2026-06-30 5 min
[notes]
Shadow Credentials in Active Directory Explained
Shadow Credentials in AD: writing msDS-KeyCredentialLink to authenticate as the target through PKINIT, without ever touching its password.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2026-06-26 5 min
[notes]
Linux Privilege Escalation Beyond sudo -l
Linux privilege escalation past sudo -l: SUID binaries, capabilities, cron jobs, systemd units, group membership and the Docker socket.
2026-06-23 6 min
[notes]
Kerberos for Offensive Security: How the Protocol Works
Kerberos for pentesters: AS-REQ, TGT, SPNs and the PAC, where AS-REP Roasting and Kerberoasting fit, and why clock skew breaks everything.
2026-06-19 5 min
[notes]
SSRF to Cloud Metadata: Reaching IMDS Through One Request
How a user controlled URL reaches cloud metadata, why IMDSv1 and IMDSv2 change the test, and how to prove impact without breaking the target.
2026-06-16 6 min
[notes]
AD CS ESC1 Explained: Exploiting Certificate Templates
AD CS ESC1 end to end: the four template conditions that create it, enumeration with Certipy, requesting the certificate, and how to remediate it.