Impel: Mapping the RPC Coercion Surface on Windows Server 2025
This post covers Impel, a Linux-native RPC coercion surface scanner we built as the final tool in our Windows authentication coercion research series. The pr...
Recent Posts
Windows Authentication Reflection, Part 2: CVE-2026-24294 in the Lab
Part one covered the mechanic and the lineage. This part is operational. We reproduce CVE-2026-24294 against a default Windows Server 2025 environment, docum...
Windows Authentication Reflection, Part 1: The Mechanic and Its Lineage
Authentication reflection is a family of attacks that keeps getting declared dead and keeps coming back. It looks like a footnote to NTLM relay until you exa...
HackTheBox: Vintage
This box is rated hard difficulty on HTB. It involves us enumerating a pre-created machine account whose password is the same as its samAccountName value. Fr...
HackTheBox: Cerberus
This box is rated hard difficulty on HTB. It involves us compromising a Linux web server running an outdated version of Icinga Web 2 through a File Disclosur...
HackTheBox: Search
This box is rated hard difficulty on HTB. It involves us finding a plaintext user password in one of the website’s images and using that account to Kerberoas...
Windows Authentication Coercion to NTLM Relay, Part 4: LDAP/LDAPS Relay and ESC8 Against Server 2025 Defaults
All testing in this writeup was performed in an isolated, fully self-contained lab environment (corp.lab) with no internet connectivity and no production ...
Windows Authentication Coercion to NTLM Relay, Part 3: The Matrix
In Part 1 and Part 2 of this series I laid out the research goal: build an isolated lab running current Windows Server 2025 defaults, then systematically tes...
HackTheBox: Phantom
This box is rated medium difficulty on HTB. It involves us finding a default password in an onboarding PDF located inside of a Guest-readable SMB share. Spra...
Windows Authentication Coercion to NTLM Relay, Part 2: Relay Target Mechanics
Part 1 covered the shape of the chain: coercion produces an authentication attempt, relay forwards it somewhere useful, and the protections that matter all l...