https://ctf-hallllow.blog/tags/adcs/ Recent content in Adcs on hallllow Hugo en-us Tue, 27 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/authority/ Tue, 27 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/authority/ HTB Authority (Medium). An AD box via a PWM self-service password portal: anonymous/guest SMB access leaks Ansible automation, cracking an ansible-vault blob (ansible2john + john) unlocks the PWM admin svc_pwm, a rogue LDAP profile + Responder captures svc_ldap in cleartext for a WinRM shell, and an ADCS ESC1 template (plus an LDAP shell adding the user to Domain Admins) finishes the box as Administrator. https://ctf-hallllow.blog/posts/technical-debt/ Sat, 24 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/technical-debt/ hack.lu CTF - Technical Debt. From an unattend file in the WDS REMINST share to Domain Admin: svc_deploy creds, GPO abuse (pyGPOAbuse) for SYSTEM on the member server, then a chain of DNS hijack + ADCS WebServer cert + a rogue WSUS server (pyWSUS + socat TLS + Ligolo pivot) to push a SYSTEM 'update' to the DC, finishing with DCSync. https://ctf-hallllow.blog/posts/tombwatcher/ Wed, 07 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/tombwatcher/ HTB TombWatcher (Medium). Assumed-breach AD box: an ACL chain through BloodHound (targeted Kerberoasting, ReadGMSAPassword, ForceChangePassword, WriteOwner) leads to a WinRM shell as john, then restoring a deleted cert_admin account from the AD Recycle Bin and abusing ESC15 (CVE-2024-49019) for Administrator.