Phantom is a Medium AD box where SMB enumeration leads to a decrypted VeraCrypt container, recovered credentials enable a foothold via password spraying, and Resource-Based Constrained Delegation (RBCD) is exploited to gain Administrator access.

On Nocturnal, an IDOR exposed credentials that unlocked the admin panel and source code. A command injection led to a shell, cracked database hashes enabled SSH access, and exploiting ISPConfig CVE-2023-46818 provided root.

LustrousTwo is a hard HackTheBox Windows machine where I use FTP to gather usernames, then spray with kerbrute and elpscrk to access an IIS site with Kerberos (IIS_KERBEROS_AUTH). By decompiling DLLs and abusing S4U2Proxy constrained_delegations, I achieve RCE and escalate via a Velociraptor server key.

VulnEscape is an Easy Difficulty Windows machine where users exploit a Remote Desktop Server to connect as KioskUser0, bypass restrictions using Microsoft Edge, and uncover a password to gain admin access and capture the root flag.

This blog post explains cross-session relay attacks, covering COM/DCOM basics and authentication flaws. It details how attackers exploit weak configurations to relay credentials.

Shibuya is a hard Windows machine that requires extensive enumeration across multiple services and accounts. The attack chain involves exploiting exposed protocols, credential discovery, and lateral movement. Privilege escalation is achieved through abusing Active Directory Certificate Services.

Cat is a medium-difficulty Linux machine featuring a custom PHP web application vulnerable to XSS, which allows cookie hijacking and privilege escalation. A SQL injection in a SQLite database enables remote code execution and access to internal logs, which leak plaintext credentials. These are used to access a vulnerable Gitea instance (CVE-2024-6886), ultimately leading to the discovery of root credentials in a private repository.

Titanic is an easy Linux machine with a booking site and a Gitea instance. An arbitrary file read vulnerability allows access to Gitea's SQLite database, leading to cracked SSH credentials. A scheduled script using a vulnerable magick binary (CVE-2024-41817) is exploited for root access.