YouTube video by AVROTROS

YouTube video by AVROTROS

YouTube video by AVROTROS

YouTube video by AVROTROS

YouTube video by AVROTROS

YouTube video by AVROTROS

YouTube video by AVROTROS

Fries is an assume breach Windows box that hides a sprawl of Linux services behind the domain controller. I’ll start with a set of credentials that don’t work anywhere obvious and use them to log into a Gitea instance, recovering database and pgAdmin access along the way. An outdated pgAdmin is vulnerable to a Python eval remote code execution bug that lands a shell in a container. From environment variables and the pgAdmin database I’ll collect more credentials and spray them to get a shell on the Docker host, which is itself a Hyper-V guest. There I’ll abuse a network file share by recreating a domain user locally to read the Docker daemon’s certificates, forge a client certificate, and use the Docker API to mount the host filesystem and become root. Root on that host holds a PWM configuration with an encrypted service account password, which I’ll recover to move into the domain. That account can read a group managed service account password, and from there I’ll abuse control over the certificate authority, chaining three ADCS misconfigurations to forge a certificate for the administrator and take over the domain.

Fluffy is an assume-breach Windows Active Directory challenge. I’ll start by exploiting CVE-2025-24071 / CVE-2025-24055, a vulnerability in how Windows handles library-ms files in zip archives, leading to authentication attempts to the attacker. I’ll get a NetNTLMv2 and crack it. From there, BloodHound data shows that this user has GenericWrite over some service accounts. I’ll abuse that to get a WinRM shell with one. From this user, I’ll exploit ESC16 in the ADCS environment to get a shell as Administrator.

Certipy has been quiet for a while - but not forgotten. After two years without active maintenance, I'm happy to say that changes are coming. Today, I'm releasing Certipy v5. It's been two years si...

要旨 2021年、SpecterOpsのWill SchroederとLee Christensenが発表した論文「Certified Pre-Owned」は、Active Directory Certificate Services（ADCS）における攻撃クラスを「ES...

Introduction The release of Metasploit Pro 5.0.0 marks a significant leap in red‑teaming capabilities, introducing an intuitive workflow and powerful modules that target Active Directory Certificate Services (AD CS). With cybercriminals increasingly weaponizing certificate‑based attack vectors such as ESC9, ESC10, and ESC16, security teams must now understand both the offensive mechanics and the defensive countermeasures to protect their environments. This article dissects the new AD CS metamodules, provides step‑by‑step exploitation guides, and delivers actionable commands to audit and harden your PKI infrastructure.

Introduction: The Hack The Box machine "Fluffy" presents a realistic assumed breach scenario, challenging penetration testers to move from initial low-privileged access to full domain compromise. This walkthrough demonstrates a critical attack path involving a novel vulnerability, improper Access Control List (ACL) configurations, and the exploitation of Active Directory Certificate Services, highlighting common misconfigurations in enterprise environments. Learning Objectives: Understand the exploitation process for CVE-2025-24071 to perform lateral movement.

Introduction: Active Directory Certificate Services (ADCS) presents a complex attack surface for penetration testers and a critical hardening area for defenders. The recent HackTheBox machine, Fluffy, showcases the real-world impact of combining NTLM relay techniques with ADCS misconfigurations, specifically leveraging CVE-2025-24071 and ESC16 to achieve full domain compromise. Learning Objectives: Understand the attack chain from initial NetNTLMv2 capture to domain administrator.

Active Directory Certificate Services (ADCS) is a prime target for attackers due to misconfigurations and misunderstood certificate templates. This article covers exploitation techniques from ESC1 to ESC16, including real-world penetration testing examples and GOAD lab scenarios. Read the full article here: Breaking ADCS: ESC1 to ESC16 Attack Techniques You Should Know: ESC1 Exploitation (Misconfigured Certificate Templates) Attackers can request a certificate with arbitrary SAN (Subject Alternative Name) for domain escalation.

Source: GitHub - jakehildreth/Locksmith Active Directory Certificate Services (AD CS) is a critical component in enterprise environments, but misconfigurations can lead to severe security risks like ESC7 (Enterprise SubCA Certificate Template Abuse) and the newly discovered ESC16 (AD CS Relay Attack). Jake Hildreth’s Locksmith tool now includes detections for these vulnerabilities. You Should Know: 1. Understanding ESC7 & ESC16 Risks…