https://ctf-hallllow.blog/tags/gpo-abuse/ Recent content in Gpo-Abuse on hallllow Hugo en-us Sat, 24 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/technical-debt/ Sat, 24 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/technical-debt/ hack.lu CTF - Technical Debt. From an unattend file in the WDS REMINST share to Domain Admin: svc_deploy creds, GPO abuse (pyGPOAbuse) for SYSTEM on the member server, then a chain of DNS hijack + ADCS WebServer cert + a rogue WSUS server (pyWSUS + socat TLS + Ligolo pivot) to push a SYSTEM 'update' to the DC, finishing with DCSync.