Red Team operations,
Active Directory security,
and technical notes

Credential exposure via an open Git repository leads to admin access on BackdropCMS, a web shell foothold, and ultimately root via a misconfigured sudo permission on bee.

A WinRM foothold leads to a chain of AD abuse — GenericAll, ForceChangePassword, GenericWrite, Kerberoasting, and DCSync — culminating in Domain Admin after cracking a PSafe3 password manager file.

SNMP leaks credentials to abuse the API, a CVE steals the admin API key, and built-in functionality delivers a reverse shell before a sudo misconfiguration leads to root.

CVE-2023-4226 delivers a reverse shell on a Chamilo LMS instance, credentials in a config file grant SSH access as mtz, and a symlink to /etc/sudoers abused via a sudoable setfacl script leads to root.

A forged JWT from a decompiled .NET WASM DLL exposes a SQL injection foothold, before chaining WriteSPN Kerberoasting, a malicious login script, and DCSync via Mimikatz to reach Domain Admin.

Writeups for OSINT challenges I solved while competing in DamCTF24 - Placed 27th out of 207 teams.

Writeups for OSINT challenges I solved while competing in UTCTF 2024 - Placed 135th out of 854 teams.