TombWatcher — HackTheBox Writeup
Henry → targeted Kerberoast on Alfred → AddSelf to INFRASTRUCTURE → ReadGMSAPassword on ansible_dev$ → Sam → John → WinRM pivot → reanimate tombstoned cert_admin via John’s GenericAll on OU=ADCS → ESC15 (CVE-2024-49019) on the WebServer template → Administrator.