BloodHound
5 posts
HTB Administrator: Medium Walkthrough – ACL Abuse Chain to Targeted Kerberoasting and DCSync
A single set of low-privilege AD credentials unlocks a chain of ACL abuses — GenericAll, ForceChangePassword, and GenericWrite — that leads to a targeted Kerberoasting attack and finally a DCSync, dumping the Administrator hash straight out of the domain.
StreamIO — SQL Injection to RFI, Firefox Creds, and LAPS Abuse on a Windows DC
MSSQL injection on a movie streaming site leaks password hashes, chained with LFI and a dangerous PHP eval() to land a shell — then Firefox saved passwords and BloodHound ACL abuse lead to reading LAPS and becoming Administrator.
TombWatcher — AD Privilege Chain to ESC15 (CVE-2024-49019) Domain Takeover
A five-hop BloodHound chain — WriteSPN → Kerberoast → gMSA dump → password resets → WinRM — leads to a deleted AD account holding ESC15 (CVE-2024-49019) rights on an ADCS template, ultimately yielding Domain Admin via PassTheCert over Schannel.
HTB Fluffy: From Low-Priv Creds to Domain Admin via CVE-2025-24071 & Shadow Credentials
Starting with low-privileged domain credentials, the attack chain exploits CVE-2025-24071 to leak an NTLM hash, cracks it, abuses GenericAll ACLs, uses Shadow Credentials to take over service accounts, and finally forges an Administrator certificate via ADCS for Domain Admin.
Forest — AS-REP Roasting et DCSync via Exchange permissions
AS-REP Roasting sur un compte sans pré-auth Kerberos, puis abus des permissions Exchange WriteDACL pour obtenir DCSync et dumper les hashes NTDS.