HackTheBox Pro Lab: Kaiju — Apache Struts2 RCE, Exchange ProxyShell & ADCS ESC1 Domain Takeover

Full walkthrough of HackTheBox Kaiju Pro Lab — Apache Struts2 RCE for initial access, Jenkins credential pivot, Exchange ProxyShell (CVE-2021-34473) for lateral movement, ADCS ESC1 certificate abuse to forge a Domain Admin certificate, and full DCSync.