HTB Cicada — Anonymous Share Leak, Guest RID-Brute & Backup Operators to Domain Admin
Posts by Tag
- htb 13
- active-directory 12
- windows 10
- kerberoasting 6
- linux 6
- bloodhound 6
- thm 4
- pass-the-hash 4
- dcsync 4
- smb 3
- as-rep-roasting 3
- flask 2
- ad-cs 2
- certipy 2
- password-reset 2
- rce 2
- symlink 2
- hashcat 2
- kerberos 2
- jwt 2
- windows-server-2025 2
- vulnbank 2
- api-security 2
- owasp 2
- mini-series 2
- introduction 1
- about 1
- gpp 1
- web 1
- lfi 1
- python 1
- sqlite 1
- information-disclosure 1
- sysvol 1
- exchange 1
- writedacl 1
- dns 1
- exfiltration 1
- data-theft 1
- network-security 1
- blue-team 1
- detection 1
- mitigation 1
- github 1
- unquoted-service-path 1
- service-binary-hijacking 1
- winpeas 1
- rdp 1
- autologon 1
- registry 1
- forensics 1
- magic-bytes 1
- file-signatures 1
- ctf 1
- digital-forensics 1
- steganography 1
- cve-2025-24071 1
- shadow-credentials 1
- esc16 1
- bloodyad 1
- flowise 1
- docker 1
- gogs 1
- cve-2025-58434 1
- cve-2025-59528 1
- cve-2025-8110 1
- ssh-port-forwarding 1
- wing-ftp 1
- lua-injection 1
- cve-2025-47812 1
- cve-2025-4517 1
- tar-symlink 1
- sudo-abuse 1
- debian 1
- apache-cxf 1
- xxe 1
- hoverfly 1
- cve-2022-46364 1
- cve-2025-54123 1
- command-injection 1
- session-forging 1
- ubuntu 1
- acl-abuse 1
- password-safe 1
- genericall 1
- genericwrite 1
- forcechangepassword 1
- dpapi 1
- wsl 1
- tombstone-restoration 1
- excel-cracking 1
- ntds 1
- langflow 1
- kubernetes 1
- cve-2026-33017 1
- mcp 1
- kubelet 1
- container-escape 1
- k8s 1
- craftcms 1
- cve-2025-32432 1
- telnetd 1
- cve-2026-24061 1
- mysql 1
- csrf-bypass 1
- easy 1
- gmsa 1
- writespn 1
- writeowner 1
- adcs 1
- esc15 1
- cve-2024-49019 1
- ad-recycle-bin 1
- lsass 1
- credential-dumping 1
- pypykatz 1
- kvcforensic 1
- procdump 1
- lolbins 1
- credential-guard 1
- runasppl 1
- dfir 1
- offense-defense 1
- sql-injection 1
- swagger 1
- authentication 1
- cwe-89 1
- cwe-347 1
- cwe-200 1
- burpsuite 1
- bola 1
- mass-assignment 1
- broken-access-control 1
- transaction-validation 1
- cwe-639 1
- cwe-915 1
- cwe-20 1
- cwe-640 1
- cve 1
- privilege-escalation 1
- pkinit 1
- certificate-abuse 1
- smb-enumeration 1
- rid-brute-force 1
- credential-reuse 1
- backup-operators 1
- sebackupprivilege 1
- secretsdump 1
- netexec 1
- evil-winrm 1
- pivoting 1
- webmin 1
- gitstack 1
- sshuttle 1
- socat 1
htb
HTB Active — My First Real Active Directory Box
Difficulty: Easy OS: Windows IP: 10.129.34.50 Status: Retired
active-directory
THM VulnNet: Roasted — AS-REP Roasting, Kerberoasting & SYSVOL Secrets
THM VulnNet: Roasted
HTB Active — My First Real Active Directory Box
Difficulty: Easy OS: Windows IP: 10.129.34.50 Status: Retired
windows
THM VulnNet: Roasted — AS-REP Roasting, Kerberoasting & SYSVOL Secrets
THM VulnNet: Roasted
HTB Active — My First Real Active Directory Box
Difficulty: Easy OS: Windows IP: 10.129.34.50 Status: Retired
kerberoasting
THM VulnNet: Roasted — AS-REP Roasting, Kerberoasting & SYSVOL Secrets
THM VulnNet: Roasted
HTB Active — My First Real Active Directory Box
Difficulty: Easy OS: Windows IP: 10.129.34.50 Status: Retired
linux
bloodhound
thm
THM VulnNet: Roasted — AS-REP Roasting, Kerberoasting & SYSVOL Secrets
THM VulnNet: Roasted
pass-the-hash
THM VulnNet: Roasted — AS-REP Roasting, Kerberoasting & SYSVOL Secrets
THM VulnNet: Roasted
dcsync
smb
THM VulnNet: Roasted — AS-REP Roasting, Kerberoasting & SYSVOL Secrets
THM VulnNet: Roasted
HTB Active — My First Real Active Directory Box
Difficulty: Easy OS: Windows IP: 10.129.34.50 Status: Retired
as-rep-roasting
THM VulnNet: Roasted — AS-REP Roasting, Kerberoasting & SYSVOL Secrets
THM VulnNet: Roasted
flask
ad-cs
certipy
password-reset
rce
symlink
hashcat
kerberos
jwt
windows-server-2025
vulnbank
api-security
owasp
mini-series
introduction
Hello World — Who is 0x5h4q?
