https://ctf-hallllow.blog/categories/hack.lu/ Recent content in Hack.lu on hallllow Hugo en-us Sat, 24 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/ma/ Sat, 24 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/ma/ hack.lu CTF - MA. A single-forest, parent-child Active Directory compromise: svc_test (user=pass) and a Kerberoasted svc_granite_sync get a foothold, cross a Kerberos-only within-forest trust, read a gMSA managed password to reach Backup$ and an NTDS.dit export, then forge a Golden Ticket with Enterprise Admins SID History to own the whole forest. https://ctf-hallllow.blog/posts/technical-debt/ Sat, 24 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/technical-debt/ hack.lu CTF - Technical Debt. From an unattend file in the WDS REMINST share to Domain Admin: svc_deploy creds, GPO abuse (pyGPOAbuse) for SYSTEM on the member server, then a chain of DNS hijack + ADCS WebServer cert + a rogue WSUS server (pyWSUS + socat TLS + Ligolo pivot) to push a SYSTEM 'update' to the DC, finishing with DCSync.