5 posts
Hack The Box write-up for the Administrator machine. GenericAll over a user chains into password resets through three accounts, FTP access recovers a Password Safe database, cracked credentials land a shell as a fourth user, targeted Kerberoasting via GenericWrite recovers a fifth account, and DCSync extracts the domain administrator's hash.
Hack The Box write-up for the Tombwatcher machine. WriteSPN over Alfred enables a targeted Kerberoast, cracked credentials chain through group self-enrollment, gMSA password extraction, a sequence of ACL abuses across four accounts, and a WinRM shell on the DC. GenericAll over the ADCS OU leads to the AD Recycle Bin, where a deleted cert_admin account maps to an unresolved SID with enrollment rights on a schema version 1 template, and an ESC15 enrollment agent hijack escalates to Domain Admin.
Hack The Box write-up for the Certified machine. WriteOwner over a delegation group chains into GenericWrite for Shadow Credentials on a service account, WinRM lands a shell, GenericAll over the CA operator enables a second Shadow Credentials attack, and an ADCS ESC9 UPN hijack escalates to Domain Admin.
Hack The Box write-up for the Cascade machine. Anonymous LDAP leaks a legacy password attribute, a TightVNC blob and a .NET audit tool give up reused service-account credentials, and the AD Recycle Bin recovers a deleted TempAdmin whose password matches the domain administrator.
Hack The Box write-up for the Monteverde machine. Anonymous RPC user enumeration feeds a username-as-password spray, a service account exposes a stored Azure credential over SMB, and Azure AD Connect credential extraction hands over the on-prem Administrator.