n0 pl4c3 l1k3 127.0.0.1
about
Hello World — Who is 0x5h4q?
n0 pl4c3 l1k3 127.0.0.1
gpp
HTB Active — My First Real Active Directory Box
Difficulty: Easy OS: Windows IP: 10.129.34.50 Status: Retired
web
Back to Top ↑lfi
Back to Top ↑python
Back to Top ↑sqlite
Back to Top ↑information-disclosure
Back to Top ↑sysvol
THM VulnNet: Roasted — AS-REP Roasting, Kerberoasting & SYSVOL Secrets
THM VulnNet: Roasted
exchange
Back to Top ↑writedacl
Back to Top ↑dns
DNS Exfiltration — Stealing Data Through the One Protocol Nobody Blocks
I want to talk about one of my favourite “wait, that actually works?” attacks. Not favourite because it’s complex(quite the contrary really), favourite becau...
exfiltration
DNS Exfiltration — Stealing Data Through the One Protocol Nobody Blocks
I want to talk about one of my favourite “wait, that actually works?” attacks. Not favourite because it’s complex(quite the contrary really), favourite becau...
data-theft
DNS Exfiltration — Stealing Data Through the One Protocol Nobody Blocks
I want to talk about one of my favourite “wait, that actually works?” attacks. Not favourite because it’s complex(quite the contrary really), favourite becau...
network-security
DNS Exfiltration — Stealing Data Through the One Protocol Nobody Blocks
I want to talk about one of my favourite “wait, that actually works?” attacks. Not favourite because it’s complex(quite the contrary really), favourite becau...
blue-team
DNS Exfiltration — Stealing Data Through the One Protocol Nobody Blocks
I want to talk about one of my favourite “wait, that actually works?” attacks. Not favourite because it’s complex(quite the contrary really), favourite becau...
detection
DNS Exfiltration — Stealing Data Through the One Protocol Nobody Blocks
I want to talk about one of my favourite “wait, that actually works?” attacks. Not favourite because it’s complex(quite the contrary really), favourite becau...
mitigation
DNS Exfiltration — Stealing Data Through the One Protocol Nobody Blocks
I want to talk about one of my favourite “wait, that actually works?” attacks. Not favourite because it’s complex(quite the contrary really), favourite becau...
github
Back to Top ↑unquoted-service-path
Back to Top ↑service-binary-hijacking
Back to Top ↑winpeas
Back to Top ↑rdp
Back to Top ↑autologon
Back to Top ↑registry
Back to Top ↑forensics
File Magic Bytes — Why You Can Never Trust a File Extension
Hiding In PL41N S1GHT
magic-bytes
File Magic Bytes — Why You Can Never Trust a File Extension
Hiding In PL41N S1GHT
file-signatures
File Magic Bytes — Why You Can Never Trust a File Extension
Hiding In PL41N S1GHT
ctf
File Magic Bytes — Why You Can Never Trust a File Extension
Hiding In PL41N S1GHT
digital-forensics
File Magic Bytes — Why You Can Never Trust a File Extension
Hiding In PL41N S1GHT
steganography
File Magic Bytes — Why You Can Never Trust a File Extension
Hiding In PL41N S1GHT