https://wearethebug.dev/tags/windows/Recent content on WE ARE THE BUGTradecraften-usSun, 04 Oct 2026 00:00:00 +0000https://wearethebug.dev/posts/htb-touch/Sun, 04 Oct 2026 00:00:00 +0000https://wearethebug.dev/posts/htb-touch/Touch is an Easy-rated Windows machine featuring a kiosk-mode device management application. Initial access stems from improperly secured credentials exposed through the device's API, leading to a restricted user session that requires creative exploitation to break out of its locked-down environment and reach a full shell. Privilege escalation involves abusing misconfigured service permissions and exposed database credentials to escalate to full administrative control.https://wearethebug.dev/posts/htb-trustfall/Sat, 12 Sep 2026 00:00:00 +0000https://wearethebug.dev/posts/htb-trustfall/TrustFall is an Insane-rated hybrid machine featuring a complex, multi-stage kill chain that bridges external web exploitation with deep Active Directory and ADCS abuse. Initial access requires chaining an osTicket arbitrary file read with a legacy telnetd vulnerability to compromise a Linux pivot host. Lateral movement involves intricate ACL/OU inheritance abuse, AS-REP roasting, and a sophisticated WSUS Man-in-the-Middle attack powered by a rogue certificate (ESC17) for local privilege escalation. The endgame tests cryptographic weaknesses and PKI administration, requiring the prediction of a time-seeded VBScript PRNG to compromise a PKI Manager, ultimately leading to full Certificate Authority takeover (ESC7) and Domain Admin compromise via DCSync.https://wearethebug.dev/posts/htb-danglingtree/Sun, 09 Aug 2026 00:00:00 +0000https://wearethebug.dev/posts/htb-danglingtree/DanglingTree is a Medium-difficulty Windows machine focusing on Windows Admin Center (WAC) exploitation and cryptographic analysis. The foothold involves exploiting CVE-2026-26119 in WAC to execute PowerShell commands and abusing SmarterMail vulnerabilities (CVE-2026-23760/CVE-2026-24423) to gain initial access. The path to root requires DLL decompilation for DES decryption, DPAPI credential recovery, ACL abuse, and ADCS exploitation to escalate privileges to Administrator.https://wearethebug.dev/posts/htb-darkzeroreturns/Tue, 28 Jul 2026 00:00:00 +0000https://wearethebug.dev/posts/htb-darkzeroreturns/Heron is an advanced Active Directory scenario featuring complex multi-step exploitation chains including web entry points (like SSTI leading to RCE), cross-realm Kerberos trust abuses, CI/CD runner pivots, and forest trust navigation.https://wearethebug.dev/posts/htb-heron/Fri, 14 Nov 2025 00:00:00 +0000https://wearethebug.dev/posts/htb-heron/Heron is a small Active Directory scenario that involves typical vulnerabilities found in real word company environments. It's designed for penetration testers and red teamers in search of a quick and challenging lab.https://wearethebug.dev/posts/ertlabs-calipendula/Sat, 08 Nov 2025 00:00:00 +0000https://wearethebug.dev/posts/ertlabs-calipendula/Calipendula is a hybrid GCP and Active Directory breach scenario, pushing you through cloud IAM enumeration, service account chaining, RBCD relay attacks, multi-hop tunnelling in a segmented network.https://wearethebug.dev/posts/ertlabs-chains/Sat, 30 Aug 2025 00:00:00 +0000https://wearethebug.dev/posts/ertlabs-chains/4 Chains which consist of 2-3 machines that are meant to be exploited together.https://wearethebug.dev/posts/ertlabs-mailservice/Fri, 29 Aug 2025 00:00:00 +0000https://wearethebug.dev/posts/ertlabs-mailservice/MailService is a multi-stage internal penetration test scenario that required chaining several techniques across both Linux and Windows domains.https://wearethebug.dev/posts/ertlabs-ifix-tcen-tcen/Sat, 09 Aug 2025 00:00:00 +0000https://wearethebug.dev/posts/ertlabs-ifix-tcen-tcen/Ifix-Tcen-Tcen is a famous Italian onomatopoeia and cultural reference originating from the erotic *fotoromanzi* (photo-novels) of the 1970s and 1980s. In our case it's a multi-stage internal penetration test scenario focus on Active Directory.https://wearethebug.dev/posts/vl-redteamlabs/Sun, 20 Apr 2025 00:00:00 +0000https://wearethebug.dev/posts/vl-redteamlabs/4 Red Team Labs with 10 or more machines, multiple subnets, multiple domains and forests. These are meant for Penetration Testers & Red Teamers to practice operations. There are modern defenses to bypass and various different AV & EDR products running.https://wearethebug.dev/posts/vl-shiva/Thu, 17 Apr 2025 00:00:00 +0000https://wearethebug.dev/posts/vl-shiva/Shiva is an insane-difficulty Red Team lab on Vulnlab that simulates a hardened hybrid Active Directory environment (on-premises and Azure) with 10+ machines and active users. All protected by Endpoint Detection and Response (EDR), SIEM solutions, Windows Defender Application Control (WDAC), and common enterprise software.https://wearethebug.dev/posts/vl-machines/Sun, 09 Mar 2025 00:00:00 +0000https://wearethebug.dev/posts/vl-machines/43 vulnerable standalone machines with various difficulties from easy to insane.https://wearethebug.dev/posts/vl-shinra/Sun, 09 Mar 2025 00:00:00 +0000https://wearethebug.dev/posts/vl-shinra/Shinra is a Hard-rated Red Team lab designed for those with foundational AD and pentesting knowledge to refine covert red teaming skills. Players focus on AD enumeration, exploitation, certificate services, lateral movement, phishing, CI/CD attacks, EDR bypass, backdooring apps, and relay attacks while evading real-time detections.https://wearethebug.dev/posts/vl-chains/Thu, 27 Feb 2025 00:00:00 +0000https://wearethebug.dev/posts/vl-chains/17 Chains which consist of 2-3 machines that are meant to be exploited together.https://wearethebug.dev/posts/vl-atlas/Sun, 19 Jan 2025 00:00:00 +0000https://wearethebug.dev/posts/vl-atlas/Atlas is a Hard-difficulty machine focusing on Java deserialization and .NET cryptographic analysis. The foothold involves exploiting a vulnerable Castor XML library in a Spring Boot app and reverse-engineering a .NET application to recover credentials.https://wearethebug.dev/posts/vl-baby2/Sun, 19 Jan 2025 00:00:00 +0000https://wearethebug.dev/posts/vl-baby2/Baby2 is a medium-rated Active Directory machine on Vulnlab. The attack path involves initial SMB enumeration, password spraying to gain low-privileged domain user access, replacing a login VBS script in SYSVOL for a reverse shell, and escalating privileges by abusing GPO (Group Policy Object) DACL misconfigurations.https://wearethebug.dev/posts/vl-redelegate/Fri, 22 Nov 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-redelegate/Redelegate is a hard-difficultly Windows machine that starts with Anonymous FTP access, which allows the attacker to download sensitive Keepass Database files. The attacker then discovers that the credentials in the database are valid for MSSQL local login, which leads to enumerate SIDs and performs a password spray attack. Being a member of the HelpDesk group, the newly compromised user account Marie.Curie has a User-Force-Change-Password Access Control setup over the Helen.Frost user account; that user account has privileges to get a PS remoting session onto the Domain Controller. The Helen.Frost user account also has the SeEnableDelegationPrivilege assigned and has full control over the FS01$ machine account, essentially allowing the attacker account to modify the msDS-AllowedToDelegateTo LDAP attribute and change the password of a computer object and perform a Constrained Delegation attack.https://wearethebug.dev/posts/vl-shibuya/Thu, 21 Nov 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-shibuya/Shibuya is a Medium Windows machine that starts of with the SMB port exposed. Enumerating possible usernames through Kerberos an attacker is able to find the valid machine account red:red. With these credentials, he can further enumerate the remote users and discover that the user svc_autojoin has a password in its description. With this account in hand, he is able to discover some Windows Imaging Format (.wmi) files that contain hashes for the user simon.watson. Now, the attacker has command execution through SSH on the remote machine and is able to enumerate that another user has an active interactive session. By performing a cross-session relay attack he is able to steal the hash and crack the password for the user nigel.mills. The new user is member of the t1_admin groups which has enrolment rights on a certificate template that's vulnerable to ESC1 and by exploiting it we are able to gain SYSTEM privileges on the machine.https://wearethebug.dev/posts/vl-mythical/Wed, 06 Nov 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-mythical/Mythical is a Medium-rated small active directory chain on Vulnlab in which we start with an already running Mythic C2 beacon on an internal system. It is designed to practice operating through a C2 framework in a modern, challenging windows environment.https://wearethebug.dev/posts/vl-puppet/Tue, 22 Oct 