1 post tagged

.PFX

10 min read Nov 9, 2024

HTB Timelapse Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory SMB-Null-Session SMB-Shares .PFX WinRM-.pem PowerShell-History LDAP LDAP-Saved-Password

1 post tagged

.bat

8 min read Nov 9, 2024

HTB ServMon Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy FTP CVE Path-Traversal Password-Spraying SSH Port-Forwarding .bat

1 post tagged

.ini

20 min read Nov 19, 2024

HTB Flight Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Hard Windows Active-Directory Vhost-Enumeration Domain-User-Enumeration AD-Password-Spraying Password-Reuse SMB-Share-Write-Permission-Abuse .ini Capturing-NTLMv2-Hashes-with-SMB-Server PHP-Reverse-Shell Chisel.exe Port-Forwarding RunasCs.exe RunasCs.exe-Reverse-Shell Microsoft-IIS cmdasp.aspx JuicyPotatoNG

1 post tagged

.mdb

4 min read Nov 18, 2024

HTB Access Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows FTP-Anonymous .mdb Telnet Stored-Credentials Runas.exe

2 posts tagged

ACLs

8 min read Nov 8, 2024

HTB Forest Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory RPC-Null-Session LDAP-Anonymous Username-Pattern AS-REP-Roasting BloodHound PowerView.ps1 ACLs GenericAll WriteDacl DCSync Pass-the-Hash

23 min read Nov 2, 2024

Attacking Active Directory Cheatsheet

Cheatsheet for Attacking Active Directory

Vorkharium in Cheatsheets Tools Active-Directory Active-Directory-Enumeration SMB Kerberoasting AS-REP-Roasting DCSync ACLs MSSQL Credential-Dumping Credential-Hunting

1 post tagged

AChat

17 min read Nov 10, 2024

HTB Chatterbox Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium AChat Buffer-Overflow Credentials-in-Registry Password-Reuse PsExec

1 post tagged

AD-Password-Spraying

20 min read Nov 19, 2024

HTB Flight Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Hard Windows Active-Directory Vhost-Enumeration Domain-User-Enumeration AD-Password-Spraying Password-Reuse SMB-Share-Write-Permission-Abuse .ini Capturing-NTLMv2-Hashes-with-SMB-Server PHP-Reverse-Shell Chisel.exe Port-Forwarding RunasCs.exe RunasCs.exe-Reverse-Shell Microsoft-IIS cmdasp.aspx JuicyPotatoNG

2 posts tagged

API

15 min read Nov 12, 2024

HTB Editorial Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Blind-SSRF Fuzzing API Git Git-Commit Python-Script CVE Command-Injection

6 min read Nov 12, 2024

THM UltraTech Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Medium Linux API Arbitrary-File-Read SSH GTFOBins-Shell Docker

4 posts tagged

AS-REP-Roasting

7 min read Nov 9, 2024

HTB Sauna Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory AS-REP-Roasting BloodHound DCSync Pass-the-Hash

8 min read Nov 8, 2024

HTB Forest Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory RPC-Null-Session LDAP-Anonymous Username-Pattern AS-REP-Roasting BloodHound PowerView.ps1 ACLs GenericAll WriteDacl DCSync Pass-the-Hash

18 min read Nov 3, 2024

HTB Blackfield Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Hard Active-Directory SMB-Null-Session SMB-Shares AS-REP-Roasting BloodHound RPC Credential-Dumping Pass-the-Hash

23 min read Nov 2, 2024

Attacking Active Directory Cheatsheet

Cheatsheet for Attacking Active Directory

Vorkharium in Cheatsheets Tools Active-Directory Active-Directory-Enumeration SMB Kerberoasting AS-REP-Roasting DCSync ACLs MSSQL Credential-Dumping Credential-Hunting

9 posts tagged

Active-Directory

20 min read Nov 19, 2024

HTB Flight Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Hard Windows Active-Directory Vhost-Enumeration Domain-User-Enumeration AD-Password-Spraying Password-Reuse SMB-Share-Write-Permission-Abuse .ini Capturing-NTLMv2-Hashes-with-SMB-Server PHP-Reverse-Shell Chisel.exe Port-Forwarding RunasCs.exe RunasCs.exe-Reverse-Shell Microsoft-IIS cmdasp.aspx JuicyPotatoNG

8 min read Nov 9, 2024

HTB Return Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory Passback-LDAP-Attack LDAP Printer Server-Operators sc.exe Service-Restart

10 min read Nov 9, 2024

HTB Timelapse Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory SMB-Null-Session SMB-Shares .PFX WinRM-.pem PowerShell-History LDAP LDAP-Saved-Password

7 min read Nov 9, 2024

HTB Sauna Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory AS-REP-Roasting BloodHound DCSync Pass-the-Hash

8 min read Nov 8, 2024

HTB Forest Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory RPC-Null-Session LDAP-Anonymous Username-Pattern AS-REP-Roasting BloodHound PowerView.ps1 ACLs GenericAll WriteDacl DCSync Pass-the-Hash

18 min read Nov 3, 2024

HTB Blackfield Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Hard Active-Directory SMB-Null-Session SMB-Shares AS-REP-Roasting BloodHound RPC Credential-Dumping Pass-the-Hash

7 min read Nov 3, 2024

HTB Active Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory SMB-Null-Session SMB-Shares GPP-cPassword Kerberoasting

23 min read Nov 2, 2024

Attacking Active Directory Cheatsheet

Cheatsheet for Attacking Active Directory

Vorkharium in Cheatsheets Tools Active-Directory Active-Directory-Enumeration SMB Kerberoasting AS-REP-Roasting DCSync ACLs MSSQL Credential-Dumping Credential-Hunting

8 min read Nov 2, 2024

NetExec and CrackMapExec Cheatsheet

Cheatsheet for NetExec and CrackMapExec

Vorkharium in Cheatsheets Tools Active-Directory Active-Directory-Enumeration SMB Credential-Dumping

2 posts tagged

Active-Directory-Enumeration

23 min read Nov 2, 2024

Attacking Active Directory Cheatsheet

Cheatsheet for Attacking Active Directory

Vorkharium in Cheatsheets Tools Active-Directory Active-Directory-Enumeration SMB Kerberoasting AS-REP-Roasting DCSync ACLs MSSQL Credential-Dumping Credential-Hunting

8 min read Nov 2, 2024

NetExec and CrackMapExec Cheatsheet

Cheatsheet for NetExec and CrackMapExec

Vorkharium in Cheatsheets Tools Active-Directory Active-Directory-Enumeration SMB Credential-Dumping

2 posts tagged

Alternative-Without-Metasploit

8 min read Nov 19, 2024

THM Alfred Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Windows Jenkins Default-Credentials Groovy-Reverse-Shell Incognito.exe RDP rdesktop Alternative-Without-Metasploit

7 min read Nov 4, 2024

HTB Nibbles Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy CVE PHP-Reverse-Shell Sudo-l Bash-Script Alternative-Without-Metasploit

2 posts tagged

Arbitrary-File-Read

6 min read Nov 12, 2024

THM UltraTech Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Medium Linux API Arbitrary-File-Read SSH GTFOBins-Shell Docker

13 min read Nov 7, 2024

HTB Pilgrimage Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Git CVE Arbitrary-File-Read pspy binwalk

1 post tagged

Arbitrary-File-Upload

4 min read Nov 18, 2024

HTB Arctic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows ColdFusion CVE Arbitrary-File-Upload JuicyPotato MSFVenom

1 post tagged

Azure-AD-Connect

11 min read Nov 3, 2024

HTB Monteverde Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Weak-Credentials RPC-Null-Session Password-Spraying SMB-Shares Azure-AD-Connect

1 post tagged

Bash-History

7 min read Nov 6, 2024

HTB SecNotes Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium XSRF PHP-Reverse-Shell SMB-Shares Bash-History SMB-PsExec

