Search — HackTheBox
Search writeup (HackTheBox): web credentials, Kerberoasting, password spraying, hidden Excel column, GMSA abuse and GenericAll to DC.
Posts by Tag
- Active Directory 10
- Red Team 10
- ADCS 6
- Privilege Escalation 4
- ESC8 3
- NTLM Relay 3
- BloodHound 3
- CRTP 2
- Pentesting 2
- MCP 2
- AI 2
- LSASS 2
- Credential Dumping 2
- Windows Security 2
- HackTheBox 2
- AS-REP Roasting 2
- GMSA 2
- BOF 1
- x32 1
- Assembly 1
- Investigation 1
- Domain Trust 1
- Child to Parent 1
- ESC11 1
- RPC Relay 1
- Kerberos Relay 1
- KrbRelay 1
- Claude 1
- Evasion 1
- Mythic C2 1
- OpenCode 1
- Ligolo-NG 1
- Pivoting 1
- CPTS 1
- Tunneling 1
- Infiltrator 1
- Output Messenger 1
- Reverse Engineering 1
- BitLocker 1
- ESC4 1
- HackSmarter 1
- ShadowGate 1
- Shadow Credentials 1
- PetitPotam 1
- DCSync 1
- Certipy 1
- Search 1
- Kerberoasting 1
- ASREPRoasting 1
- Password Spraying 1
- GenericAll 1
- PFX 1
- Certificate Authentication 1
- WinDbg 1
- Mimikatz 1
- Memory Forensics 1
Active Directory
ShadowGate — HackSmarter Pro Labs
ShadowGate writeup (HackSmarter Pro Labs): anonymous AD enumeration, AS-REP Roasting, Shadow Credentials with Certipy, ESC8 and DCSync.
Infiltrator — HackTheBox
Insane difficulty HackTheBox machine focused on Active Directory, reverse engineering with Ghidra, BitLocker recovery, GMSA abuse, and ADCS ESC4 exploitation.
BloodHound MCP: Integrating Claude with BloodHound
Leveraging the Model Context Protocol (MCP) to connect Claude AI directly with BloodHound graph databases for automated Active Directory analysis.
Active Directory Certificate Services: Abusing ADCS ESC8 (Kerberos Relay)
Deep dive into exploiting ADCS ESC8 via Kerberos Relay using KrbRelay to obtain domain controller certificates and achieve domain takeover.
Active Directory Certificate Services: Abusing ADCS ESC11 (RPC Relay)
Exploitation of ADCS ESC11 through unencrypted RPC ICertPassage interfaces via NTLM relaying to compromise Active Directory environments.
Active Directory Certificate Services: Abusing ADCS ESC8 (NTLM Relay)
Step-by-step walkthrough of ADCS ESC8 exploitation over HTTP Web Enrollment using NTLM Relay for full Active Directory domain escalation.
Active Directory Domain Trust: Abusing Child-to-Parent Trust
Privilege escalation across Active Directory trust boundaries: abusing Child-to-Parent trusts within the same forest to compromise the root domain.
My Experience with the CRTP - 2026
My journey, preparation strategy, lab experiences, and tips for successfully passing the Altered Security Certified Red Team Professional (CRTP) exam.
Mi Experiencia con la CRTP - 2026
Mi camino, anécdotas, preparación y metodología para aprobar la certificación Certified Red Team Professional (CRTP) de Altered Security.
Red Team
Credential Extraction with WinDbg + Mimikatz
How to extract credentials from a Windows memory dump using WinDbg with the Mimikatz kernel extension, working directly on the context of protected processes.
Mythic C2 MCP: Integrating AI with Command and Control Operations
Integrating Model Context Protocol (MCP) with Mythic C2 and OpenCode to enhance offensive operations and command-and-control workflows with AI.
Dumping LSASS Without Mimikatz: Native and Administrative Alternatives
Techniques and LOLBins for extracting LSASS process memory in Windows environments without triggering traditional Mimikatz signatures.
BloodHound MCP: Integrating Claude with BloodHound
Leveraging the Model Context Protocol (MCP) to connect Claude AI directly with BloodHound graph databases for automated Active Directory analysis.
Active Directory Certificate Services: Abusing ADCS ESC8 (Kerberos Relay)
Deep dive into exploiting ADCS ESC8 via Kerberos Relay using KrbRelay to obtain domain controller certificates and achieve domain takeover.
