PetitPotam: NTLM Relay to AD CS Domain Takeover

An internal workstation coerces a domain controller into authenticating to it, relays that authentication to the AD CS Web Enrollment endpoint, and walks away with a certificate for the domain controller itself. The operator turns that certificate into a domain-controller identity and DCSyncs the entire domain. Work the coercion traffic, the certificate issuance records, and the endpoint telemetry to reconstruct an attack that never fired a single exploit.