https://ctf-hallllow.blog/tags/dcsync/ Recent content in Dcsync on hallllow Hugo en-us Tue, 03 Nov 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/ghost/ Tue, 03 Nov 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/ghost/ HTB Ghost (Insane). A long AD chain: a boolean LDAP injection on the intranet brute-forces gitea_temp_principal, Gitea leaks a Ghost CMS path traversal that reads env vars for an API key, the dev API has a command injection giving a shell in a Linux container, and its env leaks a domain account. From there kerberoasting, a cached Kerberos ticket, a DNS-coerced Responder capture, a Golden SAML via the adfs_gmsa account, a MSSQL linked server, SeImpersonate, and finally a cross-domain Golden Ticket to own the whole forest. https://ctf-hallllow.blog/posts/administrator/ Tue, 13 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/administrator/ HTB Administrator (Medium). An assumed-breach AD box: chain ACLs from Olivia through Michael, Benjamin, Emily and Ethan using bloodyAD, crack a Password Safe vault for mid-chain creds, targeted-Kerberoast Ethan, and finish with DCSync for full domain compromise. https://ctf-hallllow.blog/posts/forest/ Thu, 08 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/forest/ HTB Forest (Easy). A read-only domain controller leaks its user list over an SMB null session. One account, svc-alfresco, has Kerberos pre-auth disabled, so we AS-REP roast it, crack the hash, and log in over WinRM. BloodHound then reveals an ACL path to Domain Admin: GenericAll on Exchange Windows Permissions grants WriteDACL over the domain, which we turn into DCSync rights and dump the Administrator hash.