HackTheBox - Timelapse

Timelapse is an Easy Windows box: access an SMB share to get a password-protected zip, crack it with John, extract a PFX certificate, crack that too, and use it for WinRM login. A PowerShell history file reveals svc_deploy credentials, part of the LAPS_Readers group, allowing retrieval of the Administrator password.