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-puppet/Puppet is a Medium-rated small active directory chain in which you start with an already running Sliver C2 beacon on an internal system. It is designed to practice operating through a C2 framework in a modern, challenging hybrid environment.https://wearethebug.dev/posts/vl-baby/Sat, 28 Sep 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-baby/Baby is an easy difficulty Windows machine that features LDAP enumeration, password spraying and exposed credentials. For privilege escalation, the SeBackupPrivilege is exploited to extract registry hives and the NTDS.dit file. A Pass-the-Hash attack can be performed using the uncovered domain hashes ultimately achieving Administrator access.https://wearethebug.dev/posts/vl-cicada/Thu, 26 Sep 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-cicada/Cicada is a Medium-rated Windows Active Directory machine hosted on the VulnLab platform, that involves discovering a password inside an image on a public share. With that password an attacker is able to discover that the machine is vulnerable to ESC8 and can use Kerberos relaying to bypass self-relay restrictions in order to get a certificate as the machine account itself. With this new certificate, we are able to dump the hashes of the Administrator user and thus compromise the whole domain.https://wearethebug.dev/posts/vl-ifrit/Sun, 15 Sep 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-ifrit/Ifrit is an Assumed-Breach scenario with the main objective is getting domain administrator privileges in the ifrit.vl Domain. It designed for those with foundational AD and pentesting knowledge to hone covert red teaming skills. Players aim for Domain Admin while evading real-time detections, practicing AD enumeration, exploitation, certificate services, lateral movement, EDR bypass, and relay attacks across multiple forests.https://wearethebug.dev/posts/vl-lustrous2/Wed, 11 Sep 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-lustrous2/LustrousTwo is a hard-rated Windows machine that deals with LDAP signing, channel binding, and disabled NTLM authentication. The machine has a web server vulnerable to arbitrary file read, which helps attackers capture a Net-NTLMv2 hash for the service account, using it to request Service Tickets via s4u2self, a stealthier alternative to Silver Ticket, to bypass protective measures like Account is sensitive and cannot be delegated. After reversing and auditing the source code, the attacker achieves Remote Code Execution. For privilege escalation, the attacker exploits a misconfigured, insecure Velociraptor installation.https://wearethebug.dev/posts/vl-retro2/Thu, 22 Aug 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-retro2/Retro2 is an easy difficulty Windows machine, which highlights AD exploitation. Initial external enumeration reveals a publicly accessible SMB Share containing a Microsoft Access Database file, which is password protected. After cracking the password, the contents of the accdb file are accessible, enabling the retrieval of the VBA script inside, where AD credentials can be retrieved. Then, by abusing pre-created computer accounts , we gain access to a computer account with the GenericWrite privilege over another account, which, when leveraged, provides access to the system via RDP . Finally, exploiting the RpcEptMapper registry key results in privilege escalation to a system account.https://wearethebug.dev/posts/vl-wutai/Tue, 20 Aug 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-wutai/Wutai is a Medium-difficulty Red Team lab featuring 15+ machines across multiple networks, domains, and forests, challenging players to achieve Enterprise Admin status. Players refine AD enumeration, exploitation, certificate services, lateral movement, EDR bypass, reverse engineering, and covert operations while abusing trust relationships.https://wearethebug.dev/posts/vl-heron/Thu, 13 Jun 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-heron/Heron is a medium-difficulty chain hosted on Vulnlab, featuring an assumed breach from a domain-joined linux jump server access to domain controller. Starting with an enumeration of the internal website for domain users and performing AS-REP roasting, decrypting GPP password from the sysvol share, leading to smb share having write access to web.config, gaining a shell by using AspNetCoreModule for executing powershell commands which lead to finding linux admin’s credentials, reusing the same password