How we did it

• Used employee dual-domain access to pivot into management networks.
• Extracted Azure AD Connector database for admin access.
• Gained full control over vSphere via weak authentication.

Conclusion

Without strong segmentation and access controls, an attacker could move laterally and compromise critical infrastructure. Security baselines were enforced to prevent future risks.