Hard-rated Windows Active Directory box from VulnLab. A WIM image exposes SAM hashes for lateral movement. ADCS ESC1 impersonates a privileged user via certificate abuse. RemotePotato0 performs a cross-session Net-NTLMv2 relay to capture and crack hashes for domain compromise.

Easy-rated Linux box. A hidden role parameter in a Laravel registration form grants admin access via IDOR. CVE-2018-15133 PHP deserialization RCE via a leaked APP_KEY achieves a shell. Sudo access to Composer with a GTFOBins technique escalates to root.

Medium-rated Windows Active Directory box. An MSSQL service leaks NTLMv2 hashes via xp_dirtree. SQL Server log analysis reveals plaintext credentials for lateral movement. ADCS ESC1 misconfiguration enables certificate-based impersonation of the domain administrator.

Complete walkthrough of HTB Job CTF, an Easy difficulty Windows machine featuring phishing via malicious LibreOffice macros, IIS web shell upload, and privilege escalation using token impersonation attacks.

A plaintext credential leaks from a SYSVOL logon script. GenericWrite over N.Thompson enables a targeted Kerberoast to crack his password, and his SeEnableDelegationPrivilege is used to stage an unconstrained delegation attack: a rogue machine account coerces DC authentication via PrinterBug, the captured TGT is relayed, and a DCSync dumps all hashes.

Guest SMB access exposes a homes share where a username-as-password spray yields valid credentials. A writable SYSVOL logon script is hijacked to capture a shell as Amelia Griffiths, whose BloodHound privileges chain through WriteOwner/WriteDacl over gpoadm — which holds GenericAll over the default domain GPO — to achieve domain compromise via pyGpoAbuse.

Easy-rated Linux box. Grafana 8.x path traversal (CVE-2021-43798) reads the backend SQLite database containing bcrypt hashes cracked with Hashcat. A privileged Docker container is escaped via sudo to gain root on the host system.

A broken password reset endpoint returns the newly generated password in its JSON response, granting admin access. An LFI in the log viewer is turned into a shell via log poisoning. Legacy rsh/rlogin services misconfigured with .rhosts and hosts.equiv allow passwordless lateral movement to sadm, whose leaked sudo password and GTFOBins nano escape lead to root.

A password-protected MS Access database in a public SMB share is cracked with office2john, revealing LDAP credentials. Timeroasting yields crackable hashes for pre-created computer accounts (FS01$, FS02$). GenericWrite over ADMWS01$ is abused to change its password, add a user to the RDP group, and gain access; privilege escalation on the legacy Windows Server 2008 host uses the Perfusion exploit (RpcEptMapper registry key abuse).

Tomcat's management interface is restricted to localhost, but Java RMI on port 2222 allows credential dumping and RCE via beanshooter. An unprotected backup directory leaks SSH keys and a TOTP secret for lateral movement. A restricted sudo rule permitting adduser is abused by creating a user named admin, which Ubuntu automatically adds to the sudo group.