3 posts tagged

Bash-Script

11 min read Nov 11, 2024

THM Thompson Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux Tomcat WAR-Reverse-Shell Bash-Script Cron-Job Etc-Shadow SSH Create-id_rsa

9 min read Nov 10, 2024

HTB Busqueda Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Searchor Git Gitea Password-Reuse SSH Docker Bash-Script Linux-Relative-Path-Abuse

7 min read Nov 4, 2024

HTB Nibbles Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy CVE PHP-Reverse-Shell Sudo-l Bash-Script Alternative-Without-Metasploit

1 post tagged

Blind-SSRF

15 min read Nov 12, 2024

HTB Editorial Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Blind-SSRF Fuzzing API Git Git-Commit Python-Script CVE Command-Injection

3 posts tagged

BloodHound

7 min read Nov 9, 2024

HTB Sauna Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory AS-REP-Roasting BloodHound DCSync Pass-the-Hash

8 min read Nov 8, 2024

HTB Forest Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory RPC-Null-Session LDAP-Anonymous Username-Pattern AS-REP-Roasting BloodHound PowerView.ps1 ACLs GenericAll WriteDacl DCSync Pass-the-Hash

18 min read Nov 3, 2024

HTB Blackfield Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Hard Active-Directory SMB-Null-Session SMB-Shares AS-REP-Roasting BloodHound RPC Credential-Dumping Pass-the-Hash

1 post tagged

Buffer-Overflow

17 min read Nov 10, 2024

HTB Chatterbox Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium AChat Buffer-Overflow Credentials-in-Registry Password-Reuse PsExec

1 post tagged

BusyBox

13 min read Nov 11, 2024

HTB Magic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Medium SQL-Injection-Bypass File-Upload-Bypass Magic-Bytes PHP-Reverse-Shell BusyBox MySQL Port-Forwarding Credentials-in-DB-File SUID Relative-Path-Exploitation

12 posts tagged

CVE

9 min read Nov 20, 2024

HTB Devvortex Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Vhost-Enumeration CVE Joomla MySQL Credentials-in-Database apport-cli

4 min read Nov 19, 2024

THM Retro Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Hard Windows WordPress RDP Windows-Kernel-Exploit CVE

4 min read Nov 18, 2024

HTB Arctic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows ColdFusion CVE Arbitrary-File-Upload JuicyPotato MSFVenom

11 min read Nov 18, 2024

HTB Mailing Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows Path-Traversal CVE Capturing-NTLMv2-Hashes WinRM Credential-Dumping Pass-the-Hash

10 min read Nov 16, 2024

THM Steel Mountain Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Windows CVE PowerUp.ps1 CanRestart Weak-File-Permission Unquoted-Service-Path

12 min read Nov 15, 2024

THM Skynet Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux SMB-Null-Session Login-Brute-Force CVE RFI Tar-Wildcard-Expansion

7 min read Nov 14, 2024

HTB Sau Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy CVE

15 min read Nov 12, 2024

HTB Editorial Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Blind-SSRF Fuzzing API Git Git-Commit Python-Script CVE Command-Injection

8 min read Nov 9, 2024

HTB ServMon Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy FTP CVE Path-Traversal Password-Spraying SSH Port-Forwarding .bat

8 min read Nov 9, 2024

HTB Builder Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Medium Jenkins CVE

13 min read Nov 7, 2024

HTB Pilgrimage Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Git CVE Arbitrary-File-Read pspy binwalk

7 min read Nov 4, 2024

HTB Nibbles Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy CVE PHP-Reverse-Shell Sudo-l Bash-Script Alternative-Without-Metasploit

1 post tagged

CanRestart

10 min read Nov 16, 2024

THM Steel Mountain Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Windows CVE PowerUp.ps1 CanRestart Weak-File-Permission Unquoted-Service-Path

1 post tagged

Capturing-NTLMv2-Hashes

11 min read Nov 18, 2024

HTB Mailing Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows Path-Traversal CVE Capturing-NTLMv2-Hashes WinRM Credential-Dumping Pass-the-Hash

1 post tagged

Capturing-NTLMv2-Hashes-with-SMB-Server

20 min read Nov 19, 2024

HTB Flight Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Hard Windows Active-Directory Vhost-Enumeration Domain-User-Enumeration AD-Password-Spraying Password-Reuse SMB-Share-Write-Permission-Abuse .ini Capturing-NTLMv2-Hashes-with-SMB-Server PHP-Reverse-Shell Chisel.exe Port-Forwarding RunasCs.exe RunasCs.exe-Reverse-Shell Microsoft-IIS cmdasp.aspx JuicyPotatoNG

1 post tagged

Challenges

5 min read Dec 11, 2024

HTB Brevi Moduli Solution (Without SageMath)

HTB Cryptography Challenge

Vorkharium in Solution HTB Challenges Python Script Cryptography RSA

3 posts tagged

Cheatsheets

23 min read Nov 2, 2024

Attacking Active Directory Cheatsheet

Cheatsheet for Attacking Active Directory

Vorkharium in Cheatsheets Tools Active-Directory Active-Directory-Enumeration SMB Kerberoasting AS-REP-Roasting DCSync ACLs MSSQL Credential-Dumping Credential-Hunting

8 min read Nov 2, 2024

NetExec and CrackMapExec Cheatsheet

Cheatsheet for NetExec and CrackMapExec

Vorkharium in Cheatsheets Tools Active-Directory Active-Directory-Enumeration SMB Credential-Dumping

6 min read Nov 2, 2024

Ligolo-ng Cheatsheet

Cheatsheet for Ligolo-ng

Vorkharium in Cheatsheets Tools Pivoting

1 post tagged

Chisel.exe

20 min read Nov 19, 2024

HTB Flight Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Hard Windows Active-Directory Vhost-Enumeration Domain-User-Enumeration AD-Password-Spraying Password-Reuse SMB-Share-Write-Permission-Abuse .ini Capturing-NTLMv2-Hashes-with-SMB-Server PHP-Reverse-Shell Chisel.exe Port-Forwarding RunasCs.exe RunasCs.exe-Reverse-Shell Microsoft-IIS cmdasp.aspx JuicyPotatoNG

1 post tagged

ColdFusion

4 min read Nov 18, 2024

HTB Arctic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows ColdFusion CVE Arbitrary-File-Upload JuicyPotato MSFVenom

1 post tagged

Command-Injection

15 min read Nov 12, 2024

HTB Editorial Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Blind-SSRF Fuzzing API Git Git-Commit Python-Script CVE Command-Injection

1 post tagged

Create-id_rsa

11 min read Nov 11, 2024

THM Thompson Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux Tomcat WAR-Reverse-Shell Bash-Script Cron-Job Etc-Shadow SSH Create-id_rsa

5 posts tagged

Credential-Dumping

11 min read Nov 18, 2024

HTB Mailing Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows Path-Traversal CVE Capturing-NTLMv2-Hashes WinRM Credential-Dumping Pass-the-Hash

10 min read Nov 17, 2024

THM Year of the Owl Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Hard Windows SNMP OSINT NetExec WinRM SID-Recycle-Bin Credential-Dumping SAM-SYSTEM-Dump Pass-the-Hash

18 min read Nov 3, 2024

HTB Blackfield Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Hard Active-Directory SMB-Null-Session SMB-Shares AS-REP-Roasting BloodHound RPC Credential-Dumping Pass-the-Hash

23 min read Nov 2, 2024

Attacking Active Directory Cheatsheet

Cheatsheet for Attacking Active Directory

Vorkharium in Cheatsheets Tools Active-Directory Active-Directory-Enumeration SMB Kerberoasting AS-REP-Roasting DCSync ACLs MSSQL Credential-Dumping Credential-Hunting

