https://wearethebug.dev/tags/dacl/Recent content on WE ARE THE BUGTradecraften-usSat, 12 Sep 2026 00:00:00 +0000https://wearethebug.dev/posts/bloodyad/Sat, 12 Sep 2026 00:00:00 +0000https://wearethebug.dev/posts/bloodyad/Active Directory privilege escalation swiss-army knife. Quick reference for common bloodyAD operations.https://wearethebug.dev/posts/htb-trustfall/Sat, 12 Sep 2026 00:00:00 +0000https://wearethebug.dev/posts/htb-trustfall/TrustFall is an Insane-rated hybrid machine featuring a complex, multi-stage kill chain that bridges external web exploitation with deep Active Directory and ADCS abuse. Initial access requires chaining an osTicket arbitrary file read with a legacy telnetd vulnerability to compromise a Linux pivot host. Lateral movement involves intricate ACL/OU inheritance abuse, AS-REP roasting, and a sophisticated WSUS Man-in-the-Middle attack powered by a rogue certificate (ESC17) for local privilege escalation. The endgame tests cryptographic weaknesses and PKI administration, requiring the prediction of a time-seeded VBScript PRNG to compromise a PKI Manager, ultimately leading to full Certificate Authority takeover (ESC7) and Domain Admin compromise via DCSync.https://wearethebug.dev/posts/vl-baby2/Sun, 19 Jan 2025 00:00:00 +0000https://wearethebug.dev/posts/vl-baby2/Baby2 is a medium-rated Active Directory machine on Vulnlab. The attack path involves initial SMB enumeration, password spraying to gain low-privileged domain user access, replacing a login VBS script in SYSVOL for a reverse shell, and escalating privileges by abusing GPO (Group Policy Object) DACL misconfigurations.https://wearethebug.dev/posts/vl-wutai/Tue, 20 Aug 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-wutai/Wutai is a Medium-difficulty Red Team lab featuring 15+ machines across multiple networks, domains, and forests, challenging players to achieve Enterprise Admin status. Players refine AD enumeration, exploitation, certificate services, lateral movement, EDR bypass, reverse engineering, and covert operations while abusing trust relationships.