https://wearethebug.dev/tags/ftp/Recent content on WE ARE THE BUGTradecraften-usFri, 22 Nov 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-redelegate/Fri, 22 Nov 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-redelegate/Redelegate is a hard-difficultly Windows machine that starts with Anonymous FTP access, which allows the attacker to download sensitive Keepass Database files. The attacker then discovers that the credentials in the database are valid for MSSQL local login, which leads to enumerate SIDs and performs a password spray attack. Being a member of the HelpDesk group, the newly compromised user account Marie.Curie has a User-Force-Change-Password Access Control setup over the Helen.Frost user account; that user account has privileges to get a PS remoting session onto the Domain Controller. The Helen.Frost user account also has the SeEnableDelegationPrivilege assigned and has full control over the FS01$ machine account, essentially allowing the attacker account to modify the msDS-AllowedToDelegateTo LDAP attribute and change the password of a computer object and perform a Constrained Delegation attack.https://wearethebug.dev/posts/vl-kaiju/Fri, 02 Feb 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-kaiju/Kaiju is a Hard-rated Active Directory chain, from initial reconnaissance to full domain compromise, covering FileZilla exploitation, KeePass database extraction, NTLM relay attacks, and ADCS abuse (ESC8).https://wearethebug.dev/posts/vl-sync/Tue, 25 Apr 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-sync/Sync is an Easy-rated Linux machine on the Vulnlab platform that focuses on service enumeration and exploiting an insecure Rsync configuration, custom hash cracking, and privilege escalation.https://wearethebug.dev/posts/vl-lustrous/Sat, 25 Dec 2021 00:00:00 +0000https://wearethebug.dev/posts/vl-lustrous/Lustrous is a Hard-rated chain consisting of 2 machines on vulnlab. Cevering AS-REP roasts, Kerberoasts, the main lesson on this chain is to demonstrate how silver tickets can be used with service accounts in a Active Directory environment.