https://wearethebug.dev/tags/silver-ticket/Recent content on WE ARE THE BUGTradecraften-usFri, 24 May 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-klendathu/Fri, 24 May 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-klendathu/Klendathu is an Insane difficulty chain hosted on Vulnlab, involved coercion with an undocumented function/procedure on MSSQL, forging a silver ticket, spoofing domain users on linux with GSSAPI authentication, and decrypting RDCMan credentials with domain backup keys.https://wearethebug.dev/posts/vl-breach/Tue, 14 Feb 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-breach/Breach is a medium difficulty Windows machine, where guest access to an SMB share is available. By leveraging write permissions on that SMB share, NTLMv2 hashes of a domain user are captured to obtain valid credentials. With access as a low-privileged domain user, a kerberoastable service account (svc_mssql) is revealed. After getting access to the service account, a Silver Ticket attack is performed to impersonate the `Administrator` user and gain access to Microsoft SQL Server. Through the xp_cmdshell feature, remote code execution is achieved as the svc_mssql service account. Finally, privilege escalation is performed by abusing the SeImpersonatePrivilege privilege.https://wearethebug.dev/posts/vl-lustrous/Sat, 25 Dec 2021 00:00:00 +0000https://wearethebug.dev/posts/vl-lustrous/Lustrous is a Hard-rated chain consisting of 2 machines on vulnlab. Cevering AS-REP roasts, Kerberoasts, the main lesson on this chain is to demonstrate how silver tickets can be used with service accounts in a Active Directory environment.