YPuffy: enumerate the AD surface, abuse the exposed credential or delegation path, and escalate to Administrator.