Series

Active Directory

[HackTheBox] Mantis
Just another IIS & MSSQL Creds Leaks / sqsh & DBeaver (TLS-free) / CVE Lookup / MS14-068 Write-up. Machine Link. IppSec Walkthough. This is the first HTB’s Active Directory machine. Foothold Open ports Scanning the ports against our target reveals ...
Sep 11, 202526 min read164
[HackTheBox] Administrator
Just another GenericAll / ForceChangePassword / Cypher / Password Safe 3 / GenericWrite & targeted kerberoast / DCSync Write-up. As is common in real life Windows pentests, you will start the Administrator box with credentials for the following acco...
Aug 19, 202510 min read187
[HackTheBox] Intelligence
Just another Pass Spray / ADIDNS Poisoning / NTLMv2 Crack / gMSA Password / Constrained Delegation (S4U) / msDS-ManagedPassword Constructed Attribute (LDAP Req) Write-up. CTF Link. IppSec Walkthrough. Foothold Open ports The SYN and NSE scan agains...
Jun 21, 202525 min read100
[HackTheBox] Timelapse
Just another ZIP & PFX Cracking / WinRM Cert Auth / PSReadLine ConsoleHost_History Leak / LAPS / RDP (socat) & SAM reg over DC (?) Write-up. Machine Link. IppSec Walkthrough. Foothold Open ports The Nmap scan reveals the following open ports: jamar...
May 30, 202522 min read273
[HackTheBox] Certified
Just another jq Parsing / Ownership DACL Abuse / PKINIT / Shadow Credentials / ESC9 Vulnerable Template / UPN Mismatch (?) / Certificate Mapping Write-up. As is common in Windows pentests, you will start the Certified box with credentials for the fo...
Mar 18, 202530 min read121
[HackTheBox] Cicada
Just another User-Description Leakage / SeBackupPrivilege Write-up. Machine link. IppSec Walkthrough. Footprinting Open ports The Nmap scan shows it’s a Windows machine (SMB:445, RPC:135/593, WinRM:5985), but more particularly a DC (LDAP:389/636, D...
Feb 16, 202518 min read53

Command Palette