AD CS Abuse Research, Part 1: PKI Internals and Certificate Enrollment
This post covers the foundational mechanics of Active Directory Certificate Services: how the PKI trust model is structured in AD, where configuration lives ...
Recent Posts
HackTheBox: Sizzle
This box is rated insane difficulty on HTB. It involves finding a writeable directory in an SMB share that we mounted, leading to an NTLMv2 hash theft and th...
DeleGator: Building and Testing a Linux-Native Kerberos Delegation Abuse Framework
This writeup covers the development, architecture, and OPSEC testing of DeleGator — a Linux-native Active Directory delegation abuse framework. It is split i...
HackTheBox: Zipper
This box is rated hard difficulty on HTB. It involves us discovering a Zabbix instance on a web server that allows for guest logins. Using an event notice, w...
HackTheBox: Sekhmet
This box is rated insane difficulty on HTB. It involves us getting a foothold on a domain-joined Linux web server through insecure deserialization. Then we d...
HackTheBox: Cereal
This box is rated hard difficulty on HTB. It involves us finding a subdomain with an exposed code repository, leading us to forge a valid JWT with a secret k...
HackTheBox: Rebound
This box is rated insane difficulty on HTB. It involves us performing unauthenticated Kerberoasting via AS-REP Roasting and cracking the hash in order to get...
HackTheBox: Freelancer
This box is rated hard difficulty on HTB. It involves us registering an account on a website where we can reset our password in order to bypass an activation...
HackTheBox: Falafel
This box is rated hard difficulty on HTB. It involves us grabbing password hashes from a website vulnerable to Time-Based SQL injection, letting us login. Us...
HackTheBox: Haze
This box is rated hard difficulty on HTB. It involves us discovering a path traversal vulnerability in Splunk that lets us grab an encrypted LDAP bind passwo...