2026-08-25 5 min
[notes]
NTLM Relay to AD CS: The ESC8 Attack Explained
ESC8 explained: relaying coerced NTLM authentication into the AD CS web enrollment endpoint, and why the issued certificate outlives the relay.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2026-08-21 5 min
[notes]
OAuth Account Takeover Chains: state, PKCE and Linking
OAuth account takeover chains: redirect URI matching, state and PKCE bindings, account linking abuse, email as identity and Mix-Up attacks.
2026-08-21 5 min
[notes]
HackingClub Gantry (Fácil Linux): Stats e Writeup
HackingClub Gantry: máquina fácil de Linux ativa, first blood em 10m18s pelo dumahgrind da hackersOnSteroids, o mais rápido da rotação, e 11,1% de abandono.
AD
2026-08-21 4 min
[notes]
HackingClub Ledgerline (Médio Linux): Stats e Writeup
HackingClub Ledgerline: máquina média de Linux ativa, first blood em 27m48s, 10 conclusões e 0% de abandono. As duas flags valem o mesmo tier.
AD
2026-08-21 4 min
[notes]
HackingClub Reinforcement (Difícil Windows): Stats e Writeup
HackingClub Reinforcement: máquina difícil de Windows ativa, first blood só em 27h03m e 28,6% de abandono. Os quatro primeiros fecharam em 41 minutos.
AD