Windows Archives - Threatninja.net

19 Sep, 2026

Hack The Box: Hercules Machine Walkthrough – Insane Diffucility

Insane Machine Bloodhound, bloodyAD, BurpSuite, Certipy, Challenges, changepassword.py, describeticket.py, dotnet, getTGT, HackTheBox, hashcat, impacket-getST, kerbrute, LDAP, odt, Penetration Testing, PowerView, python3, responder, SSO Authentication, Windows, winrmexec

Completed another Hack The Box machine: Hercules, an Insane difficulty Active Directory challenge.

This was one of the longer attack chains I have worked through, involving multiple stages across web exploitation, credential access, Active Directory enumeration, privilege escalation, AD CS, and Kerberos abuse.

The initial foothold started with LDAP username enumeration and the discovery of credentials stored in an account description. After gaining access to the Hercules Portal, a directory traversal vulnerability exposed the web.config file and its ASP.NET machineKey values. These values allowed a forged Forms Authentication cookie to impersonate web_admin.

From there, a malicious ODT upload triggered an outbound NTLM authentication attempt, allowing the NetNTLMv2 credentials for natalie.a to be captured and cracked. The recovered credentials opened the path to Shadow Credentials against bob.w and stephen.m, followed by OU permission abuse to gain control of the Auditor account.

The privilege escalation chain continued through the Forest Migration OU, where fernando.r was enabled and used to identify an ESC3 misconfiguration. An Enrollment Agent certificate was then obtained and abused to request a certificate for ashley.b, leading to further access within the domain.

The final stages involved controlling IIS_Administrator, taking control of the iis_webserver$ machine account, extracting the required Kerberos session key, and abusing S4U2self/S4U2proxy to impersonate Administrator. This ultimately provided access to the root flag under C:\Users\Admin\Desktop.

Hercules was a great exercise in chaining several seemingly separate weaknesses together rather than relying on a single vulnerability. Definitely a box that required careful enumeration and keeping track of the relationships between users, groups, OUs, certificates, and Kerberos tickets.

Documented as part of my continued HTB practice and learning in Active Directory and offensive security.

#HackTheBox #HTB #Hercules #CyberSecurity #ActiveDirectory #PenetrationTesting #RedTeam #OffensiveSecurity #BloodHound #Certipy #ADCS #ESC3 #Kerberos #ShadowCredentials #PrivilegeEscalation #InfoSec #CyberSecurityLearning …

Learn MoreHack The Box: Hercules Machine Walkthrough – Insane Diffucility

5 Sep, 2026

Hack The Box: Pirate Machine Walkthrough – Hard Difficulity

Hard Machine ADFS, ADFSDump, BloodHoundCE, bloodyAD, Certipy, Challenges, evil-winrm, GMSA, gMSADumper, HackTheBox, kerberos, Ligolo-ng, ntlmrelay, nxc, Penetration Testing, PowerView, rustscan, Windows, winrmexec

Completed the Hack The Box “Pirate” machine, a hard-difficulty Active Directory challenge that required chaining multiple attack paths rather than relying on a single vulnerability.

The enumeration phase uncovered domain users, pre-created computer accounts, GMSAs, delegation relationships, and an exposed internal network. Access to gMSA_ADFS_prod$ led to DC01 and enabled an internal pivot to WEB01. From there, the attack chain involved GMSA credential retrieval, NTLM relay, authentication coercion, shadow credentials, certificate-based authentication, and Kerberos ticket abuse.

The privilege escalation path continued through constrained delegation and resource-based constrained delegation. Kerberos ticket manipulation ultimately provided Administrator access to the domain controller, followed by a SYSTEM-level shell and extraction of domain credentials from NTDS.dit. Both the user and root flags were successfully obtained.

Another challenging AD machine completed and another deep dive into Windows authentication, delegation, and privilege escalation.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #ActiveDirectory #RedTeam #Kerberos #NTLMRelay #ShadowCredentials #GMSA #PrivilegeEscalation #WindowsSecurity #Cybersecurity #Infosec #HTBWriteup …

Learn MoreHack The Box: Pirate Machine Walkthrough – Hard Difficulity

25 Jul, 2026

Hack The Box: Fries Machine Walkthrough – Hard Difficulty

Hard Machine Bloodhound, Certipy, Challenges, DebugFS, docker, Gitea, gobuster, HackTheBox, hashcat, LDAP injection, Ligolo-ng, Linux, metasploit, nfs, Penetration Testing, pgAdmin4, port forwarding, PostgreSQL, rustscan, Samba, ssh, Windows

Just wrapped up another Hack The Box machine: Fries (Hard).

