Red-Team 1 Abusing GPO Delegation - From WriteDACL to Local Admin via NTLM Relay and SYSVOL Hijacking Dec 29, 2025