🔐 HTB: Certificate

LDAP → BloodHound → Cert template abuse → Evil-WinRM → Admin shell

Writeup is private while the box is still active. Full version will be published upon retirement.