8 min read Nov 2, 2024

NetExec and CrackMapExec Cheatsheet

Cheatsheet for NetExec and CrackMapExec

Vorkharium in Cheatsheets Tools Active-Directory Active-Directory-Enumeration SMB Credential-Dumping

1 post tagged

Credential-Hunting

23 min read Nov 2, 2024

Attacking Active Directory Cheatsheet

Cheatsheet for Attacking Active Directory

Vorkharium in Cheatsheets Tools Active-Directory Active-Directory-Enumeration SMB Kerberoasting AS-REP-Roasting DCSync ACLs MSSQL Credential-Dumping Credential-Hunting

1 post tagged

Credentials-in-DB-File

13 min read Nov 11, 2024

HTB Magic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Medium SQL-Injection-Bypass File-Upload-Bypass Magic-Bytes PHP-Reverse-Shell BusyBox MySQL Port-Forwarding Credentials-in-DB-File SUID Relative-Path-Exploitation

1 post tagged

Credentials-in-Database

9 min read Nov 20, 2024

HTB Devvortex Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Vhost-Enumeration CVE Joomla MySQL Credentials-in-Database apport-cli

1 post tagged

Credentials-in-Registry

17 min read Nov 10, 2024

HTB Chatterbox Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium AChat Buffer-Overflow Credentials-in-Registry Password-Reuse PsExec

1 post tagged

Cron-Job

11 min read Nov 11, 2024

THM Thompson Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux Tomcat WAR-Reverse-Shell Bash-Script Cron-Job Etc-Shadow SSH Create-id_rsa

1 post tagged

Cryptography

5 min read Dec 11, 2024

HTB Brevi Moduli Solution (Without SageMath)

HTB Cryptography Challenge

Vorkharium in Solution HTB Challenges Python Script Cryptography RSA

3 posts tagged

DCSync

7 min read Nov 9, 2024

HTB Sauna Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory AS-REP-Roasting BloodHound DCSync Pass-the-Hash

8 min read Nov 8, 2024

HTB Forest Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory RPC-Null-Session LDAP-Anonymous Username-Pattern AS-REP-Roasting BloodHound PowerView.ps1 ACLs GenericAll WriteDacl DCSync Pass-the-Hash

23 min read Nov 2, 2024

Attacking Active Directory Cheatsheet

Cheatsheet for Attacking Active Directory

Vorkharium in Cheatsheets Tools Active-Directory Active-Directory-Enumeration SMB Kerberoasting AS-REP-Roasting DCSync ACLs MSSQL Credential-Dumping Credential-Hunting

1 post tagged

Default-Credentials

8 min read Nov 19, 2024

THM Alfred Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Windows Jenkins Default-Credentials Groovy-Reverse-Shell Incognito.exe RDP rdesktop Alternative-Without-Metasploit

2 posts tagged

Docker

6 min read Nov 12, 2024

THM UltraTech Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Medium Linux API Arbitrary-File-Read SSH GTFOBins-Shell Docker

9 min read Nov 10, 2024

HTB Busqueda Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Searchor Git Gitea Password-Reuse SSH Docker Bash-Script Linux-Relative-Path-Abuse

1 post tagged

Domain-User-Enumeration

20 min read Nov 19, 2024

HTB Flight Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Hard Windows Active-Directory Vhost-Enumeration Domain-User-Enumeration AD-Password-Spraying Password-Reuse SMB-Share-Write-Permission-Abuse .ini Capturing-NTLMv2-Hashes-with-SMB-Server PHP-Reverse-Shell Chisel.exe Port-Forwarding RunasCs.exe RunasCs.exe-Reverse-Shell Microsoft-IIS cmdasp.aspx JuicyPotatoNG

22 posts tagged

Easy

9 min read Nov 20, 2024

HTB Devvortex Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Vhost-Enumeration CVE Joomla MySQL Credentials-in-Database apport-cli

8 min read Nov 19, 2024

THM Alfred Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Windows Jenkins Default-Credentials Groovy-Reverse-Shell Incognito.exe RDP rdesktop Alternative-Without-Metasploit

4 min read Nov 18, 2024

HTB Access Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows FTP-Anonymous .mdb Telnet Stored-Credentials Runas.exe

4 min read Nov 18, 2024

HTB Arctic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows ColdFusion CVE Arbitrary-File-Upload JuicyPotato MSFVenom

11 min read Nov 18, 2024

HTB Mailing Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows Path-Traversal CVE Capturing-NTLMv2-Hashes WinRM Credential-Dumping Pass-the-Hash

10 min read Nov 16, 2024

THM Steel Mountain Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Windows CVE PowerUp.ps1 CanRestart Weak-File-Permission Unquoted-Service-Path

12 min read Nov 15, 2024

THM Skynet Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux SMB-Null-Session Login-Brute-Force CVE RFI Tar-Wildcard-Expansion

7 min read Nov 14, 2024

HTB Sau Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy CVE

15 min read Nov 12, 2024

HTB Editorial Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Blind-SSRF Fuzzing API Git Git-Commit Python-Script CVE Command-Injection

8 min read Nov 12, 2024

THM Kenobi Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux SMB SMB-Null-Session RPC FTP Mount-NFS SSH SUID Linux-Relative-Path-Abuse

11 min read Nov 11, 2024

THM Thompson Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux Tomcat WAR-Reverse-Shell Bash-Script Cron-Job Etc-Shadow SSH Create-id_rsa

19 min read Nov 10, 2024

THM SQL Injection Lab Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Web-Pentesting SQL-Injection Manual-SQL-Injection SQLMap

9 min read Nov 10, 2024

HTB Busqueda Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Searchor Git Gitea Password-Reuse SSH Docker Bash-Script Linux-Relative-Path-Abuse

8 min read Nov 9, 2024

HTB Return Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory Passback-LDAP-Attack LDAP Printer Server-Operators sc.exe Service-Restart

10 min read Nov 9, 2024

HTB Timelapse Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory SMB-Null-Session SMB-Shares .PFX WinRM-.pem PowerShell-History LDAP LDAP-Saved-Password

8 min read Nov 9, 2024

HTB ServMon Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy FTP CVE Path-Traversal Password-Spraying SSH Port-Forwarding .bat

7 min read Nov 9, 2024

HTB Sauna Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory AS-REP-Roasting BloodHound DCSync Pass-the-Hash

8 min read Nov 8, 2024

HTB Forest Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory RPC-Null-Session LDAP-Anonymous Username-Pattern AS-REP-Roasting BloodHound PowerView.ps1 ACLs GenericAll WriteDacl DCSync Pass-the-Hash

13 min read Nov 7, 2024

HTB Pilgrimage Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Git CVE Arbitrary-File-Read pspy binwalk

12 min read Nov 5, 2024

HTB Sunday Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Unix Easy SSH-Brute-Force Shadow Sudo-l

7 min read Nov 4, 2024

HTB Nibbles Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy CVE PHP-Reverse-Shell Sudo-l Bash-Script Alternative-Without-Metasploit

7 min read Nov 3, 2024

HTB Active Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory SMB-Null-Session SMB-Shares GPP-cPassword Kerberoasting

1 post tagged

Etc-Shadow

11 min read Nov 11, 2024

THM Thompson Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux Tomcat WAR-Reverse-Shell Bash-Script Cron-Job Etc-Shadow SSH Create-id_rsa

2 posts tagged

FTP

8 min read Nov 12, 2024

THM Kenobi Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux SMB SMB-Null-Session RPC FTP Mount-NFS SSH SUID Linux-Relative-Path-Abuse

8 min read Nov 9, 2024

HTB ServMon Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy FTP CVE Path-Traversal Password-Spraying SSH Port-Forwarding .bat

1 post tagged

FTP-Anonymous

4 min read Nov 18, 2024

HTB Access Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows FTP-Anonymous .mdb Telnet Stored-Credentials Runas.exe

