Offensive Security Research

WinRM

Hack The Box - Blackfield - Writeup

Anonymous SMB enumeration, AS-REP Roasting, ForceChangePassword abuse, LSASS credential extraction, Backup Operators abuse, and privilege escalation on Hack The Box Blackfield.

HackTheBox Windows Active Directory AS-REP Roasting BloodHound ForceChangePassword LSASS Dump Backup Operators SeBackupPrivilege WinRM

Easy

Hack The Box - Forest - Writeup

Anonymous RPC enumeration, AS-REP Roasting, BloodHound privilege analysis, ACL abuse, and DCSync exploitation on HackTheBox Forest.

HackTheBox Windows Active Directory AS-REP Roasting BloodHound DCSync ACL Abuse WinRM

Medium

Hack The Box - Querier - Writeup

Abusing exposed SMB shares, MSSQL credentials, NTLM capture, and credential discovery to compromise Querier.

HackTheBox Windows MSSQL SMB NTLM Responder Hashcat PowerUp WinRM

Medium

Hack The Box - Resolute - Writeup

Active Directory enumeration, password spraying, WinRM access, PowerShell transcript credential discovery, and DnsAdmins privilege escalation on Hack The Box Resolute.

HackTheBox Windows Active Directory Password Spraying WinRM DnsAdmins PowerShell Privilege Escalation