Recon
Enumerate the domain, users, and certificate services. An ESC1-vulnerable certificate template stands out.
Foothold — ADCS ESC1
Request a certificate impersonating a privileged user via the misconfigured template, then authenticate with it.
Lateral movement — Kerberoasting
Roast service accounts, crack an offline hash, and reuse the credential.
Domain Admin — DCSync
With replication rights obtained, run DCSync to pull the krbtgt hash and forge a golden ticket.