Windows Authentication Coercion to NTLM Relay, Part 1: Fundamentals
Every technique in this series traces back to one design decision in Windows authentication: a machine will authenticate to whatever endpoint it’s told to co...
Recent Posts
AD CS Abuse Research, Part 5: OID and Issuance Policy Abuse, and the Complete ESC Reference
This post covers ESC13 and ESC15 as full deep dives, then provides a consolidated reference for the remaining ESC techniques across the full taxonomy. The go...
AD CS Abuse Research, Part 4: Relay-Based Attacks (ESC8, ESC11)
This post covers the relay attack class in AD CS, where an attacker coerces authentication from a target machine, relays those credentials to a CA enrollment...
AD CS Abuse Research, Part 3: AD Object Write Primitives
This post covers the AD object write attack class, where a write primitive on a PKI or account object is sufficient to introduce or directly exploit a certif...
AD CS Abuse Research, Part 2: Weak Mapping and the ESC9/ESC10 Attack Class
This post covers the certificate-to-account mapping layer in Active Directory and how it becomes an attack surface. It walks through the KB5014754 strong map...
AD CS Abuse Research, Part 1: PKI Internals and Certificate Enrollment
This post covers the foundational mechanics of Active Directory Certificate Services: how the PKI trust model is structured in AD, where configuration lives ...
HackTheBox: Sizzle
This box is rated insane difficulty on HTB. It involves finding a writeable directory in an SMB share that we mounted, leading to an NTLMv2 hash theft and th...
DeleGator: Building and Testing a Linux-Native Kerberos Delegation Abuse Framework
This writeup covers the development, architecture, and OPSEC testing of DeleGator — a Linux-native Active Directory delegation abuse framework. It is split i...
HackTheBox: Zipper
This box is rated hard difficulty on HTB. It involves us discovering a Zabbix instance on a web server that allows for guest logins. Using an event notice, w...
HackTheBox: Sekhmet
This box is rated insane difficulty on HTB. It involves us getting a foothold on a domain-joined Linux web server through insecure deserialization. Then we d...