https://ctf-hallllow.blog/tags/acl-abuse/ Recent content in Acl-Abuse on hallllow Hugo en-us Tue, 13 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/administrator/ Tue, 13 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/administrator/ HTB Administrator (Medium). An assumed-breach AD box: chain ACLs from Olivia through Michael, Benjamin, Emily and Ethan using bloodyAD, crack a Password Safe vault for mid-chain creds, targeted-Kerberoast Ethan, and finish with DCSync for full domain compromise. https://ctf-hallllow.blog/posts/forest/ Thu, 08 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/forest/ HTB Forest (Easy). A read-only domain controller leaks its user list over an SMB null session. One account, svc-alfresco, has Kerberos pre-auth disabled, so we AS-REP roast it, crack the hash, and log in over WinRM. BloodHound then reveals an ACL path to Domain Admin: GenericAll on Exchange Windows Permissions grants WriteDACL over the domain, which we turn into DCSync rights and dump the Administrator hash.