HTB · Medium
HTB Authority: Medium Walkthrough – Ansible Vault, LDAP Pass-Back, and ADCS ESC1
Anonymous SMB access to an Ansible playbook leaks a vault password, which cracks open a chain of credential pivots — an LDAP pass-back attack against a password manager — and ends in a full ADCS ESC1 compromise of the domain.