1 post tagged

File-Upload-Bypass

13 min read Nov 11, 2024

HTB Magic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Medium SQL-Injection-Bypass File-Upload-Bypass Magic-Bytes PHP-Reverse-Shell BusyBox MySQL Port-Forwarding Credentials-in-DB-File SUID Relative-Path-Exploitation

1 post tagged

Fuzzing

15 min read Nov 12, 2024

HTB Editorial Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Blind-SSRF Fuzzing API Git Git-Commit Python-Script CVE Command-Injection

1 post tagged

GPP-cPassword

7 min read Nov 3, 2024

HTB Active Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory SMB-Null-Session SMB-Shares GPP-cPassword Kerberoasting

1 post tagged

GTFOBins-Shell

6 min read Nov 12, 2024

THM UltraTech Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Medium Linux API Arbitrary-File-Read SSH GTFOBins-Shell Docker

1 post tagged

GenericAll

8 min read Nov 8, 2024

HTB Forest Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory RPC-Null-Session LDAP-Anonymous Username-Pattern AS-REP-Roasting BloodHound PowerView.ps1 ACLs GenericAll WriteDacl DCSync Pass-the-Hash

3 posts tagged

Git

15 min read Nov 12, 2024

HTB Editorial Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Blind-SSRF Fuzzing API Git Git-Commit Python-Script CVE Command-Injection

9 min read Nov 10, 2024

HTB Busqueda Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Searchor Git Gitea Password-Reuse SSH Docker Bash-Script Linux-Relative-Path-Abuse

13 min read Nov 7, 2024

HTB Pilgrimage Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Git CVE Arbitrary-File-Read pspy binwalk

1 post tagged

Git-Commit

15 min read Nov 12, 2024

HTB Editorial Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Blind-SSRF Fuzzing API Git Git-Commit Python-Script CVE Command-Injection

1 post tagged

Gitea

9 min read Nov 10, 2024

HTB Busqueda Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Searchor Git Gitea Password-Reuse SSH Docker Bash-Script Linux-Relative-Path-Abuse

2 posts tagged

Groovy-Reverse-Shell

8 min read Nov 19, 2024

THM Alfred Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Windows Jenkins Default-Credentials Groovy-Reverse-Shell Incognito.exe RDP rdesktop Alternative-Without-Metasploit

7 min read Nov 8, 2024

HTB Jeeves Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium Jenkins Groovy-Reverse-Shell KeePass-.kdbx

26 posts tagged

HTB

5 min read Dec 11, 2024

HTB Brevi Moduli Solution (Without SageMath)

HTB Cryptography Challenge

Vorkharium in Solution HTB Challenges Python Script Cryptography RSA

9 min read Nov 20, 2024

HTB Devvortex Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Vhost-Enumeration CVE Joomla MySQL Credentials-in-Database apport-cli

20 min read Nov 19, 2024

HTB Flight Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Hard Windows Active-Directory Vhost-Enumeration Domain-User-Enumeration AD-Password-Spraying Password-Reuse SMB-Share-Write-Permission-Abuse .ini Capturing-NTLMv2-Hashes-with-SMB-Server PHP-Reverse-Shell Chisel.exe Port-Forwarding RunasCs.exe RunasCs.exe-Reverse-Shell Microsoft-IIS cmdasp.aspx JuicyPotatoNG

4 min read Nov 18, 2024

HTB Access Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows FTP-Anonymous .mdb Telnet Stored-Credentials Runas.exe

4 min read Nov 18, 2024

HTB Arctic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows ColdFusion CVE Arbitrary-File-Upload JuicyPotato MSFVenom

11 min read Nov 18, 2024

HTB Mailing Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows Path-Traversal CVE Capturing-NTLMv2-Hashes WinRM Credential-Dumping Pass-the-Hash

7 min read Nov 14, 2024

HTB Sau Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy CVE

15 min read Nov 12, 2024

HTB Editorial Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Blind-SSRF Fuzzing API Git Git-Commit Python-Script CVE Command-Injection

13 min read Nov 11, 2024

HTB Magic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Medium SQL-Injection-Bypass File-Upload-Bypass Magic-Bytes PHP-Reverse-Shell BusyBox MySQL Port-Forwarding Credentials-in-DB-File SUID Relative-Path-Exploitation

17 min read Nov 10, 2024

HTB Chatterbox Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium AChat Buffer-Overflow Credentials-in-Registry Password-Reuse PsExec

9 min read Nov 10, 2024

HTB Busqueda Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Searchor Git Gitea Password-Reuse SSH Docker Bash-Script Linux-Relative-Path-Abuse

8 min read Nov 9, 2024

HTB Return Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory Passback-LDAP-Attack LDAP Printer Server-Operators sc.exe Service-Restart

10 min read Nov 9, 2024

HTB Timelapse Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory SMB-Null-Session SMB-Shares .PFX WinRM-.pem PowerShell-History LDAP LDAP-Saved-Password

8 min read Nov 9, 2024

HTB ServMon Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy FTP CVE Path-Traversal Password-Spraying SSH Port-Forwarding .bat

8 min read Nov 9, 2024

HTB Builder Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Medium Jenkins CVE

7 min read Nov 9, 2024

HTB Sauna Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory AS-REP-Roasting BloodHound DCSync Pass-the-Hash

8 min read Nov 8, 2024

HTB Forest Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory RPC-Null-Session LDAP-Anonymous Username-Pattern AS-REP-Roasting BloodHound PowerView.ps1 ACLs GenericAll WriteDacl DCSync Pass-the-Hash

12 min read Nov 8, 2024

HTB Querier Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium SMB-Null-Session SMB-Shares MSSQL PowerUp.ps1 PsExec

7 min read Nov 8, 2024

HTB Jeeves Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium Jenkins Groovy-Reverse-Shell KeePass-.kdbx

13 min read Nov 7, 2024

HTB Pilgrimage Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Git CVE Arbitrary-File-Read pspy binwalk

7 min read Nov 6, 2024

HTB SecNotes Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium XSRF PHP-Reverse-Shell SMB-Shares Bash-History SMB-PsExec

12 min read Nov 5, 2024

HTB Sunday Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Unix Easy SSH-Brute-Force Shadow Sudo-l

7 min read Nov 4, 2024

HTB Nibbles Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy CVE PHP-Reverse-Shell Sudo-l Bash-Script Alternative-Without-Metasploit

18 min read Nov 3, 2024

HTB Blackfield Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Hard Active-Directory SMB-Null-Session SMB-Shares AS-REP-Roasting BloodHound RPC Credential-Dumping Pass-the-Hash

11 min read Nov 3, 2024

HTB Monteverde Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Weak-Credentials RPC-Null-Session Password-Spraying SMB-Shares Azure-AD-Connect

7 min read Nov 3, 2024

HTB Active Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory SMB-Null-Session SMB-Shares GPP-cPassword Kerberoasting

4 posts tagged

Hard

20 min read Nov 19, 2024

HTB Flight Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Hard Windows Active-Directory Vhost-Enumeration Domain-User-Enumeration AD-Password-Spraying Password-Reuse SMB-Share-Write-Permission-Abuse .ini Capturing-NTLMv2-Hashes-with-SMB-Server PHP-Reverse-Shell Chisel.exe Port-Forwarding RunasCs.exe RunasCs.exe-Reverse-Shell Microsoft-IIS cmdasp.aspx JuicyPotatoNG

4 min read Nov 19, 2024

THM Retro Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Hard Windows WordPress RDP Windows-Kernel-Exploit CVE

10 min read Nov 17, 2024

THM Year of the Owl Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Hard Windows SNMP OSINT NetExec WinRM SID-Recycle-Bin Credential-Dumping SAM-SYSTEM-Dump Pass-the-Hash

