◆
Monteverde: Azure AD Connect to Domain Admin
Hack The Box write-up for the Monteverde machine. Anonymous RPC user enumeration feeds a username-as-password spray, a service account exposes a stored Azure credential over SMB, and Azure AD Connect credential extraction hands over the on-prem Administrator.
—13 min read