WriteUp Overview¶
Keeper
Initial access through default credentials on a Request Tracker instance, followed by KeePass memory-dump extraction (CVE-2023-32784) and a PuTTY private key recovered from the vault to gain root.
Read Writeup →
Knife
Initial access with Remote Code Execution about User-Agentt, followed by knife and ruby execution
Read Writeup →
Garfield
A logon script misconfiguration in Active Directory provides initial access. Lateral movement is achieved through password manipulation, and privilege escalation exploits a Read-Only Domain Controller via a forged golden ticket to recover domain administrator credentials.
Read Writeup →
TombWatcher
Starting with provided low-privilege credentials, a Bloodhound-mapped ACL chain across five principals yields WinRM access. Privilege escalation abuses a deleted AD object (tombstone reanimation) and an ESC3 enrollment-agent attack against ADCS to obtain the Administrator NT hash.
Read Writeup →
CCTV
Default credentials on ZoneMinder lead to a blind SQL injection (CVE-2024-51482) that dumps password hashes; a cracked hash grants SSH access. A locally-bound motionEye service running as root is reached via port forwarding; credentials recovered from its config file enable an authenticated RCE exploit (CVE-2025-60787) for a root shell.
Read Writeup →
Escape
Complete domain compromise via certipy-ad, ESC1 and PassTheCert Medium Windows AD machine.
Read Writeup →
Jeeves
Initial access through the Jenkins Script Console, followed by KeePass cracking, Pass-the-Hash privilege escalation, and Alternate Data Stream discovery.
Read Writeup →
Authority
Complete domain compromise via certipy-ad, ESC1 and PassTheCert Medium Windows AD machine.
Read Writeup →
Administrator
Complete domain compromise via ACL abuse — GenericAll, ForceChangePassword, Targeted Kerberoasting, DCSync. Medium Windows AD machine.
Read Writeup →