Active Directory & Windows on Hackpuntes

Logging WriteUp

Sat, 18 Jul 2026 00:00:00 +0000

Logging is a 🟧 Medium difficulty machine on Hack The Box, and it is one of those Active Directory boxes where you keep chaining one flaw after another until you own the whole domain. We start by reading a plaintext password someone left lying around in a log, we abuse permissions over a gMSA account to grab its hash, we jump to another user with a DLL hijacking in a scheduled task, and to finish we request an ADCS certificate via ESC1 and impersonate a WSUS server to run code as SYSTEM on the Domain Controller. It sounds like a lot, but we are going to take it slow and go bit by bit.

NanoCorp WriteUp

Sat, 20 Jun 2026 00:00:00 +0000

NanoCorp is a 🟥 Hard difficulty machine from the Hack The Box platform. The attack chain starts at a job portal that accepts résumés in ZIP format: by packaging a malicious .library-ms file (CVE-2025-24071) we get the server, on extraction, to try to authenticate over SMB against our machine, leaking the NetNTLMv2 hash of a service account. After cracking that password, we use BloodHound to map the domain and discover a DACL abuse chain that lets us join a privileged group and reset the password of another service account with WinRM access. The final escalation exploits CVE-2024-0670 in the Checkmk monitoring agent, abusing the repair of its MSI installer to run our own script as NT AUTHORITY\SYSTEM.

Overwatch WriteUp

Sat, 09 May 2026 00:00:00 +0000

Overwatch is a 🟧 Medium difficulty machine on the Hack The Box platform. The attack chain involves enumerating an SMB share accessible with a guest account to obtain a .NET binary with embedded credentials, connecting to an MSSQL server on a non-standard port to discover a misconfigured linked server, poisoning the domain DNS (ADIDNS) to intercept cleartext credentials of a service account, accessing via WinRM and escalating privileges by abusing an internal WCF service with command injection in the KillProcess method.

DarkZero WriteUp

Sat, 04 Apr 2026 00:00:00 +0000

DarkZero is a 🟥 Hard difficulty machine on the Hack The Box platform that simulates an enterprise Active Directory environment with two separate domains, multihoming, and advanced attack vectors. The ultimate goal is to fully compromise both Domain Controllers.

At the start, we are given initial credentials: 🔑 john.w:RFulUtONCOL!

🗺️ Attack Chain

Before diving into the details, here is the full attack chain at a glance:

john.w credentials
│
▼
MSSQL DC01 (guest) ──linked server──► MSSQL DC02 (sysadmin)
│
▼
xp_cmdshell ► Shell as svc_sql on DC02 (172.16.20.2)
│
▼
Ligolo-MP ► Access to internal network 172.16.20.0/24
│
▼
AD CS (Certify) ► NTLM hash of svc_sql ► Password change
│
▼
RunasCs (LogonType 5) ► SeImpersonatePrivilege
│
▼
SigmaPotato ► NT AUTHORITY\SYSTEM on DC02
│
▼
Rubeus monitor + xp_dirtree ► DC01$ TGT
│
▼
Pass-the-Ticket ► secretsdump ► DC01 Administrator hash
│
▼
evil-winrm ► Administrator on DC01 🏴

🔍 Reconnaissance

Port Scanning

We perform reconnaissance in two phases: first we quickly discover open ports, then we run detection scripts against them.

Fixing the Kerberos KRB_AP_ERR_SKEW Error

Tue, 03 Mar 2026 00:00:00 +0000

You are deep into an intrusion exercise, you have successfully compromised a vulnerable certificate template in Active Directory Certificate Services (ADCS), and you already hold the precious administrator.pfx file. The logical next step is to request a Ticket Granting Ticket (TGT) and extract the administrator’s hash. You launch certipy-ad with a smile on your face, and suddenly, the terminal spits this out:

certipy-ad auth -pfx 'administrator.pfx' -dc-ip 10.2.10.10 -debug
...
[*] Using principal: 'administrator@hackpuntes.loc'
[*] Trying to get TGT...
[+] Sending AS-REQ to KDC hackpuntes.loc (10.2.10.10)
[-] Got error while trying to request TGT: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)
...
impacket.krb5.kerberosv5.KerberosError: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)

That infamous KRB_AP_ERR_SKEW. The disappointment is immeasurable and your day is ruined.

AppLocker: Bypassing Default Rules with MSBuild

Sat, 06 Dec 2025 00:00:00 +0000

AppLocker has established itself as a primary line of defense for restricting software execution within corporate environments. However, a hasty implementation that blindly relies on Default Rules can provide a false sense of security.

If an administrator configures AppLocker to allow anything signed by Microsoft or anything residing in C:\Windows\*, a malicious user could leverage native system binaries (LOLBins) to execute arbitrary code. Today, we are going to dissect how MSBuild.exe can become our gateway to a Meterpreter session, effectively evading these basic restrictions.