https://ctf-hallllow.blog/tags/ansible-vault/ Recent content in Ansible-Vault on hallllow Hugo en-us Tue, 27 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/authority/ Tue, 27 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/authority/ HTB Authority (Medium). An AD box via a PWM self-service password portal: anonymous/guest SMB access leaks Ansible automation, cracking an ansible-vault blob (ansible2john + john) unlocks the PWM admin svc_pwm, a rogue LDAP profile + Responder captures svc_ldap in cleartext for a WinRM shell, and an ADCS ESC1 template (plus an LDAP shell adding the user to Domain Admins) finishes the box as Administrator.