- PUBLISHED ON
- Blog Published on:
Initial MSSQL access on DC01, linked instance on DC02 enables xp_cmdshell for lateral movement. CVE-2024-30088 elevates to SYSTEM. Unconstrained delegation on DC01 coerced via MSSQL to capture TGT with Rubeus, then DCSync extracts Administrator hash for root flag.