◆
Fluffy: Shadow Credentials and ADCS ESC16
Active Directory chain — CVE-2025-24071 hash leak, Shadow Credentials via GenericWrite, and ADCS ESC16 UPN hijack to Domain Admin.
—17 min read
Byte JMP
Security research, CTF write-ups, and notes on how things break.
2026
September
◆
Sauna: AS-REP Roasting to DCSync
Hack The Box write-up for the Sauna machine. Employee names from a website feed Kerberos user enumeration, AS-REP roasting yields credentials, autologon secrets pivot to a service account with DCSync rights, and pass-the-hash completes the domain compromise.
—12 min read
◆
Return: LDAP Credential Capture to Server Operators Abuse
Hack The Box write-up for the Return machine. LDAP credential capture via printer admin panel, WinRM access, and privilege escalation abusing the Server Operators group.
—6 min read
2025
June
◆
Sense: Authenticated RCE on pfSense
Hack The Box write-up for the Sense machine. Credential discovery via exposed text files leads to authenticated command injection on pfSense 2.1.3, resulting in root shell access.
—9 min read
?
◆
CSRF Vulnerability in Node.js – AppSecMaster Challenge
Walkthrough of a CSRF vulnerability exploitation in a Node.js Express application. From code review to payload delivery, demonstrating password change via cross-site request forgery.
—15 min read
?
◆
Lord of SQL Injection – Part 1: Gremlin, Cobolt & Goblin
First three levels of Lord of SQL Injection — bypassing authentication on Gremlin, Cobolt, and Goblin with increasingly strict filters.
—7 min read
◆
Flag Command – Hack The Box
Solving Flag Command (HackTheBox) — a web challenge hiding secrets in JavaScript client-side logic.
—5 min read
?
◆
SpookPass – Hack The Box
Reverse engineering SpookPass (HackTheBox) — analyzing an ELF binary to extract the hidden password.
—6 min read