that will lead to another user which has WriteAccountRestrictions on dc that leads to resource based delegationhttps://wearethebug.dev/posts/vl-klendathu/Fri, 24 May 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-klendathu/Klendathu is an Insane difficulty chain hosted on Vulnlab, involved coercion with an undocumented function/procedure on MSSQL, forging a silver ticket, spoofing domain users on linux with GSSAPI authentication, and decrypting RDCMan credentials with domain backup keys.https://wearethebug.dev/posts/vl-reaper2/Fri, 10 May 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-reaper2/ReaperTwo is an Insane Windows machine that involves both browser and kernel exploitation. The attack chain begins with enumeration of exposed services and access to an SMB share containing development artifacts. A vulnerable web application leveraging the V8 JavaScript engine allows for arbitrary JavaScript execution, which is escalated to remote code execution through a type confusion vulnerability in Harmony Set methods, combined with WebAssembly-based shellcode execution. After gaining an initial foothold as a low-privileged user, privilege escalation is achieved by exploiting a vulnerable kernel driver that exposes a function pointer execution primitive. The exploit bypasses modern protections such as kASLR, DEP, and SMEP by leaking kernel addresses via MSRs, performing a stack pivot, and constructing a ROP chain to modify Page Table Entries (PTEs). Finally, custom kernel shellcode is executed to steal a SYSTEM token, resulting in full system compromise.https://wearethebug.dev/posts/vl-unintended/Thu, 25 Apr 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-unintended/Unintended is an Medium chain that provides a hands-on experience with common missteps in Active Directory deployments, demonstrating how attackers can pivot between services to escalate privileges. It blends Linux privilege escalation techniques with Active Directory attack paths, making it a valuable practice ground for both offensive and defensive security practitioners.https://wearethebug.dev/posts/vl-vigilant/Mon, 15 Apr 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-vigilant/Vigilant is a Hard hybrid Active Directory chain. The environment consists of a domain-joined Linux system and a Windows Domain Controller, presenting a realistic enterprise attack surface. It designed to evaluate penetration testing capabilities in hybrid Windows-Linux environments. Participants begin with zero initial access and must systematically escalate privileges to achieve Domain Administrator-level compromise.https://wearethebug.dev/posts/vl-tengu/Thu, 28 Mar 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-tengu/Tengu is a medium-rated chained machine on VulnLab, features a mixed environment with two Windows hosts and one Linux host. Exploiting Node-RED on Linux (with MSSQL) grants command execution, decrypts service passwords, and pivots to dump NTLM hash. Constrained delegation allows impersonating MSSQL admin for local admin access then recover Domain Admin credentials via DPAPI and Kerberos to compromise the Domain Controller (DC).https://wearethebug.dev/posts/vl-sendai/Fri, 15 Mar 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-sendai/Sendai is a medium-difficulty Windows Active Directory machine focused on weak account hygiene, GMSA abuse, and ADCS misconfigurations. Initial access is gained through anonymous SMB enumeration, revealing files that hint at expired accounts with weak passwords. RID brute-forcing identifies users, and login attempts highlight accounts in a forced password reset state. By resetting thomas.powell’s password, the attacker obtains a domain foothold. BloodHound analysis shows that Powell’s group membership can be leveraged to compromise the MGTSVC$ GMSA account, enabling remote code execution on the domain controller. Further local enumeration uncovers inline credentials for clifford.davey, whose CA-OPERATORS group membership grants GenericAll rights over a certificate template. Abusing ESC4/ESC1 conditions with Certipy, the attacker forges a certificate for the administrator account, retrieves its NT hash, and authenticates via WinRM, achieving full domain compromise.https://wearethebug.dev/posts/vl-sweep/Fri, 01 Mar 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-sweep/Sweep is a medium difficulty Windows box that involves Active Directory and Lansweeper, a technology asset intelligence tool. The attacker