TThis machine provided a realistic attack path that started with source code review in Gitea, where leaked credentials in a Git commit led to authenticated PostgreSQL RCE through pgAdmin. From there, I pivoted through the internal Docker network using Ligolo-ng, abused an exposed NFS share and debugfs to gain host access, then exploited PWM configuration weaknesses to capture LDAP credentials. The final stage involved Active Directory enumeration and AD CS (ESC6/ESC7) abuse to obtain an administrator certificate and compromise the domain. A great lab for practising web exploitation, Docker security, Linux privilege escalation, internal pivoting, and Active Directory attacks.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #RedTeam #ActiveDirectory #ADCS #Docker #Ligolo #PostgreSQL #Gitea #EthicalHacking #Writeup #CTF …

Learn MoreHack The Box: Fries Machine Walkthrough – Hard Difficulty

18 Jul, 2026

Hack The Box: Logging Machine Walkthrough – Medium Difficulty

Medium Machine Bloodhound, bloodyAD, Certipy, Challenges, DLL Hijacking, evil-winrm, getTGT, HackTheBox, IIS, kerberos, nxc, Penetration Testing, Rubeus, smbclient, smbmap, ticketconverter, Windows, Wsuks, WSUS

Completed another Hack The Box machine focused on Active Directory exploitation and privilege escalation.

The attack involved SMB enumeration, credential discovery through log analysis, Kerberos authentication, Shadow Credentials abuse, and DLL hijacking to gain user-level access. Further enumeration revealed a WSUS infrastructure weakness, allowing exploitation through Kerberos delegation abuse, certificate-based authentication, and a WSUS machine-in-the-middle attack to achieve Domain Admin privileges. This challenge strengthened my understanding of modern AD attack paths, Kerberos abuse techniques, and enterprise infrastructure security.

#HackTheBox #HTB #CyberSecurity #ActiveDirectory #RedTeam #PenetrationTesting #OffensiveSecurity #EthicalHacking #InfoSec …

Learn MoreHack The Box: Logging Machine Walkthrough – Medium Difficulty

20 Jun, 2026

Hack The Box: Nanocorp Machine Walkhtrough – Hard Difficulity

Hard Machine Bloodhound, bloodyAD, BurpSuite, Challenges, CheckMK Agent, CVE-2024-0670, evil-winrm, gobuster, HackTheBox, hashcat, responsder, Windows

We completed the “Nanocorp” Active Directory lab on Hack The Box, covering full chain exploitation from initial access to domain compromise.

User access was achieved by exploiting a ZIP extraction flaw in a recruitment portal, leading to NTLM hash capture via a malicious .library-ms file and credential recovery for web_svc. Active Directory misconfigurations allowed privilege escalation to monitoring_svc through BloodHound-guided abuse of ForceChangePassword rights.

Root access was obtained after enumerating CheckMK Agent 2.1 on the Domain Controller. A web shell enabled command execution as web_svc, followed by exploitation of the CheckMK MSI repair process (CVE-2024-0670) using RunasCs to achieve SYSTEM-level access.

#HackTheBox #ActiveDirectory #Pentesting #RedTeam #PrivilegeEscalation #CyberSecurity #WindowsDomain #BloodHound …

Learn MoreHack The Box: Nanocorp Machine Walkhtrough – Hard Difficulity

23 May, 2026

Hack The Box: MonitorsFour Machine Walkthrough – Easy Diffucilty

Easy Machine BurpSuite, cacti, Challenges, CVE-2025-24367, docker, Docker API Abuse, gobuster, HackTheBox, Linux, Penetration Testing, rustscan, Windows

Wrapped up another solid box with a clean chain from web exploitation to full host compromise.

Gained initial access through an IDOR vulnerability on the /user endpoint, which exposed an admin hash that cracked to wonderful1. This provided access to the Cacti dashboard as marcus. From there, exploiting CVE-2025-24367 led to a reverse shell inside a Docker container as www-data, where the user flag was retrieved.

Privilege escalation came from spotting an exposed Docker API. By deploying a privileged container and mounting the host filesystem, it was possible to break out of the container and access the Windows host, ultimately retrieving the root flag.

Nice reminder of how small web flaws can cascade into full infrastructure compromise when combined with misconfigurations like exposed Docker daemons.

