HTB · Medium
VulnCicada — ADCS ESC8 relay via PetitPotam coercion to Domain Admin
NFS share leaks a user password hidden in an image post-it note; NTLM is disabled forcing Kerberos-only auth; ESC8 web enrollment relay via PetitPotam coercion yields a DC certificate and full domain compromise.
