https://ctf-hallllow.blog/tags/kerberoasting/ Recent content in Kerberoasting on hallllow Hugo en-us Wed, 04 Nov 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/voleur/ Wed, 04 Nov 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/voleur/ HTB Voleur (Medium). An assumed-breach, Kerberos-only AD box: a password-protected Access_Review.xlsx on a share leaks svc_ldap and svc_iis, BloodHound shows svc_ldap has WriteSPN over svc_winrm so I kerberoast it for a WinRM shell, restore a deleted user from the AD Recycle Bin, decrypt his DPAPI credentials for jeremy.combs, SSH in as svc_backup with a leaked key, and dump NTDS.dit to pass-the-key as Administrator. https://ctf-hallllow.blog/posts/ma/ Sat, 24 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/ma/ hack.lu CTF - MA. A single-forest, parent-child Active Directory compromise: svc_test (user=pass) and a Kerberoasted svc_granite_sync get a foothold, cross a Kerberos-only within-forest trust, read a gMSA managed password to reach Backup$ and an NTDS.dit export, then forge a Golden Ticket with Enterprise Admins SID History to own the whole forest. https://ctf-hallllow.blog/posts/active/ Tue, 13 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/active/ HTB Active (Easy). Anonymous SMB access to a Replication share leaks a GPP-encrypted password for svc_tgs, decrypted to reach the Users share and user.txt, then Kerberoasting the SPN-enabled Administrator account cracks to full domain compromise. https://ctf-hallllow.blog/posts/tombwatcher/ Wed, 07 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/tombwatcher/ HTB TombWatcher (Medium). Assumed-breach AD box: an ACL chain through BloodHound (targeted Kerberoasting, ReadGMSAPassword, ForceChangePassword, WriteOwner) leads to a WinRM shell as john, then restoring a deleted cert_admin account from the AD Recycle Bin and abusing ESC15 (CVE-2024-49019) for Administrator.