Archives

Kitsune writeup (HackSmarter Pro Labs): anonymous SMB access, Password Safe cracking, PAC injection via ADCS ESC13, DACL abuse, DPAPI credential extraction, ReadGMSA, and NTDS.dit dump via Backup Operators.

How to extract credentials from a Windows memory dump using WinDbg with the Mimikatz kernel extension, working directly on the context of protected processes.

Search writeup (HackTheBox): web credentials, Kerberoasting, password spraying, hidden Excel column, GMSA abuse and GenericAll to DC.

ShadowGate writeup (HackSmarter Pro Labs): anonymous AD enumeration, AS-REP Roasting, Shadow Credentials with Certipy, ESC8 and DCSync.

Insane difficulty HackTheBox machine focused on Active Directory, reverse engineering with Ghidra, BitLocker recovery, GMSA abuse, and ADCS ESC4 exploitation.

Comprehensive guide to multi-hop pivoting and network tunneling using Ligolo-NG, tailored for CPTS and practical pentesting environments.

Integrating Model Context Protocol (MCP) with Mythic C2 and OpenCode to enhance offensive operations and command-and-control workflows with AI.

Techniques and LOLBins for extracting LSASS process memory in Windows environments without triggering traditional Mimikatz signatures.

Leveraging the Model Context Protocol (MCP) to connect Claude AI directly with BloodHound graph databases for automated Active Directory analysis.

Deep dive into exploiting ADCS ESC8 via Kerberos Relay using KrbRelay to obtain domain controller certificates and achieve domain takeover.

Exploitation of ADCS ESC11 through unencrypted RPC ICertPassage interfaces via NTLM relaying to compromise Active Directory environments.

Step-by-step walkthrough of ADCS ESC8 exploitation over HTTP Web Enrollment using NTLM Relay for full Active Directory domain escalation.

Privilege escalation across Active Directory trust boundaries: abusing Child-to-Parent trusts within the same forest to compromise the root domain.

My journey, preparation strategy, lab experiences, and tips for successfully passing the Altered Security Certified Red Team Professional (CRTP) exam.

Mi camino, anécdotas, preparación y metodología para aprobar la certificación Certified Red Team Professional (CRTP) de Altered Security.

Guía técnica y práctica para comprender y explotar desbordamientos de búfer en arquitecturas x86 (32 bits) en entornos Linux.