◆
Pivoting with SSH Port Forwarding
How SSH tunnels let an attacker pivot through a compromised host, reach internal services invisible from the outside, and exfiltrate data through encrypted channels that blend with legitimate traffic.
—20 min read
#research
13 posts
◆
Linux Privilege Escalation: CVE-2025-32463 (sudo chroot)
How a misplaced chroot call in sudo 1.9.14 through 1.9.17 lets any local user — with no sudoers rule and no password — trick glibc into loading an attacker-controlled shared library as root. Full root cause analysis, lab reproduction, exploitation, and detection.
—20 min read
◆
Linux Privilege Escalation: Abusing make via sudo
How GNU Make's --eval flag, $(shell), and $(file) functions turn a permissive sudo rule into full root access — shell execution, arbitrary file read, and arbitrary file write — with no vulnerability involved.
—15 min read
◆
Windows Privilege Escalation: AutoLogon Credentials in the Registry
How Windows AutoLogon stores plaintext credentials in the registry under HKLM\SOFTWARE, why every authenticated user can read them, and how to turn a single reg query into privilege escalation or domain compromise during a penetration test.
—15 min read
◆
Log Poisoning: From Log Injection to Remote Code Execution
How attackers inject executable code into server log files and combine it with Local File Inclusion to turn a read primitive into full remote code execution. Covering Apache, Nginx, SSH, FTP, and SMTP across Linux and Windows environments with lab demonstrations, realistic payloads, and detection strategies.
—19 min read
◆
Windows Privilege Escalation: Unquoted Service Paths
How a missing pair of quotation marks in a service's ImagePath lets a low privilege user place a binary that Windows executes as SYSTEM. Theory behind CreateProcess path resolution, lab setup, enumeration, and exploitation.
—20 min read
◆
Windows Persistence: Scheduled Tasks
How attackers use Windows Task Scheduler to survive reboots, maintain access, and execute payloads as SYSTEM. Lab setup on a Domain Controller, multiple persistence paths via CMD and PowerShell.
—19 min read
◆
Windows Privilege Escalation: Credentials in PowerShell History (ConsoleHost_history.txt)
How the PowerShell command history file silently records credentials in cleartext, where to find it, what leaks into it, and how to turn a history file into a privilege escalation during a pentest.
—6 min read
◆
Kerberoasting: A Complete Guide from Theory to Exploitation in Active Directory
How any authenticated domain user can extract service account password hashes from Active Directory using legitimate Kerberos functionality, and crack them offline. Theory grounded in RFC 4120, lab setup, multiple exploitation paths, and cracking strategies.
—16 min read
◆
Windows Privilege Escalation: Service Binary Hijacking
From a low privileged domain user to NT AUTHORITY\SYSTEM by overwriting a service executable that weak file permissions left writable. Lab setup, enumeration, and exploitation.
—21 min read
◆
AS-REP Roasting: Exploiting Accounts Without Kerberos Pre-Authentication
How disabling Kerberos pre-authentication hands attackers an offline password crack with no credentials required. Lab setup, enumeration, exploitation, and offline cracking.
—8 min read
◆
Windows Privilege Escalation: SeBackupPrivilege
From Backup Operators to Domain Admin. Exploiting SeBackupPrivilege to bypass NTFS ACLs, extract ntds.dit or SAM hives, dump hashes offline, and Pass-the-Hash to SYSTEM.
—11 min read
◆
The Potato Family — Windows Privilege Escalation (2016–2024)
Comprehensive guide to the Potato family of Windows privilege escalation exploits. From Hot Potato to Silver Potato, covering SeImpersonatePrivilege abuse, DCOM/RPC coercion, and NTLM relay techniques.
—16 min read