Initial SMB share revealed reports with usernames & DNS misconfig. Performed MITM via DNS, stole NATS creds, found domain user. Kerberoasted to initial shell. Escalated using Winlogon creds, ACE ForceChangePassword, ReadGMSAPassword. Exploited ESC10 & RBCD to DCSync and get SYSTEM.