https://wearethebug.dev/tags/winrm/Recent content on WE ARE THE BUGTradecraften-usSat, 12 Sep 2026 00:00:00 +0000https://wearethebug.dev/posts/htb-trustfall/Sat, 12 Sep 2026 00:00:00 +0000https://wearethebug.dev/posts/htb-trustfall/TrustFall is an Insane-rated hybrid machine featuring a complex, multi-stage kill chain that bridges external web exploitation with deep Active Directory and ADCS abuse. Initial access requires chaining an osTicket arbitrary file read with a legacy telnetd vulnerability to compromise a Linux pivot host. Lateral movement involves intricate ACL/OU inheritance abuse, AS-REP roasting, and a sophisticated WSUS Man-in-the-Middle attack powered by a rogue certificate (ESC17) for local privilege escalation. The endgame tests cryptographic weaknesses and PKI administration, requiring the prediction of a time-seeded VBScript PRNG to compromise a PKI Manager, ultimately leading to full Certificate Authority takeover (ESC7) and Domain Admin compromise via DCSync.https://wearethebug.dev/posts/netexec/Sat, 25 Jul 2026 00:00:00 +0000https://wearethebug.dev/posts/netexec/Swiss-army knife for Active Directory and network protocol enumeration/exploitation, successor to CrackMapExec.https://wearethebug.dev/posts/vl-trusted/Tue, 20 Sep 2022 00:00:00 +0000https://wearethebug.dev/posts/vl-trusted/Trusted is an Easy small Active Directory chain involving two domain controllers (labdc.lab.trusted.vl and trusteddc.trusted.vl) that focuses on web vulnerabilities, local privilege escalation, and cross-domain trust abuse. An internal network access is provided with no credentials, and the goal is to assess the security posture of the AD environment.