Search for a command to run...
Articles tagged with #writeup
INFO: Ports and Services 53/tcp open domain 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 32...
It starts with a Jenkins backup on an rsync server. A password is decrypted to access Gitea, then a Jenkins pipeline is modified to gain exec [...]
Lustrous2 is a hardened AD Environment on Vulnlab that involves dealing with LDAP signing, channel binding and disabled NTLM authentication.
Explore the steps for exploiting Apache Tomcat, abusing JMX on port 2222, and achieving root access in Vulnlab's system
Box Summary The box had an LFI in a web dashboard that allowed log poisoning, leading to a shell as www-data. From there, I found sadm was a trusted user via rlogin, so I created a local user with the same name and logged in without a password. Insid...
NMAP & INFO Backdooring a ClickOnce deployment, which led to code execution. SCCM Client Push Coercion to capture NTLM hashes, privesc using ADCS by forging a certificate and abusing it with PassTheCert to grant DCSync rights. DC01.push.vl 53/t...
