# HTB-Certified 2026-01-24 3 min read Using the provided creds I start off by running an enum scan of the target: BloodHound BloodyAD certipy-ad ADCS enum4linux WriteOwner ESC9 GenericWrite GenericAll Read