HackTheBox: Search
This box is rated hard difficulty on HTB. It involves us finding a plaintext user password in one of the website’s images and using that account to Kerberoas...
Recent Posts
Windows Authentication Coercion to NTLM Relay, Part 4: LDAP/LDAPS Relay and ESC8 Against Server 2025 Defaults
All testing in this writeup was performed in an isolated, fully self-contained lab environment (corp.lab) with no internet connectivity and no production ...
Windows Authentication Coercion to NTLM Relay, Part 3: The Matrix
In Part 1 and Part 2 of this series I laid out the research goal: build an isolated lab running current Windows Server 2025 defaults, then systematically tes...
HackTheBox: Phantom
This box is rated medium difficulty on HTB. It involves us finding a default password in an onboarding PDF located inside of a Guest-readable SMB share. Spra...
Windows Authentication Coercion to NTLM Relay, Part 2: Relay Target Mechanics
Part 1 covered the shape of the chain: coercion produces an authentication attempt, relay forwards it somewhere useful, and the protections that matter all l...
Windows Authentication Coercion to NTLM Relay, Part 1: Fundamentals
Every technique in this series traces back to one design decision in Windows authentication: a machine will authenticate to whatever endpoint it’s told to co...
AD CS Abuse Research, Part 5: OID and Issuance Policy Abuse, and the Complete ESC Reference
This post covers ESC13 and ESC15 as full deep dives, then provides a consolidated reference for the remaining ESC techniques across the full taxonomy. The go...
AD CS Abuse Research, Part 4: Relay-Based Attacks (ESC8, ESC11)
This post covers the relay attack class in AD CS, where an attacker coerces authentication from a target machine, relays those credentials to a CA enrollment...
AD CS Abuse Research, Part 3: AD Object Write Primitives
This post covers the AD object write attack class, where a write primitive on a PKI or account object is sufficient to introduce or directly exploit a certif...
AD CS Abuse Research, Part 2: Weak Mapping and the ESC9/ESC10 Attack Class
This post covers the certificate-to-account mapping layer in Active Directory and how it becomes an attack surface. It walks through the KB5014754 strong map...