Initial MSSQL access with provided creds revealed a linked server to DC02, enabling xp_cmdshell for lateral movement. CVE-2024-30088 granted SYSTEM on DC02 for user.txt. Unconstrained delegation on DC01 allowed TGT capture via coercion, then DCSync extracted Administrator hash for root.txt.