Credential Extraction with WinDbg + Mimikatz
How to extract credentials from a Windows memory dump using WinDbg with the Mimikatz kernel extension, working directly on the context of protected processes.
Posts by Category
- Red Teaming 11
- Active Directory 8
- Writeups 3
- Credential Dumping 2
- HackTheBox 2
- Binary Exploitation 1
- Exploit Development 1
- Certificaciones 1
- Certifications 1
- AI Integration 1
- Pivoting 1
- HackSmarter 1
- Windows 1
Red Teaming
Ligolo-NG: Pivoting Guide for CPTS
Comprehensive guide to multi-hop pivoting and network tunneling using Ligolo-NG, tailored for CPTS and practical pentesting environments.
Mythic C2 MCP: Integrating AI with Command and Control Operations
Integrating Model Context Protocol (MCP) with Mythic C2 and OpenCode to enhance offensive operations and command-and-control workflows with AI.
Dumping LSASS Without Mimikatz: Native and Administrative Alternatives
Techniques and LOLBins for extracting LSASS process memory in Windows environments without triggering traditional Mimikatz signatures.
BloodHound MCP: Integrating Claude with BloodHound
Leveraging the Model Context Protocol (MCP) to connect Claude AI directly with BloodHound graph databases for automated Active Directory analysis.
Active Directory Certificate Services: Abusing ADCS ESC8 (Kerberos Relay)
Deep dive into exploiting ADCS ESC8 via Kerberos Relay using KrbRelay to obtain domain controller certificates and achieve domain takeover.
Active Directory Certificate Services: Abusing ADCS ESC11 (RPC Relay)
Exploitation of ADCS ESC11 through unencrypted RPC ICertPassage interfaces via NTLM relaying to compromise Active Directory environments.
Active Directory Certificate Services: Abusing ADCS ESC8 (NTLM Relay)
Step-by-step walkthrough of ADCS ESC8 exploitation over HTTP Web Enrollment using NTLM Relay for full Active Directory domain escalation.
Active Directory Domain Trust: Abusing Child-to-Parent Trust
Privilege escalation across Active Directory trust boundaries: abusing Child-to-Parent trusts within the same forest to compromise the root domain.
My Experience with the CRTP - 2026
My journey, preparation strategy, lab experiences, and tips for successfully passing the Altered Security Certified Red Team Professional (CRTP) exam.
Mi Experiencia con la CRTP - 2026
Mi camino, anécdotas, preparación y metodología para aprobar la certificación Certified Red Team Professional (CRTP) de Altered Security.
Active Directory
Search — HackTheBox
Search writeup (HackTheBox): web credentials, Kerberoasting, password spraying, hidden Excel column, GMSA abuse and GenericAll to DC.
ShadowGate — HackSmarter Pro Labs
ShadowGate writeup (HackSmarter Pro Labs): anonymous AD enumeration, AS-REP Roasting, Shadow Credentials with Certipy, ESC8 and DCSync.
Infiltrator — HackTheBox
Insane difficulty HackTheBox machine focused on Active Directory, reverse engineering with Ghidra, BitLocker recovery, GMSA abuse, and ADCS ESC4 exploitation.
BloodHound MCP: Integrating Claude with BloodHound
Leveraging the Model Context Protocol (MCP) to connect Claude AI directly with BloodHound graph databases for automated Active Directory analysis.
Active Directory Certificate Services: Abusing ADCS ESC8 (Kerberos Relay)
Deep dive into exploiting ADCS ESC8 via Kerberos Relay using KrbRelay to obtain domain controller certificates and achieve domain takeover.
Active Directory Certificate Services: Abusing ADCS ESC11 (RPC Relay)
Exploitation of ADCS ESC11 through unencrypted RPC ICertPassage interfaces via NTLM relaying to compromise Active Directory environments.
Active Directory Certificate Services: Abusing ADCS ESC8 (NTLM Relay)
Step-by-step walkthrough of ADCS ESC8 exploitation over HTTP Web Enrollment using NTLM Relay for full Active Directory domain escalation.
Active Directory Domain Trust: Abusing Child-to-Parent Trust
Privilege escalation across Active Directory trust boundaries: abusing Child-to-Parent trusts within the same forest to compromise the root domain.
Writeups
Search — HackTheBox
Search writeup (HackTheBox): web credentials, Kerberoasting, password spraying, hidden Excel column, GMSA abuse and GenericAll to DC.
ShadowGate — HackSmarter Pro Labs
ShadowGate writeup (HackSmarter Pro Labs): anonymous AD enumeration, AS-REP Roasting, Shadow Credentials with Certipy, ESC8 and DCSync.
Infiltrator — HackTheBox
Insane difficulty HackTheBox machine focused on Active Directory, reverse engineering with Ghidra, BitLocker recovery, GMSA abuse, and ADCS ESC4 exploitation.
Credential Dumping
Credential Extraction with WinDbg + Mimikatz
How to extract credentials from a Windows memory dump using WinDbg with the Mimikatz kernel extension, working directly on the context of protected processes.
Dumping LSASS Without Mimikatz: Native and Administrative Alternatives
Techniques and LOLBins for extracting LSASS process memory in Windows environments without triggering traditional Mimikatz signatures.
HackTheBox
Search — HackTheBox
Search writeup (HackTheBox): web credentials, Kerberoasting, password spraying, hidden Excel column, GMSA abuse and GenericAll to DC.
Infiltrator — HackTheBox
Insane difficulty HackTheBox machine focused on Active Directory, reverse engineering with Ghidra, BitLocker recovery, GMSA abuse, and ADCS ESC4 exploitation.
Binary Exploitation
Guía de Explotación: Buffer Overflow x32
Guía técnica y práctica para comprender y explotar desbordamientos de búfer en arquitecturas x86 (32 bits) en entornos Linux.
Exploit Development
Guía de Explotación: Buffer Overflow x32
Guía técnica y práctica para comprender y explotar desbordamientos de búfer en arquitecturas x86 (32 bits) en entornos Linux.
Certificaciones
Mi Experiencia con la CRTP - 2026
Mi camino, anécdotas, preparación y metodología para aprobar la certificación Certified Red Team Professional (CRTP) de Altered Security.
Certifications
My Experience with the CRTP - 2026
My journey, preparation strategy, lab experiences, and tips for successfully passing the Altered Security Certified Red Team Professional (CRTP) exam.
AI Integration
Mythic C2 MCP: Integrating AI with Command and Control Operations
Integrating Model Context Protocol (MCP) with Mythic C2 and OpenCode to enhance offensive operations and command-and-control workflows with AI.
Pivoting
Ligolo-NG: Pivoting Guide for CPTS
Comprehensive guide to multi-hop pivoting and network tunneling using Ligolo-NG, tailored for CPTS and practical pentesting environments.
HackSmarter
ShadowGate — HackSmarter Pro Labs
ShadowGate writeup (HackSmarter Pro Labs): anonymous AD enumeration, AS-REP Roasting, Shadow Credentials with Certipy, ESC8 and DCSync.
Windows
Credential Extraction with WinDbg + Mimikatz
How to extract credentials from a Windows memory dump using WinDbg with the Mimikatz kernel extension, working directly on the context of protected processes.