Finally got user!
It was insane. Thanks a lot @MariaB for sharing that useful article. It helped me bypassing WAF and getting the desired hashes.Cracking the hashes must be quick, yo don’t need to complicate things.
AD enumeration was not easy. I had to write my own RIDiculous script for enumerate all the AD users.
Now on to root…