Laps

Overview StreamIO is a Windows Active Directory box (domain streamIO.htb, hostname DC) running IIS + PHP with MSSQL as the backend database. The foothold chains a UNION-based SQL injection on a streaming subdomain into credential recovery, a hidden debug parameter that exposes a local file include, and finally a remote file include that reaches a raw eval() for code execution. From there the path is pure credential reuse and Active Directory ACL abuse: database credentials pulled from the web root unlock a backup database with fresh hashes, saved Firefox logins hand over a domain user, and a WriteOwner/Owns edge over a group with ReadLAPSPassword lets us read the LAPS-managed local administrator password and log in as administrator. ...

Overview Timelapse is an Easy Active Directory box built around a single domain controller (DC01, domain timelapse.htb). The entry point is an anonymously readable SMB share that stores a backup zip containing a PFX certificate bundle. The zip and the PFX inside it are both password protected, but both fall quickly to john against rockyou.txt. Once the certificate and private key are extracted, they authenticate to WinRM over TLS as legacyy, which owns the user flag. ...