Byte JMP

Security research, CTF write-ups, and notes on how things break.

2026

September

Tombwatcher: Targeted Kerberoasting to AD Recycle Bin and ADCS ESC15

Hack The Box write-up for the Tombwatcher machine. WriteSPN over Alfred enables a targeted Kerberoast, cracked credentials chain through group self-enrollment, gMSA password extraction, a sequence of ACL abuses across four accounts, and a WinRM shell on the DC. GenericAll over the ADCS OU leads to the AD Recycle Bin, where a deleted cert_admin account maps to an unresolved SID with enrollment rights on a schema version 1 template, and an ESC15 enrollment agent hijack escalates to Domain Admin.

Sep 15, 2026—17 min read

◆

Kerberoasting: A Complete Guide from Theory to Exploitation in Active Directory

How any authenticated domain user can extract service account password hashes from Active Directory using legitimate Kerberos functionality, and crack them offline. Theory grounded in RFC 4120, lab setup, multiple exploitation paths, and cracking strategies.

Sep 14, 2026—16 min read

◆

Certified: ACL Abuse and ADCS ESC9

Hack The Box write-up for the Certified machine. WriteOwner over a delegation group chains into GenericWrite for Shadow Credentials on a service account, WinRM lands a shell, GenericAll over the CA operator enables a second Shadow Credentials attack, and an ADCS ESC9 UPN hijack escalates to Domain Admin.

Sep 13, 2026—16 min read

◆

Heist: Cisco Config Credential Reuse to Firefox Credential Leak

Hack The Box write-up for the Heist machine. A support portal with guest access exposes a Cisco router configuration containing encrypted credentials. Cracking and decoding recovers three passwords, one of which maps to a Windows account via password spraying. RID brute force reveals additional users and a second valid credential pair lands WinRM as Chase. The Mozilla Maintenance Service log leaks the Administrator password in a command line argument, completing the box.

Sep 12, 2026—9 min read

◆

ServMon: NVMS-1000 Directory Traversal to NSClient++ RCE

Hack The Box write-up for the ServMon machine. Anonymous FTP exposes internal notes pointing to a password file on a user's desktop, a directory traversal in NVMS-1000 reads the file remotely, password spraying lands SSH as Nadine, and authenticated RCE against NSClient++ through an SSH tunnel escalates to SYSTEM.

Sep 11, 2026—11 min read

◆

Blackfield: AS-REP Roasting to LSASS Dump and SeBackupPrivilege

Hack The Box write-up for the Blackfield machine. Guest SMB access leaks a user list from the profiles$ share, AS-REP roasting cracks the support account, BloodHound reveals ForceChangePassword over audit2020, the forensic share yields an LSASS dump with svc_backup's NT hash, and SeBackupPrivilege extracts ntds.dit for full domain compromise.

Sep 10, 2026—13 min read

◆

Puppy: KeePass Recovery to DPAPI Credential Theft

Hack The Box write-up for the Puppy machine. ACL abuse through nested group membership grants access to a development share holding a KeePass database, cracked passwords pivot through a chain of GenericAll to enable a disabled account and land a shell, a backup archive leaks LDAP bind credentials, and DPAPI decryption of a stored Windows credential recovers an administrative account.

Sep 9, 2026—16 min read

◆

Windows Privilege Escalation: Service Binary Hijacking

From a low privileged domain user to NT AUTHORITY\SYSTEM by overwriting a service executable that weak file permissions left writable. Lab setup, enumeration, and exploitation.

Sep 8, 2026—21 min read

◆

AS-REP Roasting: Exploiting Accounts Without Kerberos Pre-Authentication

How disabling Kerberos pre-authentication hands attackers an offline password crack with no credentials required. Lab setup, enumeration, exploitation, and offline cracking.

Sep 7, 2026—8 min read

◆

Windows Privilege Escalation: SeBackupPrivilege

From Backup Operators to Domain Admin. Exploiting SeBackupPrivilege to bypass NTFS ACLs, extract ntds.dit or SAM hives, dump hashes offline, and Pass-the-Hash to SYSTEM.

Sep 6, 2026—11 min read

◆

Cascade: Legacy LDAP Secrets to AD Recycle Bin

Hack The Box write-up for the Cascade machine. Anonymous LDAP leaks a legacy password attribute, a TightVNC blob and a .NET audit tool give up reused service-account credentials, and the AD Recycle Bin recovers a deleted TempAdmin whose password matches the domain administrator.

Sep 5, 2026—14 min read

◆

Monteverde: Azure AD Connect to Domain Admin

Hack The Box write-up for the Monteverde machine. Anonymous RPC user enumeration feeds a username-as-password spray, a service account exposes a stored Azure credential over SMB, and Azure AD Connect credential extraction hands over the on-prem Administrator.

Sep 5, 2026—13 min read

◆

Timelapse: PFX Cracking to LAPS

Hack The Box write-up for the Timelapse machine. Anonymous SMB exposes a password-protected WinRM certificate backup, cracked to gain a foothold over TLS, PowerShell console history leaks a service account, and LAPS_Readers membership hands over the local Administrator password.

Sep 5, 2026—11 min read

◆

Fluffy: Shadow Credentials and ADCS ESC16

Active Directory chain — CVE-2025-24071 hash leak, Shadow Credentials via GenericWrite, and ADCS ESC16 UPN hijack to Domain Admin.

Sep 4, 2026—17 min read

◆

Sauna: AS-REP Roasting to DCSync

Hack The Box write-up for the Sauna machine. Employee names from a website feed Kerberos user enumeration, AS-REP roasting yields credentials, autologon secrets pivot to a service account with DCSync rights, and pass-the-hash completes the domain compromise.

Sep 3, 2026—12 min read

◆

Return: LDAP Credential Capture to Server Operators Abuse

Hack The Box write-up for the Return machine. LDAP credential capture via printer admin panel, WinRM access, and privilege escalation abusing the Server Operators group.

Sep 2, 2026—6 min read

July

◆

Breaking Databasement: From IDOR to RCE in a Backup Management Platform

Two high-severity vulnerabilities in Databasement v1.5.5 chain together for full server compromise via cross-tenant data exfiltration and remote code execution.

Jul 1, 2026—13 min read

May

◆

The Potato Family — Windows Privilege Escalation (2016–2024)

Comprehensive guide to the Potato family of Windows privilege escalation exploits. From Hot Potato to Silver Potato, covering SeImpersonatePrivilege abuse, DCOM/RPC coercion, and NTLM relay techniques.

May 25, 2026—16 min read

2025

June

◆

Sense: Authenticated RCE on pfSense

Hack The Box write-up for the Sense machine. Credential discovery via exposed text files leads to authenticated command injection on pfSense 2.1.3, resulting in root shell access.

Jun 30, 2025—9 min read

◆

CSRF Vulnerability in Node.js – AppSecMaster Challenge

Walkthrough of a CSRF vulnerability exploitation in a Node.js Express application. From code review to payload delivery, demonstrating password change via cross-site request forgery.

Jun 23, 2025—15 min read

◆

Lord of SQL Injection – Part 1: Gremlin, Cobolt & Goblin

First three levels of Lord of SQL Injection: bypassing authentication on Gremlin, Cobolt, and Goblin with increasingly strict filters.

Jun 22, 2025—7 min read

◆

Flag Command – Hack The Box

Solving Flag Command (HackTheBox): a web challenge hiding secrets in JavaScript client-side logic.

Jun 18, 2025—5 min read

◆

SpookPass – Hack The Box

Reverse engineering SpookPass (HackTheBox): analyzing an ELF binary to extract the hidden password.

Jun 18, 2025—6 min read