Kitsune — HackSmarter Pro Labs
Kitsune writeup (HackSmarter Pro Labs): anonymous SMB access, Password Safe cracking, PAC injection via ADCS ESC13, DACL abuse, DPAPI credential extraction, ...
Recent posts
Credential Extraction with WinDbg + Mimikatz
How to extract credentials from a Windows memory dump using WinDbg with the Mimikatz kernel extension, working directly on the context of protected processes.
Search — HackTheBox
Search writeup (HackTheBox): web credentials, Kerberoasting, password spraying, hidden Excel column, GMSA abuse and GenericAll to DC.
ShadowGate — HackSmarter Pro Labs
ShadowGate writeup (HackSmarter Pro Labs): anonymous AD enumeration, AS-REP Roasting, Shadow Credentials with Certipy, ESC8 and DCSync.
Infiltrator — HackTheBox
Insane difficulty HackTheBox machine focused on Active Directory, reverse engineering with Ghidra, BitLocker recovery, GMSA abuse, and ADCS ESC4 exploitation.