#cybersecurity #penetrationtesting #redteam #docker #privilegeescalation #websecurity #ethicalhacking #infosec …

Learn MoreHack The Box: MonitorsFour Machine Walkthrough – Easy Diffucilty

9 May, 2026

Hack The Box: Overwatch Machine Walkthrough- Medium Difficulity

Medium Machine Binary Exploitation, bloodyAD, Challenges, command injection, HackTheBox, MSSQL, NetExec, Penetration Testing, port forwarding, PowerView, responder, SMB & Kerberos Attacks, SOAP, Windows

Just completed “Overwatch” — Medium difficulty machine on Hack The Box! ✅

This Windows AD environment provided an excellent learning experience combining reconnaissance, service enumeration, and creative privilege escalation techniques.

After gaining initial access via a low-privileged service account and securing a stable WinRM shell, post-exploitation enumeration quickly led to the first flag on the user’s desktop.

For privilege escalation, I focused on an internally exposed service that contained a dangerous command injection vulnerability. By exploiting this flaw, I was able to create a new administrator account, elevate my privileges, and eventually compromise the Administrator user — granting full system control and allowing retrieval of the final flag.

Really enjoyed the logical flow and the clever abuse of internal services in this box!

#HackTheBox #HTB #PenetrationTesting #CyberSecurity #EthicalHacking #ActiveDirectory #PrivilegeEscalation #RedTeam #Infosec …

Learn MoreHack The Box: Overwatch Machine Walkthrough- Medium Difficulity

11 Apr, 2026

Hack The Box: Eighteen Machine Walkthrough – Easy Difficulity

Easy Machine BadSuccessor.ps1, Challenges, DMSA, evil-winrm, HackTheBox, impacket-getST, Ligolo-ng, mssqlclient, nxc, Penetration Testing, secretdump, Windows

Just completed the Eighteen machine on Hack The Box — a great example of chaining multiple techniques from initial access to full domain compromise.

Gained initial foothold by cracking WinRM credentials (adam.scott / iloveyou1) and accessing the system via Evil-WinRM. From there, escalated privileges by abusing Delegated Managed Service Accounts (DMSA) using BadSuccessor, allowing impersonation of the Administrator.

Set up a Ligolo-ng tunnel to reach the domain controller, leveraged Kerberos ticket abuse with Impacket, and successfully dumped NTDS secrets. This led to extracting the Administrator NTLM hash and achieving full system compromise via Pass-the-Hash.

A solid walkthrough covering credential abuse, AD misconfigurations, Kerberos attacks, and pivoting techniques.

#HackTheBox #CyberSecurity #RedTeam #PenetrationTesting #ActiveDirectory #Kerberos #PrivilegeEscalation #EthicalHacking #Infosec #OffensiveSecurity …

Learn MoreHack The Box: Eighteen Machine Walkthrough – Easy Difficulity

4 Apr, 2026

Hack The Box: Darkzero Machine – Hard Difficulity

Hard Machine Bloodhound, certif, Certify, Challenges, chisel, evil-winrm, HackTheBox, ligolo, mssqlclient, openssl, Penetration Testing, proxychains, python3, rubeus.exe, secretdump, ticketconverter, Windows

Just completed the DarkZero machine from HackTheBox (Hard difficulty)!

After gaining a foothold on DC02 via a misconfigured MSSQL linked server and escalating to local Administrator using SigmaPotato token impersonation + RunasCs, we successfully captured the user flag from the Administrator’s desktop.

Dumped the domain Administrator NT hash with secretsdump, then used Evil-WinRM to get a full shell as Administrator on DC02 and retrieved the root flag.

#HackTheBox #HTB #Pentesting #ActiveDirectory #RedTeam #CyberSecurity #PrivilegeEscalation …

Learn MoreHack The Box: Darkzero Machine – Hard Difficulity

7 Feb, 2026

Hack The Box: Signed Machine Walkthrough – Medium Difficulity

Medium Machine Challenges, HackTheBox, hashcat, kerberos, Penetration Testing, responder, SQL, Windows

After escalating to a SYSTEM-level PowerShell reverse shell using xp_cmdshell and a base64-encoded payload that called back to my netcat listener on port 9007, I navigated to the user profile and read the user flag directly with type user.txt.

With full sysadmin rights on the SQL instance as SIGNED\Administrator (thanks to a forged silver ticket with Domain Admins membership), I enabled xp_cmdshell, launched a reverse shell to land SYSTEM access, then grabbed the root flag from

Box fully pwned — domain admin and SYSTEM in the bag!

#HackTheBox #HTBSigned #PenetrationTesting #CyberSecurity #PrivilegeEscalation #ActiveDirectory #RedTeam #CTF #EthicalHacking #OffensiveSecurity …

Learn MoreHack The Box: Signed Machine Walkthrough – Medium Difficulity

Threatninja.net

Threatninja.net

Tag Archives: Windows