18 min read Nov 3, 2024

HTB Blackfield Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Hard Active-Directory SMB-Null-Session SMB-Shares AS-REP-Roasting BloodHound RPC Credential-Dumping Pass-the-Hash

1 post tagged

Incognito.exe

8 min read Nov 19, 2024

THM Alfred Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Windows Jenkins Default-Credentials Groovy-Reverse-Shell Incognito.exe RDP rdesktop Alternative-Without-Metasploit

3 posts tagged

Jenkins

8 min read Nov 19, 2024

THM Alfred Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Windows Jenkins Default-Credentials Groovy-Reverse-Shell Incognito.exe RDP rdesktop Alternative-Without-Metasploit

8 min read Nov 9, 2024

HTB Builder Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Medium Jenkins CVE

7 min read Nov 8, 2024

HTB Jeeves Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium Jenkins Groovy-Reverse-Shell KeePass-.kdbx

1 post tagged

Joomla

9 min read Nov 20, 2024

HTB Devvortex Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Vhost-Enumeration CVE Joomla MySQL Credentials-in-Database apport-cli

1 post tagged

JuicyPotato

4 min read Nov 18, 2024

HTB Arctic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows ColdFusion CVE Arbitrary-File-Upload JuicyPotato MSFVenom

1 post tagged

JuicyPotatoNG

20 min read Nov 19, 2024

HTB Flight Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Hard Windows Active-Directory Vhost-Enumeration Domain-User-Enumeration AD-Password-Spraying Password-Reuse SMB-Share-Write-Permission-Abuse .ini Capturing-NTLMv2-Hashes-with-SMB-Server PHP-Reverse-Shell Chisel.exe Port-Forwarding RunasCs.exe RunasCs.exe-Reverse-Shell Microsoft-IIS cmdasp.aspx JuicyPotatoNG

1 post tagged

KeePass-.kdbx

7 min read Nov 8, 2024

HTB Jeeves Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium Jenkins Groovy-Reverse-Shell KeePass-.kdbx

2 posts tagged

Kerberoasting

7 min read Nov 3, 2024

HTB Active Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory SMB-Null-Session SMB-Shares GPP-cPassword Kerberoasting

23 min read Nov 2, 2024

Attacking Active Directory Cheatsheet

Cheatsheet for Attacking Active Directory

Vorkharium in Cheatsheets Tools Active-Directory Active-Directory-Enumeration SMB Kerberoasting AS-REP-Roasting DCSync ACLs MSSQL Credential-Dumping Credential-Hunting

2 posts tagged

LDAP

8 min read Nov 9, 2024

HTB Return Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory Passback-LDAP-Attack LDAP Printer Server-Operators sc.exe Service-Restart

10 min read Nov 9, 2024

HTB Timelapse Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory SMB-Null-Session SMB-Shares .PFX WinRM-.pem PowerShell-History LDAP LDAP-Saved-Password

1 post tagged

LDAP-Anonymous

8 min read Nov 8, 2024

HTB Forest Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory RPC-Null-Session LDAP-Anonymous Username-Pattern AS-REP-Roasting BloodHound PowerView.ps1 ACLs GenericAll WriteDacl DCSync Pass-the-Hash

1 post tagged

LDAP-Saved-Password

10 min read Nov 9, 2024

HTB Timelapse Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory SMB-Null-Session SMB-Shares .PFX WinRM-.pem PowerShell-History LDAP LDAP-Saved-Password

13 posts tagged

Linux

9 min read Nov 20, 2024

HTB Devvortex Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Vhost-Enumeration CVE Joomla MySQL Credentials-in-Database apport-cli

12 min read Nov 15, 2024

THM Skynet Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux SMB-Null-Session Login-Brute-Force CVE RFI Tar-Wildcard-Expansion

7 min read Nov 14, 2024

HTB Sau Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy CVE

15 min read Nov 12, 2024

HTB Editorial Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Blind-SSRF Fuzzing API Git Git-Commit Python-Script CVE Command-Injection

6 min read Nov 12, 2024

THM UltraTech Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Medium Linux API Arbitrary-File-Read SSH GTFOBins-Shell Docker

8 min read Nov 12, 2024

THM Kenobi Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux SMB SMB-Null-Session RPC FTP Mount-NFS SSH SUID Linux-Relative-Path-Abuse

13 min read Nov 11, 2024

HTB Magic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Medium SQL-Injection-Bypass File-Upload-Bypass Magic-Bytes PHP-Reverse-Shell BusyBox MySQL Port-Forwarding Credentials-in-DB-File SUID Relative-Path-Exploitation

11 min read Nov 11, 2024

THM Thompson Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux Tomcat WAR-Reverse-Shell Bash-Script Cron-Job Etc-Shadow SSH Create-id_rsa

11 min read Nov 10, 2024

THM Mr Robot CTF Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Linux Medium WordPress Login-Brute-Force WP-Template-PHP-Reverse-Shell MD5-Hash Nmap-SUID

9 min read Nov 10, 2024

HTB Busqueda Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Searchor Git Gitea Password-Reuse SSH Docker Bash-Script Linux-Relative-Path-Abuse

8 min read Nov 9, 2024

HTB Builder Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Medium Jenkins CVE

13 min read Nov 7, 2024

HTB Pilgrimage Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Git CVE Arbitrary-File-Read pspy binwalk

7 min read Nov 4, 2024

HTB Nibbles Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy CVE PHP-Reverse-Shell Sudo-l Bash-Script Alternative-Without-Metasploit

2 posts tagged

Linux-Relative-Path-Abuse

8 min read Nov 12, 2024

THM Kenobi Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux SMB SMB-Null-Session RPC FTP Mount-NFS SSH SUID Linux-Relative-Path-Abuse

9 min read Nov 10, 2024

HTB Busqueda Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Searchor Git Gitea Password-Reuse SSH Docker Bash-Script Linux-Relative-Path-Abuse

2 posts tagged

Login-Brute-Force

12 min read Nov 15, 2024

THM Skynet Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux SMB-Null-Session Login-Brute-Force CVE RFI Tar-Wildcard-Expansion

11 min read Nov 10, 2024

THM Mr Robot CTF Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Linux Medium WordPress Login-Brute-Force WP-Template-PHP-Reverse-Shell MD5-Hash Nmap-SUID

1 post tagged

MD5-Hash

11 min read Nov 10, 2024

THM Mr Robot CTF Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Linux Medium WordPress Login-Brute-Force WP-Template-PHP-Reverse-Shell MD5-Hash Nmap-SUID

1 post tagged

MSFVenom

4 min read Nov 18, 2024

HTB Arctic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows ColdFusion CVE Arbitrary-File-Upload JuicyPotato MSFVenom

2 posts tagged

MSSQL

12 min read Nov 8, 2024

HTB Querier Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium SMB-Null-Session SMB-Shares MSSQL PowerUp.ps1 PsExec

23 min read Nov 2, 2024

Attacking Active Directory Cheatsheet

Cheatsheet for Attacking Active Directory

Vorkharium in Cheatsheets Tools Active-Directory Active-Directory-Enumeration SMB Kerberoasting AS-REP-Roasting DCSync ACLs MSSQL Credential-Dumping Credential-Hunting

1 post tagged

Magic-Bytes

13 min read Nov 11, 2024

HTB Magic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Medium SQL-Injection-Bypass File-Upload-Bypass Magic-Bytes PHP-Reverse-Shell BusyBox MySQL Port-Forwarding Credentials-in-DB-File SUID Relative-Path-Exploitation

1 post tagged

Manual-SQL-Injection

19 min read Nov 10, 2024

THM SQL Injection Lab Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Web-Pentesting SQL-Injection Manual-SQL-Injection SQLMap

8 posts tagged

Medium

6 min read Nov 12, 2024

THM UltraTech Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Medium Linux API Arbitrary-File-Read SSH GTFOBins-Shell Docker

