2025-07-02 2 min
[notes]
Reviewing TryHackMe's PT1 Certification
An honest review of TryHackMe's PT1 entry-level pentest certification: web exploitation, network pentesting, AD attacks, and how it reads as OSCP prep.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2025-07-01 18 min
[writeup]
Hack The Box RustyKey Writeup (Hard Windows)
Hard Windows AD box. Timeroasting cracks a machine account, pulling IT out of Protected Objects frees Kerberos, and a 7-Zip COM hijack ends in RBCD.
2025-06-19 4 min
[writeup]
TryHackMe Services Writeup (Windows AD)
Windows AD room. Staff names become usernames, j.rock turns out to be AS-REP roastable, and a binPath rewrite on the cfn-hup service returns SYSTEM.
2025-06-19 8 min
[writeup]
TryHackMe Ledger Writeup (Windows AD)
Windows AD room. Guest SMB and LDAP description fields leak CHANGEME2023!, and an ESC1 template lets certipy mint a certificate for the Administrator.
2025-06-11 7 min
[writeup]
Hack The Box Scepter Writeup (Hard Windows)
Hard Windows AD box. Crackable PFX files on an NFS export give d.baker, ForceChangePassword and ADCS ESC9 chain to h.brown across the domain.