Hey guys, im stuck in the last question " Submit the contents of C:\Flag.txt located on the Domain Controller. " i think im working more than im suppose to, i already reach the third host on the 172.16.6.25 with vfrank and i already found other host where im guesting is the Domain Controller host, im trying to log in on that machine passing the hash but i dont know if im suppose to do that or maybe i can try to create or steal a ticket with mimikatzor Rubeus. Any helps guys its appreciated, it have been a fun and learning module but its time hahahaha thanks in advanced!
enumerate closely. take a look at the file explorer. there may be something useful there.
I think I also highly overcomplicated it but at least I learnt a lot from AD 
So tips for the last question:
- don’t forget to check ipconfig and open ports (rustscan is handy)
- identify the DC and doon’t fall into the rabbithole
- just try to printout the flag on the simpliest way possible, you don’t need to get a shell in the DC - although it is possible, and to ruin the fun your user already teh Domain Admin