abuses an enabled guest account to gain access to Lansweeper, which has Map Credentials configured, which are login/password combinations for accessing and scanning network assets remotely. The attacker deploys a honeypot SSH server to read the configured credentials. The compromised account is a member of the Lansweeper Discovery group, which has GenericAll ACL over the Lansweeper Admins group. Any account member of the Lansweeper Admins group has administrator privileges on the Lansweeper dashboard. The attacker creates and deploys a package on the Domain Controller to gain complete control.https://wearethebug.dev/posts/vl-escape/Fri, 16 Feb 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-escape/Escape is an Easy Windows machine where users can log in restricted Kiosk mode via RDP without a password. By exploiting the file:// scheme in Microsoft Edge, attackers can browse the file system, bypass restrictions, and open PowerShell. Further enumeration reveals a Remote Desktop Plus profile, whose password can be extracted using BulletsPassView, allowing admin access and UAC bypass to read the root flag.https://wearethebug.dev/posts/vl-kaiju/Fri, 02 Feb 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-kaiju/Kaiju is a Hard-rated Active Directory chain, from initial reconnaissance to full domain compromise, covering FileZilla exploitation, KeePass database extraction, NTLM relay attacks, and ADCS abuse (ESC8).https://wearethebug.dev/posts/vl-lock/Fri, 19 Jan 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-lock/Lock is an Easy-rated Windows machine that involves enumerating a Gitea repository to find a Personal Access Token. This token is then used to deploy an ASPX web shell on the server, which provides an initial foothold. A password is then decrypted from an mRemoteNG configuration file, providing access to a new user account. Finally, a local privilege escalation vulnerability in the PDF24 application is exploited to obtain a shell with SYSTEM privileges.https://wearethebug.dev/posts/vl-tea/Fri, 05 Jan 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-tea/Tea is a medium-rate small Active Directory chain that provides hands-on experience with common Active Directory and DevOps vulnerabilities and misconfigurations, demonstrating how attackers can pivot between services and retrieve sensitive data to move laterally and escalate privileges.https://wearethebug.dev/posts/vl-sidecar/Fri, 15 Dec 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-sidecar/Sidecar is a Hard-rated small Active Directory chain that contains 2 Windows machines, however, attacks are not for beginners on Active Directory Pentesting. From initial enumeration through to full domain compromise, including Shell via a .lnk file, NTLM relay, WebDAV coercion, Shadow Credentials, PKINIT abuse, and a Silver Ticket attack.https://wearethebug.dev/posts/vl-media/Fri, 13 Oct 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-media/Media is a Medium-rated machine that features an Apache XAMPP stack on Windows hosting a custom PHP web application. The web application allows the upload of a Windows Media Player compatible file that can be leveraged to leak the NTLMv2 hash of the user account that opens it. This hash can be cracked to obtain user credentials that can be used to authenticate to the target via SSH. Upon gaining initial access the source code of the application can be analyzed to determine the generate storage path of uploaded files on the web application which can lead to an NTFS Junction (directory symbolic link) attack to upload a malicious PHP web shell for RCE. Once a shell under the context of the web server's service account, players can abuse the SeTcbPrivilege - Act as part of the operating system, a Windows privilege that lets code impersonate any user and achieve administrative privileges. Alternative methods for privilege escalation involve regaining the SeImpersonate privilege to elevate to NT Authority\SYSTEM.https://wearethebug.dev/posts/vl-delegate/Fri, 06 Oct 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-delegate/Delegate is a medium-rated Windows machine that involves Active Directory attacks. The machine has the guest account enabled, allowing the attacker to read files that contain hard-coded credentials. The credentials allow us to WriteProperty of a user account that is allowed to have WinRM sessions on the Domain Controller. The compromised user has the SeEnableDelegationPrivilege privilege