Tag Windows

Hack The Box: Garfield Machine Walkthrough – Hard Difficulity

Just wrapped up the Hard-difficulty “Garfield” machine on Hack The Box which a really enjoyable Active Directory challenge.

The box starts with low-privilege domain credentials and requires solid enumeration to identify interesting attack paths. From there it moves into abusing writable attributes for initial code execution, pivoting through an internal network, and eventually targeting a read-only domain controller. The privilege escalation path involves computer account creation, resource-based constrained delegation, extraction of RODC-specific Kerberos material, and forging a golden ticket to achieve Domain Admin.

It was great practice for real-world AD red teaming techniques, especially around RODCs, Kerberos ticket manipulation, and modern delegation attacks. Highly recommend it if you’re looking to sharpen your Active Directory skills.

#HackTheBox #HTB #ActiveDirectory #RedTeam #CyberSecurity #PenetrationTesting #Kerberos #RODC #GoldenTicket #InfoSec

Hack The Box: Checkpoint Machine Walkthrough Medium Difficulty

Just finished the Checkpoint machine on Hack The Box (Medium difficulty) and it was a really enjoyable Active Directory box with some modern and creative attack paths.

I started with the provided credentials for `alex.turner`. After some enumeration I discovered that a previously deleted account (`mark.davies`) could be restored and that this account had write access to a share called DevDrop. This share was used by the organisation to stage VS Code extensions.

By creating a malicious VSIX extension targeting VS Code engine version 1.118.0 and dropping it on the share, a scheduled task automatically installed the extension and gave me a reverse shell as `ryan.brooks`. This was a really clean example of abusing enterprise software deployment processes.

From the `ryan.brooks` foothold I used Rubeus to obtain a TGT, then leveraged bloodyAD to create a malicious dMSA under a writable OU and impersonated a higher-privileged account. This eventually granted access to a VMBackups share containing a Windows Server memory dump. Using Volatility I extracted the local Administrator NTLM hash from the dump, authenticated with Evil-WinRM, and captured the root flag.

Overall, Checkpoint does a great job of chaining together several current techniques: writable shares for extension abuse, deleted object restoration, dMSA abuse, and memory forensics. It’s a solid Medium box that feels realistic and rewards careful enumeration.

Would recommend it to anyone working on modern Windows / Active Directory attack paths.

#HackTheBox #CyberSecurity #PenetrationTesting #ActiveDirectory #RedTeam #HTB #InfoSec #WindowsSecurity #PrivilegeEscalation #Kerberos #MemoryForensics

Hack The Box: Hercules Machine Walkthrough – Insane Diffucility

Completed another Hack The Box machine: Hercules, an Insane difficulty Active Directory challenge.

This was one of the longer attack chains I have worked through, involving multiple stages across web exploitation, credential access, Active Directory enumeration, privilege escalation, AD CS, and Kerberos abuse.

The initial foothold started with LDAP username enumeration and the discovery of credentials stored in an account description. After gaining access to the Hercules Portal, a directory traversal vulnerability exposed the web.config file and its ASP.NET machineKey values. These values allowed a forged Forms Authentication cookie to impersonate web_admin.

From there, a malicious ODT upload triggered an outbound NTLM authentication attempt, allowing the NetNTLMv2 credentials for natalie.a to be captured and cracked. The recovered credentials opened the path to Shadow Credentials against bob.w and stephen.m, followed by OU permission abuse to gain control of the Auditor account.

The privilege escalation chain continued through the Forest Migration OU, where fernando.r was enabled and used to identify an ESC3 misconfiguration. An Enrollment Agent certificate was then obtained and abused to request a certificate for ashley.b, leading to further access within the domain.

The final stages involved controlling IIS_Administrator, taking control of the iis_webserver$ machine account, extracting the required Kerberos session key, and abusing S4U2self/S4U2proxy to impersonate Administrator. This ultimately provided access to the root flag under C:\Users\Admin\Desktop.

Hercules was a great exercise in chaining several seemingly separate weaknesses together rather than relying on a single vulnerability. Definitely a box that required careful enumeration and keeping track of the relationships between users, groups, OUs, certificates, and Kerberos tickets.

Documented as part of my continued HTB practice and learning in Active Directory and offensive security.

#HackTheBox #HTB #Hercules #CyberSecurity #ActiveDirectory #PenetrationTesting #RedTeam #OffensiveSecurity #BloodHound #Certipy #ADCS #ESC3 #Kerberos #ShadowCredentials #PrivilegeEscalation #InfoSec #CyberSecurityLearning

Hack The Box: Pirate Machine Walkthrough – Hard Difficulity

Completed the Hack The Box “Pirate” machine, a hard-difficulty Active Directory challenge that required chaining multiple attack paths rather than relying on a single vulnerability.

The enumeration phase uncovered domain users, pre-created computer accounts, GMSAs, delegation relationships, and an exposed internal network. Access to gMSA_ADFS_prod$ led to DC01 and enabled an internal pivot to WEB01. From there, the attack chain involved GMSA credential retrieval, NTLM relay, authentication coercion, shadow credentials, certificate-based authentication, and Kerberos ticket abuse.

The privilege escalation path continued through constrained delegation and resource-based constrained delegation. Kerberos ticket manipulation ultimately provided Administrator access to the domain controller, followed by a SYSTEM-level shell and extraction of domain credentials from NTDS.dit. Both the user and root flags were successfully obtained.

