Active-Directory on Łukasz Pastuszak - security noteshttps://lukaszpastuszak.dev/tags/active-directory/Recent content in Active-Directory on Łukasz Pastuszak - security notesHugoen-usSun, 06 Sep 2026 00:00:00 +0000TombWatcherhttps://lukaszpastuszak.dev/writeups/tombwatcher/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/tombwatcher/A chain of Active Directory ACL abuses (WriteSPN, AddSelf, ReadGMSAPassword, ForceChangePassword, WriteOwner) reaches john, then AD Recycle Bin plus ADCS ESC15 (CVE-2024-49019) escalates to Administrator.VulnCicadahttps://lukaszpastuszak.dev/writeups/vulncicada/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/vulncicada/A password on a sticky note in an image from an open NFS share, Kerberos-only authentication, ADCS ESC8 exploited via a Kerberos relay (a serialized empty CREDENTIAL_TARGET_INFORMATION DNS record) plus PetitPotam coercion, a DC machine-account certificate, DCSync, and the Administrator hash.