Security research, CTF write-ups, and notes on how things break.
How a missing pair of quotation marks in a service's ImagePath lets a low privilege user place a binary that Windows executes as SYSTEM. Theory behind CreateProcess path resolution, lab setup, enumeration, and exploitation.
How attackers use Windows Task Scheduler to survive reboots, maintain access, and execute payloads as SYSTEM. Lab setup on a Domain Controller, multiple persistence paths via CMD and PowerShell.
How the PowerShell command history file silently records credentials in cleartext, where to find it, what leaks into it, and how to turn a history file into a privilege escalation during a pentest.
Hack The Box write-up for the Tombwatcher machine. WriteSPN over Alfred enables a targeted Kerberoast, cracked credentials chain through group self-enrollment, gMSA password extraction, a sequence of ACL abuses across four accounts, and a WinRM shell on the DC. GenericAll over the ADCS OU leads to the AD Recycle Bin, where a deleted cert_admin account maps to an unresolved SID with enrollment rights on a schema version 1 template, and an ESC15 enrollment agent hijack escalates to Domain Admin.
How any authenticated domain user can extract service account password hashes from Active Directory using legitimate Kerberos functionality, and crack them offline. Theory grounded in RFC 4120, lab setup, multiple exploitation paths, and cracking strategies.
Hack The Box write-up for the Certified machine. WriteOwner over a delegation group chains into GenericWrite for Shadow Credentials on a service account, WinRM lands a shell, GenericAll over the CA operator enables a second Shadow Credentials attack, and an ADCS ESC9 UPN hijack escalates to Domain Admin.
Hack The Box write-up for the Heist machine. A support portal with guest access exposes a Cisco router configuration containing encrypted credentials. Cracking and decoding recovers three passwords, one of which maps to a Windows account via password spraying. RID brute force reveals additional users and a second valid credential pair lands WinRM as Chase. The Mozilla Maintenance Service log leaks the Administrator password in a command line argument, completing the box.
Hack The Box write-up for the ServMon machine. Anonymous FTP exposes internal notes pointing to a password file on a user's desktop, a directory traversal in NVMS-1000 reads the file remotely, password spraying lands SSH as Nadine, and authenticated RCE against NSClient++ through an SSH tunnel escalates to SYSTEM.
Hack The Box write-up for the Blackfield machine. Guest SMB access leaks a user list from the profiles$ share, AS-REP roasting cracks the support account, BloodHound reveals ForceChangePassword over audit2020, the forensic share yields an LSASS dump with svc_backup's NT hash, and SeBackupPrivilege extracts ntds.dit for full domain compromise.
Hack The Box write-up for the Puppy machine. ACL abuse through nested group membership grants access to a development share holding a KeePass database, cracked passwords pivot through a chain of GenericAll to enable a disabled account and land a shell, a backup archive leaks LDAP bind credentials, and DPAPI decryption of a stored Windows credential recovers an administrative account.
From a low privileged domain user to NT AUTHORITY\SYSTEM by overwriting a service executable that weak file permissions left writable. Lab setup, enumeration, and exploitation.
How disabling Kerberos pre-authentication hands attackers an offline password crack with no credentials required. Lab setup, enumeration, exploitation, and offline cracking.
From Backup Operators to Domain Admin. Exploiting SeBackupPrivilege to bypass NTFS ACLs, extract ntds.dit or SAM hives, dump hashes offline, and Pass-the-Hash to SYSTEM.
Hack The Box write-up for the Cascade machine. Anonymous LDAP leaks a legacy password attribute, a TightVNC blob and a .NET audit tool give up reused service-account credentials, and the AD Recycle Bin recovers a deleted TempAdmin whose password matches the domain administrator.
Hack The Box write-up for the Monteverde machine. Anonymous RPC user enumeration feeds a username-as-password spray, a service account exposes a stored Azure credential over SMB, and Azure AD Connect credential extraction hands over the on-prem Administrator.
Hack The Box write-up for the Timelapse machine. Anonymous SMB exposes a password-protected WinRM certificate backup, cracked to gain a foothold over TLS, PowerShell console history leaks a service account, and LAPS_Readers membership hands over the local Administrator password.
Active Directory chain — CVE-2025-24071 hash leak, Shadow Credentials via GenericWrite, and ADCS ESC16 UPN hijack to Domain Admin.
Hack The Box write-up for the Sauna machine. Employee names from a website feed Kerberos user enumeration, AS-REP roasting yields credentials, autologon secrets pivot to a service account with DCSync rights, and pass-the-hash completes the domain compromise.
Hack The Box write-up for the Return machine. LDAP credential capture via printer admin panel, WinRM access, and privilege escalation abusing the Server Operators group.
Hack The Box write-up for the Sense machine. Credential discovery via exposed text files leads to authenticated command injection on pfSense 2.1.3, resulting in root shell access.
Walkthrough of a CSRF vulnerability exploitation in a Node.js Express application. From code review to payload delivery, demonstrating password change via cross-site request forgery.
First three levels of Lord of SQL Injection: bypassing authentication on Gremlin, Cobolt, and Goblin with increasingly strict filters.
Solving Flag Command (HackTheBox): a web challenge hiding secrets in JavaScript client-side logic.
Reverse engineering SpookPass (HackTheBox): analyzing an ELF binary to extract the hidden password.