Another challenging AD machine completed and another deep dive into Windows authentication, delegation, and privilege escalation.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #ActiveDirectory #RedTeam #Kerberos #NTLMRelay #ShadowCredentials #GMSA #PrivilegeEscalation #WindowsSecurity #Cybersecurity #Infosec #HTBWriteup

Hack The Box: Fries Machine Walkthrough – Hard Difficulty

Just wrapped up another Hack The Box machine: Fries (Hard).

TThis machine provided a realistic attack path that started with source code review in Gitea, where leaked credentials in a Git commit led to authenticated PostgreSQL RCE through pgAdmin. From there, I pivoted through the internal Docker network using Ligolo-ng, abused an exposed NFS share and debugfs to gain host access, then exploited PWM configuration weaknesses to capture LDAP credentials. The final stage involved Active Directory enumeration and AD CS (ESC6/ESC7) abuse to obtain an administrator certificate and compromise the domain. A great lab for practising web exploitation, Docker security, Linux privilege escalation, internal pivoting, and Active Directory attacks.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #RedTeam #ActiveDirectory #ADCS #Docker #Ligolo #PostgreSQL #Gitea #EthicalHacking #Writeup #CTF

Hack The Box: Logging Machine Walkthrough – Medium Difficulty

Completed another Hack The Box machine focused on Active Directory exploitation and privilege escalation.

The attack involved SMB enumeration, credential discovery through log analysis, Kerberos authentication, Shadow Credentials abuse, and DLL hijacking to gain user-level access. Further enumeration revealed a WSUS infrastructure weakness, allowing exploitation through Kerberos delegation abuse, certificate-based authentication, and a WSUS machine-in-the-middle attack to achieve Domain Admin privileges. This challenge strengthened my understanding of modern AD attack paths, Kerberos abuse techniques, and enterprise infrastructure security.

#HackTheBox #HTB #CyberSecurity #ActiveDirectory #RedTeam #PenetrationTesting #OffensiveSecurity #EthicalHacking #InfoSec

Hack The Box: Nanocorp Machine Walkhtrough – Hard Difficulity

We completed the “Nanocorp” Active Directory lab on Hack The Box, covering full chain exploitation from initial access to domain compromise.

User access was achieved by exploiting a ZIP extraction flaw in a recruitment portal, leading to NTLM hash capture via a malicious .library-ms file and credential recovery for web_svc. Active Directory misconfigurations allowed privilege escalation to monitoring_svc through BloodHound-guided abuse of ForceChangePassword rights.

Root access was obtained after enumerating CheckMK Agent 2.1 on the Domain Controller. A web shell enabled command execution as web_svc, followed by exploitation of the CheckMK MSI repair process (CVE-2024-0670) using RunasCs to achieve SYSTEM-level access.

#HackTheBox #ActiveDirectory #Pentesting #RedTeam #PrivilegeEscalation #CyberSecurity #WindowsDomain #BloodHound

Hack The Box: MonitorsFour Machine Walkthrough – Easy Diffucilty

Wrapped up another solid box with a clean chain from web exploitation to full host compromise.

Gained initial access through an IDOR vulnerability on the /user endpoint, which exposed an admin hash that cracked to wonderful1. This provided access to the Cacti dashboard as marcus. From there, exploiting CVE-2025-24367 led to a reverse shell inside a Docker container as www-data, where the user flag was retrieved.

Privilege escalation came from spotting an exposed Docker API. By deploying a privileged container and mounting the host filesystem, it was possible to break out of the container and access the Windows host, ultimately retrieving the root flag.

Nice reminder of how small web flaws can cascade into full infrastructure compromise when combined with misconfigurations like exposed Docker daemons.

#cybersecurity #penetrationtesting #redteam #docker #privilegeescalation #websecurity #ethicalhacking #infosec

Hack The Box: Overwatch Machine Walkthrough- Medium Difficulity

Just completed "Overwatch" — Medium difficulty machine on Hack The Box! ✅

This Windows AD environment provided an excellent learning experience combining reconnaissance, service enumeration, and creative privilege escalation techniques.

After gaining initial access via a low-privileged service account and securing a stable WinRM shell, post-exploitation enumeration quickly led to the first flag on the user’s desktop.

For privilege escalation, I focused on an internally exposed service that contained a dangerous command injection vulnerability. By exploiting this flaw, I was able to create a new administrator account, elevate my privileges, and eventually compromise the Administrator user — granting full system control and allowing retrieval of the final flag.

Really enjoyed the logical flow and the clever abuse of internal services in this box!

#HackTheBox #HTB #PenetrationTesting #CyberSecurity #EthicalHacking #ActiveDirectory #PrivilegeEscalation #RedTeam #Infosec

Hack The Box: Eighteen Machine Walkthrough – Easy Difficulity

Just completed the Eighteen machine on Hack The Box — a great example of chaining multiple techniques from initial access to full domain compromise.

Gained initial foothold by cracking WinRM credentials (adam.scott / iloveyou1) and accessing the system via Evil-WinRM. From there, escalated privileges by abusing Delegated Managed Service Accounts (DMSA) using BadSuccessor, allowing impersonation of the Administrator.

Set up a Ligolo-ng tunnel to reach the domain controller, leveraged Kerberos ticket abuse with Impacket, and successfully dumped NTDS secrets. This led to extracting the Administrator NTLM hash and achieving full system compromise via Pass-the-Hash.

A solid walkthrough covering credential abuse, AD misconfigurations, Kerberos attacks, and pivoting techniques.

#HackTheBox #CyberSecurity #RedTeam #PenetrationTesting #ActiveDirectory #Kerberos #PrivilegeEscalation #EthicalHacking #Infosec #OffensiveSecurity