One Low-Privilege Domain Account and a Network You Cannot Route To

Use ssh -D 1080 to www01 with proxychains, because SSH is already there, requires zero uploads and leaves nothing persistent.

Alternatives and why they lose:

• chisel or ligolo: better throughput and ligolo gives you a real interface so you can use normal tooling and even ICMP, but both require uploading a binary to a host you are told not to install tooling on, and ligolo needs a listener plus a tun device. Keep as a fallback if SOCKS proves too slow.
• Static port forwards (ssh -L): fine for one or two ports, untenable when AD enumeration touches 88, 389, 445 and 3268 on several hosts. You would be maintaining a dozen forwards.

SOCKS caveats you must plan around: it is TCP-only, so no ICMP and no UDP - which does not matter here because Kerberos and LDAP over TCP are all you need. Nmap must run -sT -Pn -n and will be slow; never scan a /24 through SOCKS with a full port range. Configure proxy_dns in proxychains and add DC01/FS01 to /etc/hosts so names resolve remotely. Verify the tunnel with a single curl or nc to 172.16.10.10:88 before launching anything heavy.

Order by cost per credential returned, not by tool familiarity.

1. Fix Kerberos first. Your clock is 11 minutes behind; anything Kerberos-authenticated will fail with KRB_AP_ERR_SKEW and you will misread it as a bad password. Sync to the DC before the first kerberos request.
2. AS-REP roasting: one LDAP query, no authentication attempts, zero lockout risk. Any hit cracks offline. Cheapest possible win.
3. Kerberoasting: enumerate accounts with SPNs, request service tickets, crack offline. Also zero lockout risk. Prioritise service accounts with old password dates - those are the ones that crack.
4. ACL and group mapping: who is svc_deploy, what does it own, what does it control? A single GenericAll or WriteDACL edge over a group is worth more than a hundred cracked hashes. Collect with BloodHound through the proxy or with targeted ldapsearch if the collector will not tunnel cleanly.
5. Only then consider guessing, and only after proving the lockout policy.

Wrong order to avoid: spraying first. It is the loudest action available, it risks locking out the one account you have, and it is the least likely to succeed against a 12-character policy.

Work through the layers in order, because the tunnel introduces failure modes that look like authentication failures.

1. Clocks. Confirm skew is under five minutes after your sync. A stale skew produces confusing KRB errors and no lockout counter movement.
2. Name resolution. Through SOCKS, the DC's hostname must resolve to the internal address. If /etc/hosts still maps dc01.corp to something public, or DNS resolves locally, the ticket request goes to the wrong principal or the wrong host. This is the most common tunnelling error.
3. SPN correctness. The service principal must match the hostname the service is registered under. Requesting a ticket for a short name or an IP when the SPN is an FQDN returns a principal-not-found error that has nothing to do with the password.
4. Tool support. Confirm the tool actually honours the proxy - a wrapper that resolves and connects outside proxychains silently fails, and so does anything that falls back to UDP for Kerberos.

Only after all four are eliminated should you test the credential itself, and when you do, test it once against LDAP over TCP, which returns an unambiguous invalid-credentials error rather than a Kerberos code you have to interpret.