writeups

Credential Discovery and KerberoastingWe start with the credentials pentest / p3nt3st2025!&. An initial LDAP enumeration using BloodHound and a kerberoasting attack allow us to map the domain pirate.htb: 1bloodhound-python -u pentest -p 'p3nt3st2025!&' -d pirate.htb -ns 10.129.244.95 -c all In particular, the Kerberoasting reveals the account a.white_adm (a member of the group IT) as well as the managed service account gMSA_ADFS_prod$ (a member of Remote Management Users):...

IntroductionVintage is a Hard challenge on HackTheBox that simulates an assumed breach scenario in an Active Directory environment where NTLM is completely disabled. The entire exploit relies exclusively on Kerberos, making it an extremely educational challenge for pentesters accustomed to relying on NTLM. With the phase-out of NTLM announced by Microsoft for future versions of Windows Server, this type of environment will become the norm. We might as well prepare for it now. ConfigurationFi...

Sidecar is a chain made up of two machines, WS01 and DC01, classified as difficult. Initial access to WS01 is gained via a booby-trapped .lnk file, set up to limit antivirus detection. Once the first machine has been compromised, the absence of an LDAP signature combined with the presence of WebDAV enables a Shadow Credentials attack to be carried out, resulting in a much deeper compromise of the infrastructure. By compromising WS01, the recovery of a password made it possible to reach an acc...

Vigilant is a chain of Vulnlab-hardened machines, consisting of a Linux machine and a Windows machine. Anonymous access to the domain controller (DC) shares is used to retrieve a PDF file encrypted with ADAudit. By recovering the DLLs linked to the ADAudit executable, we can use ILSpy to identify the way in which the PDF is encrypted, and thus decrypt it. The identifiers contained in the PDF then allow us to access an Elasticsearch administration interface which, once exploited, gives us a sh...

**Kaiju” is a Hard chain made up of three Windows machines, where you have to exploit various advanced techniques to compromise the domain.Initial access is gained through the use of default credentials on an FTP server, retrieving files that give an insight into how administrators construct their passwords.By building a wordlist from this information, it is possible to compromise the backup account, which provides SSH access to the machine.Then, by browsing the FileZilla FTP server logs, we ...