Rebound HackTheBox | Detailed Writeup | by 0xleksa | Apr, 2025
Seems like delegator$ is able to delegate to http/dc01.rebound.htb, so i will attempt the traditional method of abusing this delegation by obtaining a service ticket combining the use of S4U2self