Tag evil-winrm

Hack The Box: Garfield Machine Walkthrough – Hard Difficulity

Just wrapped up the Hard-difficulty “Garfield” machine on Hack The Box which a really enjoyable Active Directory challenge.

The box starts with low-privilege domain credentials and requires solid enumeration to identify interesting attack paths. From there it moves into abusing writable attributes for initial code execution, pivoting through an internal network, and eventually targeting a read-only domain controller. The privilege escalation path involves computer account creation, resource-based constrained delegation, extraction of RODC-specific Kerberos material, and forging a golden ticket to achieve Domain Admin.

It was great practice for real-world AD red teaming techniques, especially around RODCs, Kerberos ticket manipulation, and modern delegation attacks. Highly recommend it if you’re looking to sharpen your Active Directory skills.

#HackTheBox #HTB #ActiveDirectory #RedTeam #CyberSecurity #PenetrationTesting #Kerberos #RODC #GoldenTicket #InfoSec

Hack The Box: Pirate Machine Walkthrough – Hard Difficulity

Completed the Hack The Box “Pirate” machine, a hard-difficulty Active Directory challenge that required chaining multiple attack paths rather than relying on a single vulnerability.

The enumeration phase uncovered domain users, pre-created computer accounts, GMSAs, delegation relationships, and an exposed internal network. Access to gMSA_ADFS_prod$ led to DC01 and enabled an internal pivot to WEB01. From there, the attack chain involved GMSA credential retrieval, NTLM relay, authentication coercion, shadow credentials, certificate-based authentication, and Kerberos ticket abuse.

The privilege escalation path continued through constrained delegation and resource-based constrained delegation. Kerberos ticket manipulation ultimately provided Administrator access to the domain controller, followed by a SYSTEM-level shell and extraction of domain credentials from NTDS.dit. Both the user and root flags were successfully obtained.

Another challenging AD machine completed and another deep dive into Windows authentication, delegation, and privilege escalation.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #ActiveDirectory #RedTeam #Kerberos #NTLMRelay #ShadowCredentials #GMSA #PrivilegeEscalation #WindowsSecurity #Cybersecurity #Infosec #HTBWriteup

Hack The Box: Logging Machine Walkthrough – Medium Difficulty

Completed another Hack The Box machine focused on Active Directory exploitation and privilege escalation.

The attack involved SMB enumeration, credential discovery through log analysis, Kerberos authentication, Shadow Credentials abuse, and DLL hijacking to gain user-level access. Further enumeration revealed a WSUS infrastructure weakness, allowing exploitation through Kerberos delegation abuse, certificate-based authentication, and a WSUS machine-in-the-middle attack to achieve Domain Admin privileges. This challenge strengthened my understanding of modern AD attack paths, Kerberos abuse techniques, and enterprise infrastructure security.

#HackTheBox #HTB #CyberSecurity #ActiveDirectory #RedTeam #PenetrationTesting #OffensiveSecurity #EthicalHacking #InfoSec

Hack The Box: Nanocorp Machine Walkhtrough – Hard Difficulity

We completed the “Nanocorp” Active Directory lab on Hack The Box, covering full chain exploitation from initial access to domain compromise.

User access was achieved by exploiting a ZIP extraction flaw in a recruitment portal, leading to NTLM hash capture via a malicious .library-ms file and credential recovery for web_svc. Active Directory misconfigurations allowed privilege escalation to monitoring_svc through BloodHound-guided abuse of ForceChangePassword rights.

Root access was obtained after enumerating CheckMK Agent 2.1 on the Domain Controller. A web shell enabled command execution as web_svc, followed by exploitation of the CheckMK MSI repair process (CVE-2024-0670) using RunasCs to achieve SYSTEM-level access.

#HackTheBox #ActiveDirectory #Pentesting #RedTeam #PrivilegeEscalation #CyberSecurity #WindowsDomain #BloodHound

Hack The Box: Eighteen Machine Walkthrough – Easy Difficulity

Just completed the Eighteen machine on Hack The Box — a great example of chaining multiple techniques from initial access to full domain compromise.

Gained initial foothold by cracking WinRM credentials (adam.scott / iloveyou1) and accessing the system via Evil-WinRM. From there, escalated privileges by abusing Delegated Managed Service Accounts (DMSA) using BadSuccessor, allowing impersonation of the Administrator.

