https://wearethebug.dev/tags/dpapi/Recent content on WE ARE THE BUGTradecraften-usSun, 09 Aug 2026 00:00:00 +0000https://wearethebug.dev/posts/htb-danglingtree/Sun, 09 Aug 2026 00:00:00 +0000https://wearethebug.dev/posts/htb-danglingtree/DanglingTree is a Medium-difficulty Windows machine focusing on Windows Admin Center (WAC) exploitation and cryptographic analysis. The foothold involves exploiting CVE-2026-26119 in WAC to execute PowerShell commands and abusing SmarterMail vulnerabilities (CVE-2026-23760/CVE-2026-24423) to gain initial access. The path to root requires DLL decompilation for DES decryption, DPAPI credential recovery, ACL abuse, and ADCS exploitation to escalate privileges to Administrator.https://wearethebug.dev/posts/vl-odori/Fri, 17 Jan 2025 00:00:00 +0000https://wearethebug.dev/posts/vl-odori/Odori is a medium-difficulty machine on Vulnlab that involves gaining access to a Bitlocker encrypted disk image, in order to retrieve DPAPI protected credentials. Furthermore we will use SFTP to bypass login restrictions and manipulate a python cache file to gain root privileges.https://wearethebug.dev/posts/vl-klendathu/Fri, 24 May 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-klendathu/Klendathu is an Insane difficulty chain hosted on Vulnlab, involved coercion with an undocumented function/procedure on MSSQL, forging a silver ticket, spoofing domain users on linux with GSSAPI authentication, and decrypting RDCMan credentials with domain backup keys.https://wearethebug.dev/posts/vl-tengu/Thu, 28 Mar 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-tengu/Tengu is a medium-rated chained machine on VulnLab, features a mixed environment with two Windows hosts and one Linux host. Exploiting Node-RED on Linux (with MSSQL) grants command execution, decrypts service passwords, and pivots to dump NTLM hash. Constrained delegation allows impersonating MSSQL admin for local admin access then recover Domain Admin credentials via DPAPI and Kerberos to compromise the Domain Controller (DC).https://wearethebug.dev/posts/vl-reaper/Fri, 18 Aug 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-reaper/Reaper is an Insane Windows machine that begins with an exposed FTP service. Within the FTP share resides a Windows binary vulnerable to both format-string and buffer-overflow attacks. By exploiting these flaws, an attacker can leak sensitive memory regions, hijack the program’s execution flow, and ultimately obtain a reverse shell on the target as the user keysvc. After gaining initial access, the attacker discovers a file containing a DPAPI blob. Once decrypted, this blob provides valid credentials for RDP access as keysvc. Continued enumeration reveals a custom kernel driver present and actively running on the system. Through reverse-engineering the driver, the attacker determines that it permits arbitrary kernel-level writes. Leveraging this capability, the attacker is able to steal a privileged token and escalate to a full SYSTEM shell (NT AUTHORITY\SYSTEM).https://wearethebug.dev/posts/vl-reflection/Sat, 10 Jun 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-reflection/Reflection is a medium-difficulty Active Directory chain that simulates a vulnerable enterprise environment and challenges users to progress from limited access to Domain Administrator. Including 3 machines, with anonymous SMB bind abuse, MSSQL abuse, NTLM relay attacks, Windows Credential Vault harvesting, Resource-Based Constrained Delegation (RBCD), and finally credential reuse.