CyberShelter - Shelter Bank Heist (GISEC 2026)
Writeup for the Shelter Bank Heist event at GISEC 2026 - LDAP injection in a bank's support lookup leaks a domain user, a BloodHound gMSA edge turns that into jump-server admin, a ligolo-ng pivot opens the firewalled parent domain, and an ESC8 NTLM relay through a hijacked SMB port into AD CS web enrollment ends with a SIDHistory golden ticket, a parent-domain DCSync, and a settled $10M transfer.