https://lpbyte.pages.dev/writeups/index.html Hugo en-us Sun, 05 Jul 2026 00:00:00 +0000 https://lpbyte.pages.dev/writeups/blackfield/index.html Sun, 05 Jul 2026 00:00:00 +0000 https://lpbyte.pages.dev/writeups/blackfield/index.html Overview Machine: BlackField Platform: HackTheBox Difficulty: Hard OS: Windows This machine focuses on exploiting Kerberos pre-authentication and ASREPRoasting to gain a foothold, followed by ForceChangePassword abuse and DPAPI/LSASS credential extraction, culminating in NTDS.dit extraction via a Shadow Copy and SeBackupPrivilege abuse. Kill Chain Kerberos Pre-Authentication Enumeration ASREPRoasting -> Credentials Disclosure(support) SMB Share Enumeration -> Forensic Data Exposure Credential Discovery via LSASS Memory Dump Pass-the-Hash -> Initial Access (svc_backup) Privilege Enumeration (Backup Operators) Abuse of SeBackupPrivilege -> NTDS.dit Extraction -> Domain Compromise Needed Tools Nmap SmbMap SMBClient NetExec Impacket HashCat BloodHound BloodHound-ce-python Net PyPyKatz Evil-WinRM Dos2Unix Recon Perform an Nmap scan to identify open ports and running services. nmap -Pn -sCV 10.129.229.17 https://lpbyte.pages.dev/writeups/wingdata/index.html Wed, 29 Apr 2026 00:00:00 +0000 https://lpbyte.pages.dev/writeups/wingdata/index.html Overview Machine: WingData Platform: HackTheBox Difficulty: Easy OS: Linux This machine focuses on exploiting a vulnerable FTP Server to gain initial access, followed by credential extraction and privilege escalation via a misconfigured sudo backup script. Kill Chain Reconnaissance Enumeration Vulnerability Identification Exploiting the Vulnerability Credential Access Privilege Escalation Needed Tools FeroxBuster Hashcat ffuf Metasploit NCat Recon Add the target IP address to the local /etc/hosts file. echo "$IP wingdata.htb" | sudo tee -a /etc/hosts Perform an Nmap scan to identify open ports and running services. nmap -sV wingdata.htb https://lpbyte.pages.dev/writeups/resolute/index.html Tue, 31 Mar 2026 00:00:00 +0000 https://lpbyte.pages.dev/writeups/resolute/index.html Overview Machine: Resolute Platform: HackTheBox Difficulty: Medium OS: Windows This machine focuses on Active Directory enumeration and credential discovery (especially via LDAP and user data) leading to privilege escalation through misconfigurations like group memberships. Kill Chain Anonymous LDAP Enumeration Credential Disclosure via LDAP User Attributes Password spraying → Initial Access Credential Discovery via PowerShell Transcripts Privilege Enumeration (DnsAdmins) Abuse of DNS Service Configuration → Privilege Escalation Needed Tools NetExec SMBClient SMBMap WinRM Nmap MsfVenom Recon configure hosts entry nmap scan of the machine nmap -Pn resolute.htb https://lpbyte.pages.dev/writeups/active/index.html Mon, 30 Mar 2026 00:00:00 +0000 https://lpbyte.pages.dev/writeups/active/index.html Overview Machine: Active Platform: HackTheBox Difficulty: Easy OS: Windows This machine focuses on SMB enumeration, Group Policy Preferences (GPP) credential extraction, and Kerberoasting. Kill Chain Anonymous SMB access Retrieve Groups.xml from SYSVOL Decrypt GPP password Kerberoast Administrator account Crack hash -> Administrator access Needed Tools NetExec SMBClient SMBMap targetedKerberoast Nmap Recon Add the target IP address to the local /etc/hosts file. echo "$IP active.htb" | sudo tee -a /etc/hosts Perform an Nmap scan to identify open ports and running services. nmap -Pn active.htb