https://ctf-hallllow.blog/tags/dpapi/ Recent content in Dpapi on hallllow Hugo en-us Wed, 04 Nov 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/voleur/ Wed, 04 Nov 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/voleur/ HTB Voleur (Medium). An assumed-breach, Kerberos-only AD box: a password-protected Access_Review.xlsx on a share leaks svc_ldap and svc_iis, BloodHound shows svc_ldap has WriteSPN over svc_winrm so I kerberoast it for a WinRM shell, restore a deleted user from the AD Recycle Bin, decrypt his DPAPI credentials for jeremy.combs, SSH in as svc_backup with a leaked key, and dump NTDS.dit to pass-the-key as Administrator.