Just finished the Checkpoint machine on Hack The Box (Medium difficulty) and it was a really enjoyable Active Directory box with some modern and creative attack paths.

I started with the provided credentials for `alex.turner`. After some enumeration I discovered that a previously deleted account (`mark.davies`) could be restored and that this account had write access to a share called DevDrop. This share was used by the organisation to stage VS Code extensions.

By creating a malicious VSIX extension targeting VS Code engine version 1.118.0 and dropping it on the share, a scheduled task automatically installed the extension and gave me a reverse shell as `ryan.brooks`. This was a really clean example of abusing enterprise software deployment processes.

From the `ryan.brooks` foothold I used Rubeus to obtain a TGT, then leveraged bloodyAD to create a malicious dMSA under a writable OU and impersonated a higher-privileged account. This eventually granted access to a VMBackups share containing a Windows Server memory dump. Using Volatility I extracted the local Administrator NTLM hash from the dump, authenticated with Evil-WinRM, and captured the root flag.

Overall, Checkpoint does a great job of chaining together several current techniques: writable shares for extension abuse, deleted object restoration, dMSA abuse, and memory forensics. It’s a solid Medium box that feels realistic and rewards careful enumeration.

Would recommend it to anyone working on modern Windows / Active Directory attack paths.

#HackTheBox #CyberSecurity #PenetrationTesting #ActiveDirectory #RedTeam #HTB #InfoSec #WindowsSecurity #PrivilegeEscalation #Kerberos #MemoryForensics …

Learn MoreHack The Box: Checkpoint Machine Walkthrough Medium Difficulty

The post Hack The Box: Checkpoint Machine Walkthrough Medium Difficulty appeared first on Threatninja.net.

Completed another Hack The Box machine: Hercules, an Insane difficulty Active Directory challenge.

This was one of the longer attack chains I have worked through, involving multiple stages across web exploitation, credential access, Active Directory enumeration, privilege escalation, AD CS, and Kerberos abuse.

The initial foothold started with LDAP username enumeration and the discovery of credentials stored in an account description. After gaining access to the Hercules Portal, a directory traversal vulnerability exposed the web.config file and its ASP.NET machineKey values. These values allowed a forged Forms Authentication cookie to impersonate web_admin.

From there, a malicious ODT upload triggered an outbound NTLM authentication attempt, allowing the NetNTLMv2 credentials for natalie.a to be captured and cracked. The recovered credentials opened the path to Shadow Credentials against bob.w and stephen.m, followed by OU permission abuse to gain control of the Auditor account.

The privilege escalation chain continued through the Forest Migration OU, where fernando.r was enabled and used to identify an ESC3 misconfiguration. An Enrollment Agent certificate was then obtained and abused to request a certificate for ashley.b, leading to further access within the domain.

The final stages involved controlling IIS_Administrator, taking control of the iis_webserver$ machine account, extracting the required Kerberos session key, and abusing S4U2self/S4U2proxy to impersonate Administrator. This ultimately provided access to the root flag under C:\Users\Admin\Desktop.

Hercules was a great exercise in chaining several seemingly separate weaknesses together rather than relying on a single vulnerability. Definitely a box that required careful enumeration and keeping track of the relationships between users, groups, OUs, certificates, and Kerberos tickets.

Documented as part of my continued HTB practice and learning in Active Directory and offensive security.

#HackTheBox #HTB #Hercules #CyberSecurity #ActiveDirectory #PenetrationTesting #RedTeam #OffensiveSecurity #BloodHound #Certipy #ADCS #ESC3 #Kerberos #ShadowCredentials #PrivilegeEscalation #InfoSec #CyberSecurityLearning …

Learn MoreHack The Box: Hercules Machine Walkthrough – Insane Diffucility

The post Hack The Box: Hercules Machine Walkthrough – Insane Diffucility appeared first on Threatninja.net.

Completed the Hack The Box “Pirate” machine, a hard-difficulty Active Directory challenge that required chaining multiple attack paths rather than relying on a single vulnerability.

The enumeration phase uncovered domain users, pre-created computer accounts, GMSAs, delegation relationships, and an exposed internal network. Access to gMSA_ADFS_prod$ led to DC01 and enabled an internal pivot to WEB01. From there, the attack chain involved GMSA credential retrieval, NTLM relay, authentication coercion, shadow credentials, certificate-based authentication, and Kerberos ticket abuse.

The privilege escalation path continued through constrained delegation and resource-based constrained delegation. Kerberos ticket manipulation ultimately provided Administrator access to the domain controller, followed by a SYSTEM-level shell and extraction of domain credentials from NTDS.dit. Both the user and root flags were successfully obtained.

Another challenging AD machine completed and another deep dive into Windows authentication, delegation, and privilege escalation.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #ActiveDirectory #RedTeam #Kerberos #NTLMRelay #ShadowCredentials #GMSA #PrivilegeEscalation #WindowsSecurity #Cybersecurity #Infosec #HTBWriteup …

Learn MoreHack The Box: Pirate Machine Walkthrough – Hard Difficulity

The post Hack The Box: Pirate Machine Walkthrough – Hard Difficulity appeared first on Threatninja.net.

Completed another Hack The Box machine focused on Active Directory exploitation and privilege escalation.

The attack involved SMB enumeration, credential discovery through log analysis, Kerberos authentication, Shadow Credentials abuse, and DLL hijacking to gain user-level access. Further enumeration revealed a WSUS infrastructure weakness, allowing exploitation through Kerberos delegation abuse, certificate-based authentication, and a WSUS machine-in-the-middle attack to achieve Domain Admin privileges. This challenge strengthened my understanding of modern AD attack paths, Kerberos abuse techniques, and enterprise infrastructure security.

#HackTheBox #HTB #CyberSecurity #ActiveDirectory #RedTeam #PenetrationTesting #OffensiveSecurity #EthicalHacking #InfoSec …

Learn MoreHack The Box: Logging Machine Walkthrough – Medium Difficulty

The post Hack The Box: Logging Machine Walkthrough – Medium Difficulty appeared first on Threatninja.net.