Active Directory Certificate Services: Abusing ADCS ESC11 (RPC Relay)
Exploitation of ADCS ESC11 through unencrypted RPC ICertPassage interfaces via NTLM relaying to compromise Active Directory environments.
Active Directory Certificate Services: Abusing ADCS ESC8 (NTLM Relay)
Step-by-step walkthrough of ADCS ESC8 exploitation over HTTP Web Enrollment using NTLM Relay for full Active Directory domain escalation.
Active Directory Domain Trust: Abusing Child-to-Parent Trust
Privilege escalation across Active Directory trust boundaries: abusing Child-to-Parent trusts within the same forest to compromise the root domain.
My Experience with the CRTP - 2026
My journey, preparation strategy, lab experiences, and tips for successfully passing the Altered Security Certified Red Team Professional (CRTP) exam.
Mi Experiencia con la CRTP - 2026
Mi camino, anécdotas, preparación y metodología para aprobar la certificación Certified Red Team Professional (CRTP) de Altered Security.
ADCS
Search — HackTheBox
Search writeup (HackTheBox): web credentials, Kerberoasting, password spraying, hidden Excel column, GMSA abuse and GenericAll to DC.
ShadowGate — HackSmarter Pro Labs
ShadowGate writeup (HackSmarter Pro Labs): anonymous AD enumeration, AS-REP Roasting, Shadow Credentials with Certipy, ESC8 and DCSync.
Infiltrator — HackTheBox
Insane difficulty HackTheBox machine focused on Active Directory, reverse engineering with Ghidra, BitLocker recovery, GMSA abuse, and ADCS ESC4 exploitation.
Active Directory Certificate Services: Abusing ADCS ESC8 (Kerberos Relay)
Deep dive into exploiting ADCS ESC8 via Kerberos Relay using KrbRelay to obtain domain controller certificates and achieve domain takeover.
Active Directory Certificate Services: Abusing ADCS ESC11 (RPC Relay)
Exploitation of ADCS ESC11 through unencrypted RPC ICertPassage interfaces via NTLM relaying to compromise Active Directory environments.
Active Directory Certificate Services: Abusing ADCS ESC8 (NTLM Relay)
Step-by-step walkthrough of ADCS ESC8 exploitation over HTTP Web Enrollment using NTLM Relay for full Active Directory domain escalation.
Privilege Escalation
Active Directory Certificate Services: Abusing ADCS ESC8 (Kerberos Relay)
Deep dive into exploiting ADCS ESC8 via Kerberos Relay using KrbRelay to obtain domain controller certificates and achieve domain takeover.
Active Directory Certificate Services: Abusing ADCS ESC11 (RPC Relay)
Exploitation of ADCS ESC11 through unencrypted RPC ICertPassage interfaces via NTLM relaying to compromise Active Directory environments.
Active Directory Certificate Services: Abusing ADCS ESC8 (NTLM Relay)
Step-by-step walkthrough of ADCS ESC8 exploitation over HTTP Web Enrollment using NTLM Relay for full Active Directory domain escalation.
Active Directory Domain Trust: Abusing Child-to-Parent Trust
Privilege escalation across Active Directory trust boundaries: abusing Child-to-Parent trusts within the same forest to compromise the root domain.
ESC8
ShadowGate — HackSmarter Pro Labs
ShadowGate writeup (HackSmarter Pro Labs): anonymous AD enumeration, AS-REP Roasting, Shadow Credentials with Certipy, ESC8 and DCSync.
Active Directory Certificate Services: Abusing ADCS ESC8 (Kerberos Relay)
Deep dive into exploiting ADCS ESC8 via Kerberos Relay using KrbRelay to obtain domain controller certificates and achieve domain takeover.
Active Directory Certificate Services: Abusing ADCS ESC8 (NTLM Relay)
Step-by-step walkthrough of ADCS ESC8 exploitation over HTTP Web Enrollment using NTLM Relay for full Active Directory domain escalation.
NTLM Relay
ShadowGate — HackSmarter Pro Labs
ShadowGate writeup (HackSmarter Pro Labs): anonymous AD enumeration, AS-REP Roasting, Shadow Credentials with Certipy, ESC8 and DCSync.
Active Directory Certificate Services: Abusing ADCS ESC11 (RPC Relay)
Exploitation of ADCS ESC11 through unencrypted RPC ICertPassage interfaces via NTLM relaying to compromise Active Directory environments.