13 min read Nov 11, 2024

HTB Magic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Medium SQL-Injection-Bypass File-Upload-Bypass Magic-Bytes PHP-Reverse-Shell BusyBox MySQL Port-Forwarding Credentials-in-DB-File SUID Relative-Path-Exploitation

17 min read Nov 10, 2024

HTB Chatterbox Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium AChat Buffer-Overflow Credentials-in-Registry Password-Reuse PsExec

11 min read Nov 10, 2024

THM Mr Robot CTF Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Linux Medium WordPress Login-Brute-Force WP-Template-PHP-Reverse-Shell MD5-Hash Nmap-SUID

8 min read Nov 9, 2024

HTB Builder Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Medium Jenkins CVE

12 min read Nov 8, 2024

HTB Querier Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium SMB-Null-Session SMB-Shares MSSQL PowerUp.ps1 PsExec

7 min read Nov 8, 2024

HTB Jeeves Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium Jenkins Groovy-Reverse-Shell KeePass-.kdbx

7 min read Nov 6, 2024

HTB SecNotes Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium XSRF PHP-Reverse-Shell SMB-Shares Bash-History SMB-PsExec

1 post tagged

Microsoft-IIS

20 min read Nov 19, 2024

HTB Flight Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Hard Windows Active-Directory Vhost-Enumeration Domain-User-Enumeration AD-Password-Spraying Password-Reuse SMB-Share-Write-Permission-Abuse .ini Capturing-NTLMv2-Hashes-with-SMB-Server PHP-Reverse-Shell Chisel.exe Port-Forwarding RunasCs.exe RunasCs.exe-Reverse-Shell Microsoft-IIS cmdasp.aspx JuicyPotatoNG

1 post tagged

Mount-NFS

8 min read Nov 12, 2024

THM Kenobi Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux SMB SMB-Null-Session RPC FTP Mount-NFS SSH SUID Linux-Relative-Path-Abuse

2 posts tagged

MySQL

9 min read Nov 20, 2024

HTB Devvortex Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Vhost-Enumeration CVE Joomla MySQL Credentials-in-Database apport-cli

13 min read Nov 11, 2024

HTB Magic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Medium SQL-Injection-Bypass File-Upload-Bypass Magic-Bytes PHP-Reverse-Shell BusyBox MySQL Port-Forwarding Credentials-in-DB-File SUID Relative-Path-Exploitation

1 post tagged

NetExec

10 min read Nov 17, 2024

THM Year of the Owl Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Hard Windows SNMP OSINT NetExec WinRM SID-Recycle-Bin Credential-Dumping SAM-SYSTEM-Dump Pass-the-Hash

1 post tagged

Nmap-SUID

11 min read Nov 10, 2024

THM Mr Robot CTF Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Linux Medium WordPress Login-Brute-Force WP-Template-PHP-Reverse-Shell MD5-Hash Nmap-SUID

35 posts tagged

OSCP+

9 min read Nov 20, 2024

HTB Devvortex Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Vhost-Enumeration CVE Joomla MySQL Credentials-in-Database apport-cli

20 min read Nov 19, 2024

HTB Flight Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Hard Windows Active-Directory Vhost-Enumeration Domain-User-Enumeration AD-Password-Spraying Password-Reuse SMB-Share-Write-Permission-Abuse .ini Capturing-NTLMv2-Hashes-with-SMB-Server PHP-Reverse-Shell Chisel.exe Port-Forwarding RunasCs.exe RunasCs.exe-Reverse-Shell Microsoft-IIS cmdasp.aspx JuicyPotatoNG

8 min read Nov 19, 2024

THM Alfred Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Windows Jenkins Default-Credentials Groovy-Reverse-Shell Incognito.exe RDP rdesktop Alternative-Without-Metasploit

4 min read Nov 19, 2024

THM Retro Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Hard Windows WordPress RDP Windows-Kernel-Exploit CVE

4 min read Nov 18, 2024

HTB Access Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows FTP-Anonymous .mdb Telnet Stored-Credentials Runas.exe

4 min read Nov 18, 2024

HTB Arctic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows ColdFusion CVE Arbitrary-File-Upload JuicyPotato MSFVenom

11 min read Nov 18, 2024

HTB Mailing Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows Path-Traversal CVE Capturing-NTLMv2-Hashes WinRM Credential-Dumping Pass-the-Hash

10 min read Nov 17, 2024

THM Year of the Owl Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Hard Windows SNMP OSINT NetExec WinRM SID-Recycle-Bin Credential-Dumping SAM-SYSTEM-Dump Pass-the-Hash

10 min read Nov 16, 2024

THM Steel Mountain Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Windows CVE PowerUp.ps1 CanRestart Weak-File-Permission Unquoted-Service-Path

12 min read Nov 15, 2024

THM Skynet Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux SMB-Null-Session Login-Brute-Force CVE RFI Tar-Wildcard-Expansion

7 min read Nov 14, 2024

HTB Sau Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy CVE

15 min read Nov 12, 2024

HTB Editorial Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Blind-SSRF Fuzzing API Git Git-Commit Python-Script CVE Command-Injection

6 min read Nov 12, 2024

THM UltraTech Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Medium Linux API Arbitrary-File-Read SSH GTFOBins-Shell Docker

8 min read Nov 12, 2024

THM Kenobi Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux SMB SMB-Null-Session RPC FTP Mount-NFS SSH SUID Linux-Relative-Path-Abuse

13 min read Nov 11, 2024

HTB Magic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Medium SQL-Injection-Bypass File-Upload-Bypass Magic-Bytes PHP-Reverse-Shell BusyBox MySQL Port-Forwarding Credentials-in-DB-File SUID Relative-Path-Exploitation

11 min read Nov 11, 2024

THM Thompson Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux Tomcat WAR-Reverse-Shell Bash-Script Cron-Job Etc-Shadow SSH Create-id_rsa

19 min read Nov 10, 2024

THM SQL Injection Lab Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Web-Pentesting SQL-Injection Manual-SQL-Injection SQLMap

17 min read Nov 10, 2024

HTB Chatterbox Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium AChat Buffer-Overflow Credentials-in-Registry Password-Reuse PsExec

11 min read Nov 10, 2024

THM Mr Robot CTF Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Linux Medium WordPress Login-Brute-Force WP-Template-PHP-Reverse-Shell MD5-Hash Nmap-SUID

9 min read Nov 10, 2024

HTB Busqueda Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Searchor Git Gitea Password-Reuse SSH Docker Bash-Script Linux-Relative-Path-Abuse

8 min read Nov 9, 2024

HTB Return Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory Passback-LDAP-Attack LDAP Printer Server-Operators sc.exe Service-Restart

10 min read Nov 9, 2024

HTB Timelapse Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory SMB-Null-Session SMB-Shares .PFX WinRM-.pem PowerShell-History LDAP LDAP-Saved-Password

8 min read Nov 9, 2024

HTB ServMon Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy FTP CVE Path-Traversal Password-Spraying SSH Port-Forwarding .bat

8 min read Nov 9, 2024

HTB Builder Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Medium Jenkins CVE

7 min read Nov 9, 2024

HTB Sauna Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory AS-REP-Roasting BloodHound DCSync Pass-the-Hash

8 min read Nov 8, 2024

HTB Forest Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory RPC-Null-Session LDAP-Anonymous Username-Pattern AS-REP-Roasting BloodHound PowerView.ps1 ACLs GenericAll WriteDacl DCSync Pass-the-Hash

12 min read Nov 8, 2024

HTB Querier Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium SMB-Null-Session SMB-Shares MSSQL PowerUp.ps1 PsExec

7 min read Nov 8, 2024

HTB Jeeves Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium Jenkins Groovy-Reverse-Shell KeePass-.kdbx

13 min read Nov 7, 2024

HTB Pilgrimage Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Git CVE Arbitrary-File-Read pspy binwalk