assigned, which allows us to modify the TRUSTED_FOR_DELEGATION flag for AD objects, enabling us to perform Unconstrained Delegation.https://wearethebug.dev/posts/vl-push/Fri, 22 Sep 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-push/Push is a Hard-rated small Windows Active Directory chain featuring a one domain controller and one member server. This chain focuses on advanced attack techniques including ClickOnce application exploitation, SCCM coercion, and ADCS exploitation via Golden Certificate attacks.https://wearethebug.dev/posts/vl-reaper/Fri, 18 Aug 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-reaper/Reaper is an Insane Windows machine that begins with an exposed FTP service. Within the FTP share resides a Windows binary vulnerable to both format-string and buffer-overflow attacks. By exploiting these flaws, an attacker can leak sensitive memory regions, hijack the program’s execution flow, and ultimately obtain a reverse shell on the target as the user keysvc. After gaining initial access, the attacker discovers a file containing a DPAPI blob. Once decrypted, this blob provides valid credentials for RDP access as keysvc. Continued enumeration reveals a custom kernel driver present and actively running on the system. Through reverse-engineering the driver, the attacker determines that it permits arbitrary kernel-level writes. Leveraging this capability, the attacker is able to steal a privileged token and escalate to a full SYSTEM shell (NT AUTHORITY\SYSTEM).https://wearethebug.dev/posts/vl-retro/Fri, 11 Aug 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-retro/Retro is an Easy Windows machine that showcases an Active Directory Domain Controller. Through SMB enumeration and pre-created machine account exploitation, we gain access to the system. Through the exploitation of the Active Directory Certificate Service and specifically by using the ESC1 attack, which involves exploiting certificate templates to impersonate the Administrative user, privilege escalation is achieved.https://wearethebug.dev/posts/vl-hybrid/Thu, 22 Jun 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-hybrid/Hybrid is an Easy-rated, simplified Active Directory chain with 2 servers MAIL01 (Roundcube webmail) and DC01. Exploited a vulnerable Roundcube plugin via a crafted email, escalated privileges via NFS, and abused AD CS with certipy to achieve Domain Admin.https://wearethebug.dev/posts/vl-reflection/Sat, 10 Jun 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-reflection/Reflection is a medium-difficulty Active Directory chain that simulates a vulnerable enterprise environment and challenges users to progress from limited access to Domain Administrator. Including 3 machines, with anonymous SMB bind abuse, MSSQL abuse, NTLM relay attacks, Windows Credential Vault harvesting, Resource-Based Constrained Delegation (RBCD), and finally credential reuse.https://wearethebug.dev/posts/vl-job2/Wed, 10 May 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-job2/Job2 is a hard-rated Windows machine that involves a macro phishing attack for initial foothold. The machine has hMailServer installed, which includes a configuration file containing encrypted credentials for the database connection. After extracting the password database, we decrypt the SQL Server Compact database file (SDF), allowing a compromised user who can use WinRM to the machine. The machine has a vulnerable version of Veeam Backup & Replication; the attacker executes a malicious executable under sqlserver.exe, which is running as SYSTEM to gain full access.https://wearethebug.dev/posts/vl-breach/Tue, 14 Feb 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-breach/Breach is a medium difficulty Windows machine, where guest access to an SMB share is available. By leveraging write permissions on that SMB share, NTLMv2 hashes of a domain user are captured to obtain valid credentials. With access as a low-privileged domain user, a kerberoastable service account (svc_mssql) is revealed. After getting access to the service account, a Silver Ticket attack is performed to impersonate the `Administrator` user and gain access to Microsoft SQL Server. Through the xp_cmdshell feature, remote code execution is achieved as the svc_mssql service account. Finally, privilege escalation is performed by abusing the SeImpersonatePrivilege privilege.https://wearethebug.dev/posts/vl-trusted/Tue, 20 Sep 2022 00:00:00 +0000https://wearethebug.dev/posts/vl-trusted/Trusted is an