Active Directory Certificate Services: Abusing ADCS ESC8 (NTLM Relay)
Step-by-step walkthrough of ADCS ESC8 exploitation over HTTP Web Enrollment using NTLM Relay for full Active Directory domain escalation.
BloodHound
Search — HackTheBox
Search writeup (HackTheBox): web credentials, Kerberoasting, password spraying, hidden Excel column, GMSA abuse and GenericAll to DC.
Infiltrator — HackTheBox
Insane difficulty HackTheBox machine focused on Active Directory, reverse engineering with Ghidra, BitLocker recovery, GMSA abuse, and ADCS ESC4 exploitation.
BloodHound MCP: Integrating Claude with BloodHound
Leveraging the Model Context Protocol (MCP) to connect Claude AI directly with BloodHound graph databases for automated Active Directory analysis.
CRTP
My Experience with the CRTP - 2026
My journey, preparation strategy, lab experiences, and tips for successfully passing the Altered Security Certified Red Team Professional (CRTP) exam.
Mi Experiencia con la CRTP - 2026
Mi camino, anécdotas, preparación y metodología para aprobar la certificación Certified Red Team Professional (CRTP) de Altered Security.
Pentesting
My Experience with the CRTP - 2026
My journey, preparation strategy, lab experiences, and tips for successfully passing the Altered Security Certified Red Team Professional (CRTP) exam.
Mi Experiencia con la CRTP - 2026
Mi camino, anécdotas, preparación y metodología para aprobar la certificación Certified Red Team Professional (CRTP) de Altered Security.
MCP
Mythic C2 MCP: Integrating AI with Command and Control Operations
Integrating Model Context Protocol (MCP) with Mythic C2 and OpenCode to enhance offensive operations and command-and-control workflows with AI.
BloodHound MCP: Integrating Claude with BloodHound
Leveraging the Model Context Protocol (MCP) to connect Claude AI directly with BloodHound graph databases for automated Active Directory analysis.
AI
Mythic C2 MCP: Integrating AI with Command and Control Operations
Integrating Model Context Protocol (MCP) with Mythic C2 and OpenCode to enhance offensive operations and command-and-control workflows with AI.
BloodHound MCP: Integrating Claude with BloodHound
Leveraging the Model Context Protocol (MCP) to connect Claude AI directly with BloodHound graph databases for automated Active Directory analysis.
LSASS
Credential Extraction with WinDbg + Mimikatz
How to extract credentials from a Windows memory dump using WinDbg with the Mimikatz kernel extension, working directly on the context of protected processes.
Dumping LSASS Without Mimikatz: Native and Administrative Alternatives
Techniques and LOLBins for extracting LSASS process memory in Windows environments without triggering traditional Mimikatz signatures.
Credential Dumping
Credential Extraction with WinDbg + Mimikatz
How to extract credentials from a Windows memory dump using WinDbg with the Mimikatz kernel extension, working directly on the context of protected processes.
Dumping LSASS Without Mimikatz: Native and Administrative Alternatives
Techniques and LOLBins for extracting LSASS process memory in Windows environments without triggering traditional Mimikatz signatures.
Windows Security
Credential Extraction with WinDbg + Mimikatz
How to extract credentials from a Windows memory dump using WinDbg with the Mimikatz kernel extension, working directly on the context of protected processes.
Dumping LSASS Without Mimikatz: Native and Administrative Alternatives
Techniques and LOLBins for extracting LSASS process memory in Windows environments without triggering traditional Mimikatz signatures.
HackTheBox
Search — HackTheBox
Search writeup (HackTheBox): web credentials, Kerberoasting, password spraying, hidden Excel column, GMSA abuse and GenericAll to DC.
Infiltrator — HackTheBox
Insane difficulty HackTheBox machine focused on Active Directory, reverse engineering with Ghidra, BitLocker recovery, GMSA abuse, and ADCS ESC4 exploitation.
AS-REP Roasting
ShadowGate — HackSmarter Pro Labs
ShadowGate writeup (HackSmarter Pro Labs): anonymous AD enumeration, AS-REP Roasting, Shadow Credentials with Certipy, ESC8 and DCSync.
Infiltrator — HackTheBox
Insane difficulty HackTheBox machine focused on Active Directory, reverse engineering with Ghidra, BitLocker recovery, GMSA abuse, and ADCS ESC4 exploitation.
