https://ctf-hallllow.blog/tags/gmsa/ Recent content in Gmsa on hallllow Hugo en-us Sat, 24 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/ma/ Sat, 24 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/ma/ hack.lu CTF - MA. A single-forest, parent-child Active Directory compromise: svc_test (user=pass) and a Kerberoasted svc_granite_sync get a foothold, cross a Kerberos-only within-forest trust, read a gMSA managed password to reach Backup$ and an NTDS.dit export, then forge a Golden Ticket with Enterprise Admins SID History to own the whole forest. https://ctf-hallllow.blog/posts/tombwatcher/ Wed, 07 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/tombwatcher/ HTB TombWatcher (Medium). Assumed-breach AD box: an ACL chain through BloodHound (targeted Kerberoasting, ReadGMSAPassword, ForceChangePassword, WriteOwner) leads to a WinRM shell as john, then restoring a deleted cert_admin account from the AD Recycle Bin and abusing ESC15 (CVE-2024-49019) for Administrator.