https://wearethebug.dev/tags/active-directory/Recent content on WE ARE THE BUGTradecraften-usSat, 12 Sep 2026 00:00:00 +0000https://wearethebug.dev/posts/bloodyad/Sat, 12 Sep 2026 00:00:00 +0000https://wearethebug.dev/posts/bloodyad/Active Directory privilege escalation swiss-army knife. Quick reference for common bloodyAD operations.https://wearethebug.dev/posts/netexec-advanced/Fri, 28 Aug 2026 00:00:00 +0000https://wearethebug.dev/posts/netexec-advanced/Follow-up to the NetExec cheatsheet: deeper Active Directory abuse techniques, delegation attacks, and operational tooling for experienced operators.https://wearethebug.dev/posts/netexec/Sat, 25 Jul 2026 00:00:00 +0000https://wearethebug.dev/posts/netexec/Swiss-army knife for Active Directory and network protocol enumeration/exploitation, successor to CrackMapExec.https://wearethebug.dev/posts/htb-heron/Fri, 14 Nov 2025 00:00:00 +0000https://wearethebug.dev/posts/htb-heron/Heron is a small Active Directory scenario that involves typical vulnerabilities found in real word company environments. It's designed for penetration testers and red teamers in search of a quick and challenging lab.https://wearethebug.dev/posts/vl-heron/Thu, 13 Jun 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-heron/Heron is a medium-difficulty chain hosted on Vulnlab, featuring an assumed breach from a domain-joined linux jump server access to domain controller. Starting with an enumeration of the internal website for domain users and performing AS-REP roasting, decrypting GPP password from the sysvol share, leading to smb share having write access to web.config, gaining a shell by using AspNetCoreModule for executing powershell commands which lead to finding linux admin’s credentials, reusing the same password that will lead to another user which has WriteAccountRestrictions on dc that leads to resource based delegation