Set up a Ligolo-ng tunnel to reach the domain controller, leveraged Kerberos ticket abuse with Impacket, and successfully dumped NTDS secrets. This led to extracting the Administrator NTLM hash and achieving full system compromise via Pass-the-Hash.

A solid walkthrough covering credential abuse, AD misconfigurations, Kerberos attacks, and pivoting techniques.

#HackTheBox #CyberSecurity #RedTeam #PenetrationTesting #ActiveDirectory #Kerberos #PrivilegeEscalation #EthicalHacking #Infosec #OffensiveSecurity

Hack The Box: Darkzero Machine – Hard Difficulity

Just completed the DarkZero machine from HackTheBox (Hard difficulty)!

After gaining a foothold on DC02 via a misconfigured MSSQL linked server and escalating to local Administrator using SigmaPotato token impersonation + RunasCs, we successfully captured the user flag from the Administrator’s desktop.

Dumped the domain Administrator NT hash with secretsdump, then used Evil-WinRM to get a full shell as Administrator on DC02 and retrieved the root flag.

#HackTheBox #HTB #Pentesting #ActiveDirectory #RedTeam #CyberSecurity #PrivilegeEscalation

Hack The Box: RustyKey Machine Walkthrough – Hard Difficulity

Authenticated to rustykey.htb as bb.morgan after exploiting Kerberos flows and resolving a time sync issue: obtained a TGT (bb.morgan.ccache), set KRB5CCNAME, and used evil‑winrm to capture the user flag.
Escalated to SYSTEM by abusing machine account and delegation: IT‑COMPUTER3$ was used to modify AD protections and reset ee.reed’s password, S4U2Self/S4U2Proxy impersonation produced backupadmin.ccache, and Impacket was used to deploy a service payload to achieve a SYSTEM shell and capture the root flag.

#CyberSecurity #RedTeam #Kerberos #ActiveDirectory #PrivilegeEscalation #HackTheBox #Impacket #WindowsAD

Hack The Box: DarkCorp Machine Walkthrough – Insane Difficulity

Finished the Insane-level DarkCorp box on Hack The Box. Initial foothold came from registering on a webmail portal and abusing a contact form to deliver a payload that resulted in a reverse shell. From there I enumerated the app and DB, identified SQL injection and extracted hashes (cracked one to thePlague61780), recovered DPAPI master key material and additional credentials (Pack_beneath_Solid9!), and used those artifacts to escalate to root and retrieve root.txt. Valuable practice in web vectors, SQLi exploitation, credential harvesting, DPAPI analysis, and Windows privilege escalation. Happy to share high-level notes or mitigations.

#HackTheBox #Infosec #RedTeam #Pentesting #WindowsSecurity #CredentialHunting #CTF

Hack The Box: Certificate Machine Walkthrough – Hard Difficulty

I recently completed the "Certificate" challenge on Hack The Box: after extracting and cracking a captured authentication hash I gained access to a user account (lion.sk) and retrieved the user flag, then progressed to full system compromise by responsibly exploiting weak certificate‑based authentication controls—obtaining and converting certificate material into elevated credentials to capture the root flag. The exercise reinforced how misconfigurations in certificate services and poor time synchronization can create powerful escalation paths, and highlighted the importance of least‑privilege, strict enrollment policies, and monitoring certificate issuance. Great hands‑on reminder that defensive hygiene around PKI and identity services matters.

#CyberSecurity #HTB #Infosec #ADCS #Certificates #PrivilegeEscalation #RedTeam #Pentesting

Hack The Box: Puppy Machine Walkthrough – Medium Difficulty

Crushed the Puppy machine on HTB with surgical precision! Unlocked the user flag by leveraging levi.james credentials to access the DEV share, cracking recovery.kdbx with "Liverpool," and using ant.edwards:Antman2025! to reset ADAM.SILVER’s password, followed by a swift WinRM login to grab user.txt. For the root flag, extracted steph.cooper:ChefSteph2025! from C:\Backups, accessed a WinRM shell, and exfiltrated DPAPI keys via SMB. Impacket unveiled steph.cooper_adm:FivethChipOnItsWay2025!, opening the Administrator directory to claim root.txt.

#Cybersecurity #HackTheBox #CTF #Pentesting #PrivilegeEscalation