https://ctf-hallllow.blog/tags/active-directory/ Recent content in Active-Directory on hallllow Hugo en-us Wed, 04 Nov 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/voleur/ Wed, 04 Nov 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/voleur/ HTB Voleur (Medium). An assumed-breach, Kerberos-only AD box: a password-protected Access_Review.xlsx on a share leaks svc_ldap and svc_iis, BloodHound shows svc_ldap has WriteSPN over svc_winrm so I kerberoast it for a WinRM shell, restore a deleted user from the AD Recycle Bin, decrypt his DPAPI credentials for jeremy.combs, SSH in as svc_backup with a leaked key, and dump NTDS.dit to pass-the-key as Administrator. https://ctf-hallllow.blog/posts/ghost/ Tue, 03 Nov 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/ghost/ HTB Ghost (Insane). A long AD chain: a boolean LDAP injection on the intranet brute-forces gitea_temp_principal, Gitea leaks a Ghost CMS path traversal that reads env vars for an API key, the dev API has a command injection giving a shell in a Linux container, and its env leaks a domain account. From there kerberoasting, a cached Kerberos ticket, a DNS-coerced Responder capture, a Golden SAML via the adfs_gmsa account, a MSSQL linked server, SeImpersonate, and finally a cross-domain Golden Ticket to own the whole forest. https://ctf-hallllow.blog/posts/authority/ Tue, 27 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/authority/ HTB Authority (Medium). An AD box via a PWM self-service password portal: anonymous/guest SMB access leaks Ansible automation, cracking an ansible-vault blob (ansible2john + john) unlocks the PWM admin svc_pwm, a rogue LDAP profile + Responder captures svc_ldap in cleartext for a WinRM shell, and an ADCS ESC1 template (plus an LDAP shell adding the user to Domain Admins) finishes the box as Administrator. https://ctf-hallllow.blog/posts/ma/ Sat, 24 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/ma/ hack.lu CTF - MA. A single-forest, parent-child Active Directory compromise: svc_test (user=pass) and a Kerberoasted svc_granite_sync get a foothold, cross a Kerberos-only within-forest trust, read a gMSA managed password to reach Backup$ and an NTDS.dit export, then forge a Golden Ticket with Enterprise Admins SID History to own the whole forest. https://ctf-hallllow.blog/posts/technical-debt/ Sat, 24 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/technical-debt/ hack.lu CTF - Technical Debt. From an unattend file in the WDS REMINST share to Domain Admin: svc_deploy creds, GPO abuse (pyGPOAbuse) for SYSTEM on the member server, then a chain of DNS hijack + ADCS WebServer cert + a rogue WSUS server (pyWSUS + socat TLS + Ligolo pivot) to push a SYSTEM 'update' to the DC, finishing with DCSync. https://ctf-hallllow.blog/posts/active/ Tue, 13 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/active/ HTB Active (Easy). Anonymous SMB access to a Replication share leaks a GPP-encrypted password for svc_tgs, decrypted to reach the Users share and user.txt, then Kerberoasting the SPN-enabled Administrator account cracks to full domain compromise. https://ctf-hallllow.blog/posts/administrator/ Tue, 13 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/administrator/ HTB Administrator (Medium). An assumed-breach AD box: chain ACLs from Olivia through Michael, Benjamin, Emily and Ethan using bloodyAD, crack a Password Safe vault for mid-chain creds, targeted-Kerberoast Ethan, and finish with DCSync for full domain compromise. https://ctf-hallllow.blog/posts/tombwatcher/ Wed, 07 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/tombwatcher/ HTB TombWatcher (Medium). Assumed-breach AD box: an ACL chain through BloodHound (targeted Kerberoasting, ReadGMSAPassword, ForceChangePassword, WriteOwner) leads to a WinRM shell as john, then restoring a deleted cert_admin account from the AD Recycle Bin and abusing ESC15 (CVE-2024-49019) for Administrator.