Offensive Security Research

All Writeups

Windows, Linux, and Active Directory exploitation walkthroughs focused on enumeration, privilege escalation, and offensive security tradecraft.

Windows

Linux

Active Directory

Easy

Hack The Box - Active - Writeup

Abusing Group Policy Preferences credentials and Kerberoasting to compromise an Active Directory domain on Hack The Box Active.

HackTheBox Windows ActiveDirectory SMB Kerberos GPP Kerberoasting Hashcat

Hard

Hack The Box - Blackfield - Writeup

Anonymous SMB enumeration, AS-REP Roasting, ForceChangePassword abuse, LSASS credential extraction, Backup Operators abuse, and privilege escalation on Hack The Box Blackfield.

HackTheBox Windows Active Directory AS-REP Roasting BloodHound ForceChangePassword LSASS Dump Backup Operators SeBackupPrivilege WinRM

Easy

Hack The Box - Forest - Writeup

Anonymous RPC enumeration, AS-REP Roasting, BloodHound privilege analysis, ACL abuse, and DCSync exploitation on HackTheBox Forest.

HackTheBox Windows Active Directory AS-REP Roasting BloodHound DCSync ACL Abuse WinRM

Easy

Hack The Box - Lame - Writeup

Linux service enumeration and exploitation of vulnerable Samba services on Hack The Box Lame.

HackTheBox Linux Samba vsftpd Metasploit CVE-2007-2447 CVE-2011-2523 Remote Code Execution

Medium

Hack The Box - Querier - Writeup

Abusing exposed SMB shares, MSSQL credentials, NTLM capture, and credential discovery to compromise Querier.

HackTheBox Windows MSSQL SMB NTLM Responder Hashcat PowerUp WinRM

Medium

Hack The Box - Resolute - Writeup

Active Directory enumeration, password spraying, WinRM access, PowerShell transcript credential discovery, and DnsAdmins privilege escalation on Hack The Box Resolute.

HackTheBox Windows Active Directory Password Spraying WinRM DnsAdmins PowerShell Privilege Escalation