HTB 2 Compromising a full AD environment (volume shadow copying and ntds.dit dumping) Nov 1, 2026 From normal user to domain admin with exploiting Kerberos and ESC16 Nov 1, 2026