HackTheBox

TL;DR - A Windows domain controller that allows null-session enumeration over SMB/RPC, leaking the full list of domain users. One of them, svc-alfresco, has Kerberos pre-authentication disabled, so we AS-REP roast it, crack the hash to s3rvice, and log in over WinRM for user.txt. For root, BloodHound maps an ACL chain: svc-alfresco has GenericAll over the Exchange Windows Permissions group, that group holds WriteDACL over the domain object, so we add ourselves to the group, grant our user DCSync rights, dump the Administrator NT hash with secretsdump, and pass-the-hash in as Domain Admin. ...

TL;DR - A Windows box where a video-upload feature lets us smuggle an .asx playlist pointing at a UNC path. When the server processes it, it authenticates to our SMB listener and leaks enox’s NetNTLM hash, which we crack and reuse over SSH for the foothold. For root, the upload handler stores files in a predictable per-user directory, so we abuse a symlink to redirect our shell.php into the XAMPP webroot, get a webshell, drop to a reverse shell, and finally use FullPowers to recover the service account’s full privilege set and land as nt authority\system. ...

TL;DR - An assumed-breach Active Directory box. Starting from henry, I chain ACLs through BloodHound: a targeted Kerberoast on alfred, abusing AddSelf + ReadGMSAPassword to read the ansible_dev$ gMSA password, then a trail of ForceChangePassword and WriteOwner abuses to pivot sam → john and land a WinRM shell. For root, john controls an OU holding a deleted cert_admin account, so I restore it from the AD Recycle Bin, reset its password, and abuse an ESC15 (CVE-2024-49019) vulnerable certificate template to impersonate the Administrator. ...

TL;DR - Foothold through a misconfigured Redis instance by writing an SSH key into authorized_keys. From the redis user I find an id_rsa.bak belonging to Matt, crack its passphrase with john, and switch to Matt. Root comes from CVE-2019-15107 on Webmin, exploited through a Metasploit module. Recon Starting with a basic nmap scan with the following command: nmap -sV -sC -p- 10.129.2.1 -oA nmap/postman I got this output: ...