Meridian Freight, a logistics company, runs its Windows domain MERIDIAN.LAB. The database behind its Transport Management System runs under a service account, svc-mssql-tms, that carries an MSSQL Service Principal Name and a weak RC4 key, so any domain user can request its Kerberos service ticket and crack it offline. From the foothold user t.okonkwo, roast svc-mssql-tms, recover its password, and read the flag from a share only that account may open.
Not startedDockercommit e08eaebx86_64 · aarch64Secret
One-shot by default: solve each challenge from its prompt alone.
Opening guided steps or hints is recorded. A solve without them counts as stronger evidence for your skills.
From the t.okonkwo foothold, kerberoast svc-mssql-tms: request its Kerberos service ticket, crack it offline to recover svc-mssql-tms's password, then read flag.txt from the //dc/manifests share that only svc-mssql-tms may open.
The brief for this lab lives in its repository.