🗂️ HTB: Tombwatcher

gMSA → ACL pivot → restore deleted obj → CVE-2024-49019 → Domain Admin

Writeup is private while the box is still active. Full version will be published upon retirement.