impacket-lookupsid

Active Directory machine where MSSQL abuse leaks credentials that feed into an AD CS certificate attack for full domain compromise.

Active Directory box where exposed SMB shares leak credentials that get reused, then Backup Operators membership is abused to dump domain hashes.