https://wearethebug.dev/tags/esc7/Recent content on WE ARE THE BUGTradecraften-usSat, 12 Sep 2026 00:00:00 +0000https://wearethebug.dev/posts/htb-trustfall/Sat, 12 Sep 2026 00:00:00 +0000https://wearethebug.dev/posts/htb-trustfall/TrustFall is an Insane-rated hybrid machine featuring a complex, multi-stage kill chain that bridges external web exploitation with deep Active Directory and ADCS abuse. Initial access requires chaining an osTicket arbitrary file read with a legacy telnetd vulnerability to compromise a Linux pivot host. Lateral movement involves intricate ACL/OU inheritance abuse, AS-REP roasting, and a sophisticated WSUS Man-in-the-Middle attack powered by a rogue certificate (ESC17) for local privilege escalation. The endgame tests cryptographic weaknesses and PKI administration, requiring the prediction of a time-seeded VBScript PRNG to compromise a PKI Manager, ultimately leading to full Certificate Authority takeover (ESC7) and Domain Admin compromise via DCSync.https://wearethebug.dev/posts/vl-intercept/Sat, 25 Dec 2021 00:00:00 +0000https://wearethebug.dev/posts/vl-intercept/Intercept is a small Active Directory scenario rated as Hard that provides hands-on experience with common Active Directory vulnerabilities and misconfigurations, demonstrating relay attacks and authentication coercion attacks can be used to get access to the domain.