◆
Windows Persistence: Scheduled Tasks
How attackers use Windows Task Scheduler to survive reboots, maintain access, and execute payloads as SYSTEM. Lab setup on a Domain Controller, multiple persistence paths via CMD and PowerShell.
—19 min read
Byte JMP
Security research, CTF write-ups, and notes on how things break.
2026
September
◆
Windows Privilege Escalation: Credentials in PowerShell History (ConsoleHost_history.txt)
How the PowerShell command history file silently records credentials in cleartext, where to find it, what leaks into it, and how to turn a history file into a privilege escalation during a pentest.
—6 min read
◆
Tombwatcher: Targeted Kerberoasting to AD Recycle Bin and ADCS ESC15
Hack The Box write-up for the Tombwatcher machine. WriteSPN over Alfred enables a targeted Kerberoast, cracked credentials chain through group self-enrollment, gMSA password extraction, a sequence of ACL abuses across four accounts, and a WinRM shell on the DC. GenericAll over the ADCS OU leads to the AD Recycle Bin, where a deleted cert_admin account maps to an unresolved SID with enrollment rights on a schema version 1 template, and an ESC15 enrollment agent hijack escalates to Domain Admin.
—17 min read
◆
Kerberoasting: A Complete Guide from Theory to Exploitation in Active Directory
How any authenticated domain user can extract service account password hashes from Active Directory using legitimate Kerberos functionality, and crack them offline. Theory grounded in RFC 4120, lab setup, multiple exploitation paths, and cracking strategies.
—16 min read
◆
Certified: ACL Abuse and ADCS ESC9
Hack The Box write-up for the Certified machine. WriteOwner over a delegation group chains into GenericWrite for Shadow Credentials on a service account, WinRM lands a shell, GenericAll over the CA operator enables a second Shadow Credentials attack, and an ADCS ESC9 UPN hijack escalates to Domain Admin.
—16 min read
◆
Heist: Cisco Config Credential Reuse to Firefox Credential Leak
Hack The Box write-up for the Heist machine. A support portal with guest access exposes a Cisco router configuration containing encrypted credentials. Cracking and decoding recovers three passwords, one of which maps to a Windows account via password spraying. RID brute force reveals additional users and a second valid credential pair lands WinRM as Chase. The Mozilla Maintenance Service log leaks the Administrator password in a command line argument, completing the box.
—9 min read
◆
ServMon: NVMS-1000 Directory Traversal to NSClient++ RCE
Hack The Box write-up for the ServMon machine. Anonymous FTP exposes internal notes pointing to a password file on a user's desktop, a directory traversal in NVMS-1000 reads the file remotely, password spraying lands SSH as Nadine, and authenticated RCE against NSClient++ through an SSH tunnel escalates to SYSTEM.
—11 min read
◆
Blackfield: AS-REP Roasting to LSASS Dump and SeBackupPrivilege
Hack The Box write-up for the Blackfield machine. Guest SMB access leaks a user list from the profiles$ share, AS-REP roasting cracks the support account, BloodHound reveals ForceChangePassword over audit2020, the forensic share yields an LSASS dump with svc_backup's NT hash, and SeBackupPrivilege extracts ntds.dit for full domain compromise.
—13 min read
◆
Puppy: KeePass Recovery to DPAPI Credential Theft
Hack The Box write-up for the Puppy machine. ACL abuse through nested group membership grants access to a development share holding a KeePass database, cracked passwords pivot through a chain of GenericAll to enable a disabled account and land a shell, a backup archive leaks LDAP bind credentials, and DPAPI decryption of a stored Windows credential recovers an administrative account.
—16 min read
◆
Windows Privilege Escalation: Service Binary Hijacking
From a low privileged domain user to NT AUTHORITY\SYSTEM by overwriting a service executable that weak file permissions left writable. Lab setup, enumeration, and exploitation.
—21 min read
◆
AS-REP Roasting: Exploiting Accounts Without Kerberos Pre-Authentication
How disabling Kerberos pre-authentication hands attackers an offline password crack with no credentials required. Lab setup, enumeration, exploitation, and offline cracking.
—8 min read
◆
Windows Privilege Escalation: SeBackupPrivilege
From Backup Operators to Domain Admin. Exploiting SeBackupPrivilege to bypass NTFS ACLs, extract ntds.dit or SAM hives, dump hashes offline, and Pass-the-Hash to SYSTEM.
—11 min read
◆
Cascade: Legacy LDAP Secrets to AD Recycle Bin
Hack The Box write-up for the Cascade machine. Anonymous LDAP leaks a legacy password attribute, a TightVNC blob and a .NET audit tool give up reused service-account credentials, and the AD Recycle Bin recovers a deleted TempAdmin whose password matches the domain administrator.
—14 min read
◆
Monteverde: Azure AD Connect to Domain Admin
Hack The Box write-up for the Monteverde machine. Anonymous RPC user enumeration feeds a username-as-password spray, a service account exposes a stored Azure credential over SMB, and Azure AD Connect credential extraction hands over the on-prem Administrator.
—13 min read
◆
Timelapse: PFX Cracking to LAPS
Hack The Box write-up for the Timelapse machine. Anonymous SMB exposes a password-protected WinRM certificate backup, cracked to gain a foothold over TLS, PowerShell console history leaks a service account, and LAPS_Readers membership hands over the local Administrator password.
—11 min read
◆
Fluffy: Shadow Credentials and ADCS ESC16
Active Directory chain — CVE-2025-24071 hash leak, Shadow Credentials via GenericWrite, and ADCS ESC16 UPN hijack to Domain Admin.
—17 min read
◆
Sauna: AS-REP Roasting to DCSync
Hack The Box write-up for the Sauna machine. Employee names from a website feed Kerberos user enumeration, AS-REP roasting yields credentials, autologon secrets pivot to a service account with DCSync rights, and pass-the-hash completes the domain compromise.
—12 min read
◆
Return: LDAP Credential Capture to Server Operators Abuse
Hack The Box write-up for the Return machine. LDAP credential capture via printer admin panel, WinRM access, and privilege escalation abusing the Server Operators group.
—6 min read
2025
June
◆
Sense: Authenticated RCE on pfSense
Hack The Box write-up for the Sense machine. Credential discovery via exposed text files leads to authenticated command injection on pfSense 2.1.3, resulting in root shell access.
—9 min read
?
◆
CSRF Vulnerability in Node.js – AppSecMaster Challenge
Walkthrough of a CSRF vulnerability exploitation in a Node.js Express application. From code review to payload delivery, demonstrating password change via cross-site request forgery.
—15 min read
?
◆
Lord of SQL Injection – Part 1: Gremlin, Cobolt & Goblin
First three levels of Lord of SQL Injection: bypassing authentication on Gremlin, Cobolt, and Goblin with increasingly strict filters.
—7 min read
◆
Flag Command – Hack The Box
Solving Flag Command (HackTheBox): a web challenge hiding secrets in JavaScript client-side logic.
—5 min read
◆
SpookPass – Hack The Box
Reverse engineering SpookPass (HackTheBox): analyzing an ELF binary to extract the hidden password.
—6 min read