Easy small Active Directory chain involving two domain controllers (labdc.lab.trusted.vl and trusteddc.trusted.vl) that focuses on web vulnerabilities, local privilege escalation, and cross-domain trust abuse. An internal network access is provided with no credentials, and the goal is to assess the security posture of the AD environment.https://wearethebug.dev/posts/vl-bruno/Sat, 02 Jul 2022 00:00:00 +0000https://wearethebug.dev/posts/vl-bruno/Bruno is a medium-rated Windows domain box that chains insecure application configuration and weak Active Directory hygiene to go from no access to domain admin. The service-facing component is a custom .NET application that extracts ZIP entries unsafely using Path.Combine, allowing crafted archives to perform a zip-slip and place files under the app folder. That capability enables a DLL-search-path hijack - an attacker who can write to the queue share can drop a malicious dll and achieve code execution as the service user. On the network/AD side, an account svc_scan is discoverable and kerberoastable/AS-REP crackable; its recovered credentials grant write access to the queue share, which is used to trigger the DLL payload and get a low-privilege shell. From there the default machine account quota of authenticated users and RBCD are abused to perform a Kerberos relay/RBCD attack that resets the Administrator password and yields full domain compromise.https://wearethebug.dev/posts/vl-rainbow2/Mon, 06 Jun 2022 00:00:00 +0000https://wearethebug.dev/posts/vl-rainbow2/Rainbow2 is a Hard Windows machine centered around exploit development for a custom network file-sharing service. Initial enumeration reveals anonymous FTP access and an unknown service listening on TCP port 2121. The FTP share exposes the vulnerable service binary, a developer README, and a copy of SysWOW64\kernel32.dll. The README confirms that the service was rebuilt with ASLR, DEP, and GS enabled. Static and dynamic analysis then shows that the service is still vulnerable to a format string issue and a stack-based overflow that overwrites the SEH chain. The format string leak provides a reliable ASLR bypass by disclosing a pointer inside filesrv.exe; the SEH overwrite provides control of the exception handler; and a ROP chain calls VirtualAlloc to bypass DEP. Privilege escalation is achieved by abusing SeDebugPrivilege to migrate into a SYSTEM process.https://wearethebug.dev/posts/vl-rainbow/Mon, 17 Jan 2022 00:00:00 +0000https://wearethebug.dev/posts/vl-rainbow/Rainbow is a medium-difficulty Windows machine exposing FTP and HTTP services on ports 21 and 80 & 8080 respectively. From the FTP server, we can retrieve the web server binary and a PowerShell restart script, which is used to relaunch the server in the event of a crash automatically. The HTTP service on port 8080 is vulnerable to an SEH-based buffer overflow and exploiting this yields code execution as the rainbow user. Because rainbow is a member of the Administrators group, we achieved full elevation by bypassing UAC via the FodHelper technique.https://wearethebug.dev/posts/vl-intercept/Sat, 25 Dec 2021 00:00:00 +0000https://wearethebug.dev/posts/vl-intercept/Intercept is a small Active Directory scenario rated as Hard that provides hands-on experience with common Active Directory vulnerabilities and misconfigurations, demonstrating relay attacks and authentication coercion attacks can be used to get access to the domain.https://wearethebug.dev/posts/vl-lustrous/Sat, 25 Dec 2021 00:00:00 +0000https://wearethebug.dev/posts/vl-lustrous/Lustrous is a Hard-rated chain consisting of 2 machines on vulnlab. Cevering AS-REP roasts, Kerberoasts, the main lesson on this chain is to demonstrate how silver tickets can be used with service accounts in a Active Directory environment.https://wearethebug.dev/posts/vl-job/Sat, 27 Nov 2021 00:00:00 +0000https://wearethebug.dev/posts/vl-job/Job is a Medium-rated Windows box. It runs an SMTP server and its website accepts LibreOffice-compatible documents, providing a vector to deliver a document with embedded macros that leads to remote code execution as user jack.black. jack.black is a member of the DEVELOPERS group, which has write access to the IIS web root, allowing files to be placed in the webroot and achieve code execution as the IIS AppPool service account. The IIS AppPool account has the SeImpersonate privilege, creating conditions that allow token-impersonation techniques to be used to escalate privileges to Administrator.