Bonnie Tyler, who represented the United Kingdom at the Eurovision Song Contest, has passed away at the age of 75. In May, Bonnie Tyler was rushed to a hospital in Faro, Portugal, for emergency int…

Mist is an insane-level Windows box mostly focused on Active Directory attacks. It starts off with a simple file disclosure vulneraility in Pluck CMS that allows me to leak the admin password and upload a malicious Pluck module to get a foothold on the webserver. There’s a directory at the filesystem root with links in it, and by overwriting one, I get execution as a user on the host. I’ll find LDAP signing is off, and use PetitPotam to coerce the server to authenticate to my, and relay that to the domain controller to get LDAP access as the machine account. I’ll add a shadow credential to that account and get auth as the machine account on the webserver. I’ll use machine access to get access to the local administrator account. In another user’s home directory I’ll find a KeePass database, along with an image showing a partial password. I’ll use Hashcat to break the database and get an account on the domain. From there, I’ll abuse multiple hops in Active Directory, reading a GMSA password, abusing AddKeyCredentialLink, and exploiting ADCS ESC 13 twice.

Active Directory Certificate Services (ADCS) is a critical component in Windows environments, often targeted during penetration testing and red team engagements. This article explores common vulnerabilities and misconfigurations in ADCS, specifically focusing on ESC (Elevation of Service Control) vulnerabilities like ESC5, ESC7, ESC9, ESC10, ESC11, ESC13, ESC14, and ESC15. You Should Know: 1. Understanding ADCS Vulnerabilities ADCS provides PKI (Public Key Infrastructure) services in Windows domains.