Dcsync

TL;DR - A long one. A boolean LDAP injection on the intranet lets me log in as kathryn.holland with */*, then brute-force the password of gitea_temp_principal. Inside Gitea the Ghost CMS repo has a path traversal that reads /proc/self/environ for the DEV_INTRANET_KEY, and the dev API behind that key has a command injection, which gives me a shell in a Linux container running as root. Its env leaks intranet_principal, a real domain account. From there it is all AD: kerberoast adfs_gmsa, grab a cached Kerberos ticket for florence.ramirez, coerce justin.bradley with a fake DNS record plus Responder and crack his hash (user.txt). justin can read the adfs_gmsa gMSA password, so I forge a Golden SAML to log into the ADFS-protected MSSQL console, pivot through a linked server to PRIMARY, impersonate sa for RCE, abuse SeImpersonate to get SYSTEM on corp.ghost.htb, and finally forge a cross-domain Golden Ticket to own ghost.htb and grab root.txt. ...

TL;DR - An assumed-breach Active Directory box starting with Olivia:ichliebedich. BloodHound maps an ACL chain: Olivia has GenericAll over Michael, Michael can ForceChangePassword on Benjamin, and Benjamin (in Share Moderators) can reach an FTP backup. That backup is a Password Safe vault, cracked to reveal mid-chain users, one of whom (Emily) has GenericWrite over Ethan. A targeted Kerberoast against Ethan cracks his password, and Ethan holds DCSync rights, so secretsdump dumps every hash and a pass-the-hash as Administrator finishes the box. ...

TL;DR - A Windows domain controller that allows null-session enumeration over SMB/RPC, leaking the full list of domain users. One of them, svc-alfresco, has Kerberos pre-authentication disabled, so we AS-REP roast it, crack the hash to s3rvice, and log in over WinRM for user.txt. For root, BloodHound maps an ACL chain: svc-alfresco has GenericAll over the Exchange Windows Permissions group, that group holds WriteDACL over the domain object, so we add ourselves to the group, grant our user DCSync rights, dump the Administrator NT hash with secretsdump, and pass-the-hash in as Domain Admin. ...