HackTheBox: Hathor
This box is rated insane difficulty on HTB. It involves us using default credentials to gain Admin access to a mojoPortal website where we can abuse a File M...
read more →Offensive security researcher focused on Windows Active Directory, Kerberos internals, and the authentication mechanisms that hold them together. Writeups, tooling, and the occasional advisory.
This box is rated insane difficulty on HTB. It involves us using default credentials to gain Admin access to a mojoPortal website where we can abuse a File M...
read more →This box is rated hard difficulty on HTB. It involves us exploiting a PHP file upload feature through null byte injection to get a low-privileged shell on th...
read more →The Windows KDC Proxy (KPSSVC, the service behind MS-KKDCP) is one of those components that quietly ends up internet-facing and rarely gets a second look. It...
read more →I spent a few weeks living inside the Windows KDC Proxy, and the short version is that it does exactly what it was designed to do, which turns out to be the ...
read more →This box is rated insane difficulty on HTB. It involves us exploiting a wide range of techniques from LDAP and command injection to crafting Golden SAML resp...
read more →Most of my time goes into how the Windows KDC decides who you get to be and what ends up in your PAC. This one started with a smaller question that had been ...
read more →Every mature blue team eventually builds detection for SharpHound. The LDAP-sweep signature is well-understood: a single source account issuing hundreds of q...
read more →SCEP is the protocol that quietly issues a large share of the certificates on a modern network. Every MDM-enrolled phone, every Intune or Jamf device, and ev...
read more →The Certificate Enrollment Web Service (CES) forwards a SAN AdditionalContext ContextItem to the CA as a SAN request attribute. Where EDITF_ATTRIBUTESUBJECTA...
read more →Why U2U, and why the acceptor side
read more →