[HackTheBox] Certified

Just another jq Parsing / Ownership DACL Abuse / PKINIT / Shadow Credentials / ESC9 Vulnerable Template / UPN Mismatch (?) / Certificate Mapping Write-up. As is common in Windows pentests, you will start the Certified box with credentials for the fo...