Tag: ADCS

All the articles with the tag "ADCS".

• Kitsune — HackSmarter Pro Labs

  22 Oct, 2026

  Kitsune writeup (HackSmarter Pro Labs): anonymous SMB access, Password Safe cracking, PAC injection via ADCS ESC13, DACL abuse, DPAPI credential extraction, ReadGMSA, and NTDS.dit dump via Backup Operators.

• Search — HackTheBox

  22 Sep, 2026

  Search writeup (HackTheBox): web credentials, Kerberoasting, password spraying, hidden Excel column, GMSA abuse and GenericAll to DC.

• ShadowGate — HackSmarter Pro Labs

  21 Sep, 2026

  ShadowGate writeup (HackSmarter Pro Labs): anonymous AD enumeration, AS-REP Roasting, Shadow Credentials with Certipy, ESC8 and DCSync.

• Infiltrator — HackTheBox

  5 Sep, 2026

  Insane difficulty HackTheBox machine focused on Active Directory, reverse engineering with Ghidra, BitLocker recovery, GMSA abuse, and ADCS ESC4 exploitation.

• Active Directory Certificate Services: Abusing ADCS ESC8 (Kerberos Relay)

  30 Jun, 2026

  Deep dive into exploiting ADCS ESC8 via Kerberos Relay using KrbRelay to obtain domain controller certificates and achieve domain takeover.