HTB Shibuya Walkthrough: WIM, RemotePotato0 and ADCS ESC1

Hack The Box Shibuya Write-up: Enumerate users via Kerberos, extract NTLM hashes from WIM backups, and leverage RemotePotato0 and ADCS ESC1 up to Domain Admin.