7 min read Nov 6, 2024

HTB SecNotes Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium XSRF PHP-Reverse-Shell SMB-Shares Bash-History SMB-PsExec

12 min read Nov 5, 2024

HTB Sunday Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Unix Easy SSH-Brute-Force Shadow Sudo-l

7 min read Nov 4, 2024

HTB Nibbles Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy CVE PHP-Reverse-Shell Sudo-l Bash-Script Alternative-Without-Metasploit

18 min read Nov 3, 2024

HTB Blackfield Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Hard Active-Directory SMB-Null-Session SMB-Shares AS-REP-Roasting BloodHound RPC Credential-Dumping Pass-the-Hash

11 min read Nov 3, 2024

HTB Monteverde Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Weak-Credentials RPC-Null-Session Password-Spraying SMB-Shares Azure-AD-Connect

7 min read Nov 3, 2024

HTB Active Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory SMB-Null-Session SMB-Shares GPP-cPassword Kerberoasting

1 post tagged

OSINT

10 min read Nov 17, 2024

THM Year of the Owl Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Hard Windows SNMP OSINT NetExec WinRM SID-Recycle-Bin Credential-Dumping SAM-SYSTEM-Dump Pass-the-Hash

4 posts tagged

PHP-Reverse-Shell

20 min read Nov 19, 2024

HTB Flight Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Hard Windows Active-Directory Vhost-Enumeration Domain-User-Enumeration AD-Password-Spraying Password-Reuse SMB-Share-Write-Permission-Abuse .ini Capturing-NTLMv2-Hashes-with-SMB-Server PHP-Reverse-Shell Chisel.exe Port-Forwarding RunasCs.exe RunasCs.exe-Reverse-Shell Microsoft-IIS cmdasp.aspx JuicyPotatoNG

13 min read Nov 11, 2024

HTB Magic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Medium SQL-Injection-Bypass File-Upload-Bypass Magic-Bytes PHP-Reverse-Shell BusyBox MySQL Port-Forwarding Credentials-in-DB-File SUID Relative-Path-Exploitation

7 min read Nov 6, 2024

HTB SecNotes Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium XSRF PHP-Reverse-Shell SMB-Shares Bash-History SMB-PsExec

7 min read Nov 4, 2024

HTB Nibbles Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy CVE PHP-Reverse-Shell Sudo-l Bash-Script Alternative-Without-Metasploit

5 posts tagged

Pass-the-Hash

11 min read Nov 18, 2024

HTB Mailing Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows Path-Traversal CVE Capturing-NTLMv2-Hashes WinRM Credential-Dumping Pass-the-Hash

10 min read Nov 17, 2024

THM Year of the Owl Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Hard Windows SNMP OSINT NetExec WinRM SID-Recycle-Bin Credential-Dumping SAM-SYSTEM-Dump Pass-the-Hash

7 min read Nov 9, 2024

HTB Sauna Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory AS-REP-Roasting BloodHound DCSync Pass-the-Hash

8 min read Nov 8, 2024

HTB Forest Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory RPC-Null-Session LDAP-Anonymous Username-Pattern AS-REP-Roasting BloodHound PowerView.ps1 ACLs GenericAll WriteDacl DCSync Pass-the-Hash

18 min read Nov 3, 2024

HTB Blackfield Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Hard Active-Directory SMB-Null-Session SMB-Shares AS-REP-Roasting BloodHound RPC Credential-Dumping Pass-the-Hash

1 post tagged

Passback-LDAP-Attack

8 min read Nov 9, 2024

HTB Return Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory Passback-LDAP-Attack LDAP Printer Server-Operators sc.exe Service-Restart

3 posts tagged

Password-Reuse

20 min read Nov 19, 2024

HTB Flight Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Hard Windows Active-Directory Vhost-Enumeration Domain-User-Enumeration AD-Password-Spraying Password-Reuse SMB-Share-Write-Permission-Abuse .ini Capturing-NTLMv2-Hashes-with-SMB-Server PHP-Reverse-Shell Chisel.exe Port-Forwarding RunasCs.exe RunasCs.exe-Reverse-Shell Microsoft-IIS cmdasp.aspx JuicyPotatoNG

17 min read Nov 10, 2024

HTB Chatterbox Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium AChat Buffer-Overflow Credentials-in-Registry Password-Reuse PsExec

9 min read Nov 10, 2024

HTB Busqueda Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Searchor Git Gitea Password-Reuse SSH Docker Bash-Script Linux-Relative-Path-Abuse

2 posts tagged

Password-Spraying

8 min read Nov 9, 2024

HTB ServMon Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy FTP CVE Path-Traversal Password-Spraying SSH Port-Forwarding .bat

11 min read Nov 3, 2024

HTB Monteverde Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Weak-Credentials RPC-Null-Session Password-Spraying SMB-Shares Azure-AD-Connect

2 posts tagged

Path-Traversal

11 min read Nov 18, 2024

HTB Mailing Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows Path-Traversal CVE Capturing-NTLMv2-Hashes WinRM Credential-Dumping Pass-the-Hash

8 min read Nov 9, 2024

HTB ServMon Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy FTP CVE Path-Traversal Password-Spraying SSH Port-Forwarding .bat

1 post tagged

Pivoting

6 min read Nov 2, 2024

Ligolo-ng Cheatsheet

Cheatsheet for Ligolo-ng

Vorkharium in Cheatsheets Tools Pivoting

3 posts tagged

Port-Forwarding

20 min read Nov 19, 2024

HTB Flight Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Hard Windows Active-Directory Vhost-Enumeration Domain-User-Enumeration AD-Password-Spraying Password-Reuse SMB-Share-Write-Permission-Abuse .ini Capturing-NTLMv2-Hashes-with-SMB-Server PHP-Reverse-Shell Chisel.exe Port-Forwarding RunasCs.exe RunasCs.exe-Reverse-Shell Microsoft-IIS cmdasp.aspx JuicyPotatoNG

13 min read Nov 11, 2024

HTB Magic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Medium SQL-Injection-Bypass File-Upload-Bypass Magic-Bytes PHP-Reverse-Shell BusyBox MySQL Port-Forwarding Credentials-in-DB-File SUID Relative-Path-Exploitation

8 min read Nov 9, 2024

HTB ServMon Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy FTP CVE Path-Traversal Password-Spraying SSH Port-Forwarding .bat

1 post tagged

PowerShell-History

10 min read Nov 9, 2024

HTB Timelapse Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory SMB-Null-Session SMB-Shares .PFX WinRM-.pem PowerShell-History LDAP LDAP-Saved-Password

2 posts tagged

PowerUp.ps1

10 min read Nov 16, 2024

THM Steel Mountain Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Windows CVE PowerUp.ps1 CanRestart Weak-File-Permission Unquoted-Service-Path

12 min read Nov 8, 2024

HTB Querier Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium SMB-Null-Session SMB-Shares MSSQL PowerUp.ps1 PsExec

1 post tagged

PowerView.ps1

8 min read Nov 8, 2024

HTB Forest Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory RPC-Null-Session LDAP-Anonymous Username-Pattern AS-REP-Roasting BloodHound PowerView.ps1 ACLs GenericAll WriteDacl DCSync Pass-the-Hash

1 post tagged

Printer

8 min read Nov 9, 2024

HTB Return Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory Passback-LDAP-Attack LDAP Printer Server-Operators sc.exe Service-Restart

2 posts tagged

PsExec

17 min read Nov 10, 2024

HTB Chatterbox Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium AChat Buffer-Overflow Credentials-in-Registry Password-Reuse PsExec

12 min read Nov 8, 2024

HTB Querier Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium SMB-Null-Session SMB-Shares MSSQL PowerUp.ps1 PsExec

1 post tagged

Python

5 min read Dec 11, 2024

HTB Brevi Moduli Solution (Without SageMath)

