https://wearethebug.dev/tags/s4u2self/Recent content on WE ARE THE BUGTradecraften-usFri, 28 Aug 2026 00:00:00 +0000https://wearethebug.dev/posts/netexec-advanced/Fri, 28 Aug 2026 00:00:00 +0000https://wearethebug.dev/posts/netexec-advanced/Follow-up to the NetExec cheatsheet: deeper Active Directory abuse techniques, delegation attacks, and operational tooling for experienced operators.https://wearethebug.dev/posts/vl-lustrous2/Wed, 11 Sep 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-lustrous2/LustrousTwo is a hard-rated Windows machine that deals with LDAP signing, channel binding, and disabled NTLM authentication. The machine has a web server vulnerable to arbitrary file read, which helps attackers capture a Net-NTLMv2 hash for the service account, using it to request Service Tickets via s4u2self, a stealthier alternative to Silver Ticket, to bypass protective measures like Account is sensitive and cannot be delegated. After reversing and auditing the source code, the attacker achieves Remote Code Execution. For privilege escalation, the attacker exploits a misconfigured, insecure Velociraptor installation.