Posts

A Windows Active Directory machine involving SMB share exposure, NTLM credential coercion, BloodHound-guided privilege escalation, shadow credentials abuse, and ADCS certificate exploitation leading to full domain compromise.

A Windows Active Directory machine involving SMB share exposure, NTLM credential coercion, BloodHound-guided privilege escalation, shadow credentials abuse, and ADCS certificate exploitation leading to full domain compromise.

A HackTheBox Windows machine involving NTLM hash capture through a firmware review workflow and privilege escalation via a vulnerable Ricoh printer driver.

An Active Directory machine involving GPP password leakage, Kerberoasting, and domain admin compromise.

A Medium difficulty Active Directory machine involving SMB enumeration, credential exposure, and privilege abuse leading to full domain compromise.

A Linux machine involving JWT authentication bypass, credential reuse, and SSH CA key abuse to gain root access.

An Active Directory machine involving SMB enumeration, credential extraction, and RBCD-based domain privilege escalation.

An Active Directory machine involving .NET WCF exploitation, SQL credential discovery, and ADIDNS hijacking leading to SYSTEM access.

An in-depth Threat Intelligence investigation of the Hack The Box Sherlocks challenge Dream Job-2, focused on malware used by the Lazarus Group during Operation Dream Job. This analysis covers malware lineage, macro-based initial access, payload staging, and defensive detection opportunities

An Android DFIR investigation of the HTB Sherlocks challenge HookFlare, reconstructing an SMS-based phishing attack, malicious app behavior, permission abuse, and encrypted data exfiltration.