Reset — TryHackMe
Anonymous SMB leaks a default onboarding password; AS-REP roasting cracks TABATHA_BRITT; a three-link BloodHound ACL chain of forced password resets leads to DARLA_WINTERS, whose constrained delegation with protocol transition lets us impersonate Administrator via S4U2Self/S4U2Proxy for a full domain dump.