An assumed-breach AD box using Kerberos. Timeroast cracked IT-COMPUTER3 computer account, added to Helpdesk, removed groups from Protected Objects to reset BB.MORGAN and EE.REED passwords. Gained WinRM and RunasCs shells, abused writable 7-Zip registry DLL paths to escalate to MM.TURNER, then performed RBCD to impersonate DC and get Admin.

A full writeup of the HTB TombWatcher machine, covering a multi-stage AD privilege-escalation path. Starting from user access, it chains WriteSPN abuse, GMSA password extraction, shadow credentials, OU control, tombstone restoration, and finally an ESC15 ADCS exploit to forge an Administrator certificate and gain system compromise.