I work in offensive security. Here I share CTF writeups, security notes and small projects.
Active machine — write-up published after retirement.
Active machine — write-up published after retirement.
Active machine — write-up published after retirement.
Active machine — write-up published after retirement.
Active machine — write-up published after retirement.
Active machine — write-up published after retirement.
Overview Pirate is a Windows Active Directory box built around delegation abuse. The domain controller, DC01, doubles as a Hyper-V host: a second web server, WEB01, runs as a guest VM on an internal virtual switch (192.168.100.0/24) that is not directly reachable from the VPN. The only externally reachable host is DC01 itself. The captured chain starts with two Group Managed Service Account NTLM hashes (gMSA_ADCS_prod$ and gMSA_ADFS_prod$). Because gMSA managed-password blobs are stored in LDAP and readable by authorized principals, their NTLM hashes can be derived without ever cracking a password, and both accounts are allowed to log in over WinRM. That gives a foothold on DC01, from which a chisel reverse SOCKS tunnel opens the internal 192.168.100.0/24 segment and WEB01. ...
Overview Windows Server 2022 (build 10.0.20348). Stack: Apache XAMPP + PHP 8.1. Stage Technique Result Recon nmap: 22 (SSH), 80 (HTTP), 3389 (RDP) Windows, a video upload form Foothold .wax/.asx playlist leaks Net-NTLMv2 via Responder hash for MEDIA\enox Crack hashcat -m 5600 + rockyou enox:1234virus@ Access SSH (WinRM/5985 is closed) shell as enox Lateral NTFS junction from Uploads\<md5> to C:\xampp\htdocs write a webshell as Apache Shell webshell + reverse shell nt authority\local service PrivEsc FullPowers (recover SeImpersonate) then GodPotato nt authority\system Two official paths to SYSTEM: ...
Overview Redelegate is a Windows Active Directory Domain Controller that layers a chain of small misconfigurations into a full domain compromise. The box exposes anonymous FTP alongside the usual DC services and a Microsoft SQL Server instance. The FTP share leaks a shared KeePass database and a couple of “audit” documents, one of which conveniently hints at the exact weak password pattern in use on the domain (SeasonYear!). That hint cracks the KeePass passphrase, which in turn yields a set of stored credentials. ...
Overview Voleur is a medium-difficulty Windows machine built around an Active Directory environment with NTLM authentication fully disabled. The challenge begins as an assumed breach, with low-privileged credentials for ryan.naylor provided as the starting point. The full attack chain covers: Kerberos setup and SMB enumeration leading to a password-protected Excel file whose cracked contents expose service account credentials; BloodHound-driven discovery of a WriteSPN misconfiguration enabling targeted Kerberoasting against svc_winrm; Active Directory Recycle Bin abuse to restore a deleted user; offline DPAPI credential decryption to recover a higher-privileged account; and finally, pivoting through a Windows Subsystem for Linux instance to extract backup copies of ntds.dit, SYSTEM, and SECURITY - yielding the Administrator NT hash and full domain compromise. ...