GMSA
Search — HackTheBox
Search writeup (HackTheBox): web credentials, Kerberoasting, password spraying, hidden Excel column, GMSA abuse and GenericAll to DC.
Infiltrator — HackTheBox
Insane difficulty HackTheBox machine focused on Active Directory, reverse engineering with Ghidra, BitLocker recovery, GMSA abuse, and ADCS ESC4 exploitation.
BOF
Guía de Explotación: Buffer Overflow x32
Guía técnica y práctica para comprender y explotar desbordamientos de búfer en arquitecturas x86 (32 bits) en entornos Linux.
x32
Guía de Explotación: Buffer Overflow x32
Guía técnica y práctica para comprender y explotar desbordamientos de búfer en arquitecturas x86 (32 bits) en entornos Linux.
Assembly
Guía de Explotación: Buffer Overflow x32
Guía técnica y práctica para comprender y explotar desbordamientos de búfer en arquitecturas x86 (32 bits) en entornos Linux.
Investigation
Guía de Explotación: Buffer Overflow x32
Guía técnica y práctica para comprender y explotar desbordamientos de búfer en arquitecturas x86 (32 bits) en entornos Linux.
Domain Trust
Active Directory Domain Trust: Abusing Child-to-Parent Trust
Privilege escalation across Active Directory trust boundaries: abusing Child-to-Parent trusts within the same forest to compromise the root domain.
Child to Parent
Active Directory Domain Trust: Abusing Child-to-Parent Trust
Privilege escalation across Active Directory trust boundaries: abusing Child-to-Parent trusts within the same forest to compromise the root domain.
ESC11
Active Directory Certificate Services: Abusing ADCS ESC11 (RPC Relay)
Exploitation of ADCS ESC11 through unencrypted RPC ICertPassage interfaces via NTLM relaying to compromise Active Directory environments.
RPC Relay
Active Directory Certificate Services: Abusing ADCS ESC11 (RPC Relay)
Exploitation of ADCS ESC11 through unencrypted RPC ICertPassage interfaces via NTLM relaying to compromise Active Directory environments.
Kerberos Relay
Active Directory Certificate Services: Abusing ADCS ESC8 (Kerberos Relay)
Deep dive into exploiting ADCS ESC8 via Kerberos Relay using KrbRelay to obtain domain controller certificates and achieve domain takeover.
KrbRelay
Active Directory Certificate Services: Abusing ADCS ESC8 (Kerberos Relay)
Deep dive into exploiting ADCS ESC8 via Kerberos Relay using KrbRelay to obtain domain controller certificates and achieve domain takeover.
Claude
BloodHound MCP: Integrating Claude with BloodHound
Leveraging the Model Context Protocol (MCP) to connect Claude AI directly with BloodHound graph databases for automated Active Directory analysis.
Evasion
Dumping LSASS Without Mimikatz: Native and Administrative Alternatives
Techniques and LOLBins for extracting LSASS process memory in Windows environments without triggering traditional Mimikatz signatures.
Mythic C2
Mythic C2 MCP: Integrating AI with Command and Control Operations
Integrating Model Context Protocol (MCP) with Mythic C2 and OpenCode to enhance offensive operations and command-and-control workflows with AI.
OpenCode
Mythic C2 MCP: Integrating AI with Command and Control Operations
Integrating Model Context Protocol (MCP) with Mythic C2 and OpenCode to enhance offensive operations and command-and-control workflows with AI.
Ligolo-NG
Ligolo-NG: Pivoting Guide for CPTS
Comprehensive guide to multi-hop pivoting and network tunneling using Ligolo-NG, tailored for CPTS and practical pentesting environments.
Pivoting
Ligolo-NG: Pivoting Guide for CPTS
Comprehensive guide to multi-hop pivoting and network tunneling using Ligolo-NG, tailored for CPTS and practical pentesting environments.
CPTS
Ligolo-NG: Pivoting Guide for CPTS
Comprehensive guide to multi-hop pivoting and network tunneling using Ligolo-NG, tailored for CPTS and practical pentesting environments.
Tunneling
Ligolo-NG: Pivoting Guide for CPTS
Comprehensive guide to multi-hop pivoting and network tunneling using Ligolo-NG, tailored for CPTS and practical pentesting environments.
