Search Ctrl + K

Search Ctrl + K

Home

HTB-Machines

HTB-Season-10

HTB-Season10-DevArea

HTB-Season10-Interpreter

HTB-Season10-Kobold

HTB-Season10-Pirate

HTB-Season10-Pterodactyl

HTB-Season-10-Facts

HTB-Season-11

HTB Connected Writeup

HTB-Season-11-Reactor

Enter your search text in the box above

Select a result to preview

Enter to select

⇅ to navigate

ESC to close

HTB Checkpoint

#HackTheBox #ActiveDirectory #BadSuccessor #dMSA #AS-REProasting #premium

🔒 Verifying access...

❯ react to this write-up

COMMENTS

❯ loading comments...

Connected Pages

HTB Checkpoint

Overview
Reconnaissance
1. Nmap Scan
2. LDAP Root DSE Enumeration
Foothold — ACL Abuse & AD Recycle Bin Restoration
1. Enumerating Writable Objects with bloodyAD
2. Restoring the Deleted Object
AS-REP Roasting — Mark Davies
Initial Shell — Malicious VS Code Extension via SMB
1. Building a Malicious .vsix Extension
2. Packaging and Delivery
User Flag
Privilege Escalation — BadSuccessor (dMSA Abuse)
Lateral Movement — svc_deploy via Evil-WinRM
Discovering the VM Memory Dump
Privilege Escalation — Memory Forensics with Volatility
1. Extracting Hashes from the Memory Dump
Root Flag
Attack Chain Summary
Key Takeaways

Pages mentioning this page

No other pages mentions this page