The engagement started with a single low-privilege domain user and a promise from the client that “AD is pretty locked down these days.” Reader, it was not.
The foothold
A password spray with one seasonal guess got a helpdesk account. Nothing special — until you notice the account is a member of a group that, three reorganizations ago, was granted GenericWrite over a service account. Nobody remembers why. Nobody ever does.
The pivot
GenericWrite over a user is enough to configure a fake SPN and Kerberoast it offline. The service account’s password was chosen by a human in 2018, which is to say it fell in minutes. That account, in turn, had DCSync-adjacent rights it should never have held.
The point
None of this was a vulnerability in the CVE sense. Every step was a feature working exactly as designed, chained through years of accumulated “we’ll clean that up later.” The report’s remediation section was longer than the exploit, and far less fun to write.