UnChleuHacker

Credential Discovery and KerberoastingWe start with the credentials pentest / p3nt3st2025!&. An initial LDAP enumeration using BloodHound and a kerberoasting attack allow us to map the domain pirate.htb: 1bloodhound-python -u pentest -p 'p3nt3st2025!&' -d pirate.htb -ns 10.129.244.95 -c all In particular, the Kerberoasting reveals the account a.white_adm (a member of the group IT) as well as the managed service account gMSA_ADFS_prod$ (a member of Remote Management Users):...

IntroductionVintage is a Hard challenge on HackTheBox that simulates an assumed breach scenario in an Active Directory environment where NTLM is completely disabled. The entire exploit relies exclusively on Kerberos, making it an extremely educational challenge for pentesters accustomed to relying on NTLM. With the phase-out of NTLM announced by Microsoft for future versions of Windows Server, this type of environment will become the norm. We might as well prepare for it now. ConfigurationFi...

IntroductionTo truly control a Windows system, you must operate at Ring 0, i.e., the kernel. The problem is that from user mode (Ring 3), you cannot interact directly with Ring 0, so it is impossible to modify the kernel’s internal structures, disable an EDR’s monitoring mechanisms, or manipulate process protections. Tools like WinDbg allow you to explore and modify kernel memory, but they are not viable in production environments: WinDbg requires a reboot to enable debug mode, a second machi...

IntroductionClickOnce is a Microsoft deployment technology built into the .NET Framework. It allows Windows applications to be distributed via a simple URL: the user clicks a link, and the application downloads, installs, and runs with very little user interaction. The idea is not to create a malicious application from scratch, but to backdoor an existing legitimate ClickOnce application and redeploy it. The application retains its normal behavior but executes arbitrary code upon launch. Sev...

IntroductionThe previous article on Local Hollowing addressed the issue of loading native PEs into memory. The encrypted payload is decrypted, manually mapped section by section, relocations are corrected, imports are resolved, and then the main thread is redirected to the entry point. This approach works because a native PE contains machine instructions that the CPU can understand directly. Therefore, it is sufficient to place the bytes in the correct location in memory and have the RIP poin...