🗂️ HTB: Fluffy

NTLMv2 → Shadow Creds → ADCS ESC1 → Pass-the-Cert → Domain Admin

Writeup is private while the box is still active. Full version will be published upon retirement.