Infiltrator
Infiltrator — HackTheBox
Insane difficulty HackTheBox machine focused on Active Directory, reverse engineering with Ghidra, BitLocker recovery, GMSA abuse, and ADCS ESC4 exploitation.
Output Messenger
Infiltrator — HackTheBox
Insane difficulty HackTheBox machine focused on Active Directory, reverse engineering with Ghidra, BitLocker recovery, GMSA abuse, and ADCS ESC4 exploitation.
Reverse Engineering
Infiltrator — HackTheBox
Insane difficulty HackTheBox machine focused on Active Directory, reverse engineering with Ghidra, BitLocker recovery, GMSA abuse, and ADCS ESC4 exploitation.
BitLocker
Infiltrator — HackTheBox
Insane difficulty HackTheBox machine focused on Active Directory, reverse engineering with Ghidra, BitLocker recovery, GMSA abuse, and ADCS ESC4 exploitation.
ESC4
Infiltrator — HackTheBox
Insane difficulty HackTheBox machine focused on Active Directory, reverse engineering with Ghidra, BitLocker recovery, GMSA abuse, and ADCS ESC4 exploitation.
HackSmarter
ShadowGate — HackSmarter Pro Labs
ShadowGate writeup (HackSmarter Pro Labs): anonymous AD enumeration, AS-REP Roasting, Shadow Credentials with Certipy, ESC8 and DCSync.
ShadowGate
ShadowGate — HackSmarter Pro Labs
ShadowGate writeup (HackSmarter Pro Labs): anonymous AD enumeration, AS-REP Roasting, Shadow Credentials with Certipy, ESC8 and DCSync.
Shadow Credentials
ShadowGate — HackSmarter Pro Labs
ShadowGate writeup (HackSmarter Pro Labs): anonymous AD enumeration, AS-REP Roasting, Shadow Credentials with Certipy, ESC8 and DCSync.
PetitPotam
ShadowGate — HackSmarter Pro Labs
ShadowGate writeup (HackSmarter Pro Labs): anonymous AD enumeration, AS-REP Roasting, Shadow Credentials with Certipy, ESC8 and DCSync.
DCSync
ShadowGate — HackSmarter Pro Labs
ShadowGate writeup (HackSmarter Pro Labs): anonymous AD enumeration, AS-REP Roasting, Shadow Credentials with Certipy, ESC8 and DCSync.
Certipy
ShadowGate — HackSmarter Pro Labs
ShadowGate writeup (HackSmarter Pro Labs): anonymous AD enumeration, AS-REP Roasting, Shadow Credentials with Certipy, ESC8 and DCSync.
Search
Search — HackTheBox
Search writeup (HackTheBox): web credentials, Kerberoasting, password spraying, hidden Excel column, GMSA abuse and GenericAll to DC.
Kerberoasting
Search — HackTheBox
Search writeup (HackTheBox): web credentials, Kerberoasting, password spraying, hidden Excel column, GMSA abuse and GenericAll to DC.
ASREPRoasting
Search — HackTheBox
Search writeup (HackTheBox): web credentials, Kerberoasting, password spraying, hidden Excel column, GMSA abuse and GenericAll to DC.
Password Spraying
Search — HackTheBox
Search writeup (HackTheBox): web credentials, Kerberoasting, password spraying, hidden Excel column, GMSA abuse and GenericAll to DC.
GenericAll
Search — HackTheBox
Search writeup (HackTheBox): web credentials, Kerberoasting, password spraying, hidden Excel column, GMSA abuse and GenericAll to DC.
PFX
Search — HackTheBox
Search writeup (HackTheBox): web credentials, Kerberoasting, password spraying, hidden Excel column, GMSA abuse and GenericAll to DC.
Certificate Authentication
Search — HackTheBox
Search writeup (HackTheBox): web credentials, Kerberoasting, password spraying, hidden Excel column, GMSA abuse and GenericAll to DC.
WinDbg
Credential Extraction with WinDbg + Mimikatz
How to extract credentials from a Windows memory dump using WinDbg with the Mimikatz kernel extension, working directly on the context of protected processes.
Mimikatz
Credential Extraction with WinDbg + Mimikatz
How to extract credentials from a Windows memory dump using WinDbg with the Mimikatz kernel extension, working directly on the context of protected processes.
Memory Forensics
Credential Extraction with WinDbg + Mimikatz
How to extract credentials from a Windows memory dump using WinDbg with the Mimikatz kernel extension, working directly on the context of protected processes.