From web app to Domain Admin: a walkthrough of the Dracarys lab
A technical walkthrough of the Dracarys GOAD lab: exploiting GLPI CVE-2025-24799 for initial access, leveraging the Dollar Ticket Kerberos attack, SPN jacking via WriteSPN abuse with KrbNixPwn, and extracting Domain...