HTB Cryptography Challenge

Vorkharium in Solution HTB Challenges Python Script Cryptography RSA

1 post tagged

Python-Script

15 min read Nov 12, 2024

HTB Editorial Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Blind-SSRF Fuzzing API Git Git-Commit Python-Script CVE Command-Injection

2 posts tagged

RDP

8 min read Nov 19, 2024

THM Alfred Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Windows Jenkins Default-Credentials Groovy-Reverse-Shell Incognito.exe RDP rdesktop Alternative-Without-Metasploit

4 min read Nov 19, 2024

THM Retro Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Hard Windows WordPress RDP Windows-Kernel-Exploit CVE

1 post tagged

RFI

12 min read Nov 15, 2024

THM Skynet Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux SMB-Null-Session Login-Brute-Force CVE RFI Tar-Wildcard-Expansion

2 posts tagged

RPC

8 min read Nov 12, 2024

THM Kenobi Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux SMB SMB-Null-Session RPC FTP Mount-NFS SSH SUID Linux-Relative-Path-Abuse

18 min read Nov 3, 2024

HTB Blackfield Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Hard Active-Directory SMB-Null-Session SMB-Shares AS-REP-Roasting BloodHound RPC Credential-Dumping Pass-the-Hash

2 posts tagged

RPC-Null-Session

8 min read Nov 8, 2024

HTB Forest Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory RPC-Null-Session LDAP-Anonymous Username-Pattern AS-REP-Roasting BloodHound PowerView.ps1 ACLs GenericAll WriteDacl DCSync Pass-the-Hash

11 min read Nov 3, 2024

HTB Monteverde Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Weak-Credentials RPC-Null-Session Password-Spraying SMB-Shares Azure-AD-Connect

1 post tagged

RSA

5 min read Dec 11, 2024

HTB Brevi Moduli Solution (Without SageMath)

HTB Cryptography Challenge

Vorkharium in Solution HTB Challenges Python Script Cryptography RSA

1 post tagged

Relative-Path-Exploitation

13 min read Nov 11, 2024

HTB Magic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Medium SQL-Injection-Bypass File-Upload-Bypass Magic-Bytes PHP-Reverse-Shell BusyBox MySQL Port-Forwarding Credentials-in-DB-File SUID Relative-Path-Exploitation

1 post tagged

Runas.exe

4 min read Nov 18, 2024

HTB Access Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows FTP-Anonymous .mdb Telnet Stored-Credentials Runas.exe

1 post tagged

RunasCs.exe

20 min read Nov 19, 2024

HTB Flight Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Hard Windows Active-Directory Vhost-Enumeration Domain-User-Enumeration AD-Password-Spraying Password-Reuse SMB-Share-Write-Permission-Abuse .ini Capturing-NTLMv2-Hashes-with-SMB-Server PHP-Reverse-Shell Chisel.exe Port-Forwarding RunasCs.exe RunasCs.exe-Reverse-Shell Microsoft-IIS cmdasp.aspx JuicyPotatoNG

1 post tagged

RunasCs.exe-Reverse-Shell

20 min read Nov 19, 2024

HTB Flight Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Hard Windows Active-Directory Vhost-Enumeration Domain-User-Enumeration AD-Password-Spraying Password-Reuse SMB-Share-Write-Permission-Abuse .ini Capturing-NTLMv2-Hashes-with-SMB-Server PHP-Reverse-Shell Chisel.exe Port-Forwarding RunasCs.exe RunasCs.exe-Reverse-Shell Microsoft-IIS cmdasp.aspx JuicyPotatoNG

1 post tagged

SAM-SYSTEM-Dump

10 min read Nov 17, 2024

THM Year of the Owl Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Hard Windows SNMP OSINT NetExec WinRM SID-Recycle-Bin Credential-Dumping SAM-SYSTEM-Dump Pass-the-Hash

1 post tagged

SID-Recycle-Bin

10 min read Nov 17, 2024

THM Year of the Owl Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Hard Windows SNMP OSINT NetExec WinRM SID-Recycle-Bin Credential-Dumping SAM-SYSTEM-Dump Pass-the-Hash

3 posts tagged

SMB

8 min read Nov 12, 2024

THM Kenobi Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux SMB SMB-Null-Session RPC FTP Mount-NFS SSH SUID Linux-Relative-Path-Abuse

23 min read Nov 2, 2024

Attacking Active Directory Cheatsheet

Cheatsheet for Attacking Active Directory

Vorkharium in Cheatsheets Tools Active-Directory Active-Directory-Enumeration SMB Kerberoasting AS-REP-Roasting DCSync ACLs MSSQL Credential-Dumping Credential-Hunting

8 min read Nov 2, 2024

NetExec and CrackMapExec Cheatsheet

Cheatsheet for NetExec and CrackMapExec

Vorkharium in Cheatsheets Tools Active-Directory Active-Directory-Enumeration SMB Credential-Dumping

6 posts tagged

SMB-Null-Session

12 min read Nov 15, 2024

THM Skynet Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux SMB-Null-Session Login-Brute-Force CVE RFI Tar-Wildcard-Expansion

8 min read Nov 12, 2024

THM Kenobi Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux SMB SMB-Null-Session RPC FTP Mount-NFS SSH SUID Linux-Relative-Path-Abuse

10 min read Nov 9, 2024

HTB Timelapse Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory SMB-Null-Session SMB-Shares .PFX WinRM-.pem PowerShell-History LDAP LDAP-Saved-Password

12 min read Nov 8, 2024

HTB Querier Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium SMB-Null-Session SMB-Shares MSSQL PowerUp.ps1 PsExec

18 min read Nov 3, 2024

HTB Blackfield Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Hard Active-Directory SMB-Null-Session SMB-Shares AS-REP-Roasting BloodHound RPC Credential-Dumping Pass-the-Hash

7 min read Nov 3, 2024

HTB Active Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory SMB-Null-Session SMB-Shares GPP-cPassword Kerberoasting

1 post tagged

SMB-PsExec

7 min read Nov 6, 2024

HTB SecNotes Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium XSRF PHP-Reverse-Shell SMB-Shares Bash-History SMB-PsExec

1 post tagged

SMB-Share-Write-Permission-Abuse

20 min read Nov 19, 2024

HTB Flight Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Hard Windows Active-Directory Vhost-Enumeration Domain-User-Enumeration AD-Password-Spraying Password-Reuse SMB-Share-Write-Permission-Abuse .ini Capturing-NTLMv2-Hashes-with-SMB-Server PHP-Reverse-Shell Chisel.exe Port-Forwarding RunasCs.exe RunasCs.exe-Reverse-Shell Microsoft-IIS cmdasp.aspx JuicyPotatoNG

6 posts tagged

SMB-Shares

10 min read Nov 9, 2024

HTB Timelapse Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory SMB-Null-Session SMB-Shares .PFX WinRM-.pem PowerShell-History LDAP LDAP-Saved-Password

12 min read Nov 8, 2024

HTB Querier Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium SMB-Null-Session SMB-Shares MSSQL PowerUp.ps1 PsExec

7 min read Nov 6, 2024

HTB SecNotes Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium XSRF PHP-Reverse-Shell SMB-Shares Bash-History SMB-PsExec

18 min read Nov 3, 2024

HTB Blackfield Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Hard Active-Directory SMB-Null-Session SMB-Shares AS-REP-Roasting BloodHound RPC Credential-Dumping Pass-the-Hash

11 min read Nov 3, 2024

HTB Monteverde Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Weak-Credentials RPC-Null-Session Password-Spraying SMB-Shares Azure-AD-Connect

7 min read Nov 3, 2024

HTB Active Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory SMB-Null-Session SMB-Shares GPP-cPassword Kerberoasting

1 post tagged

SNMP

10 min read Nov 17, 2024

THM Year of the Owl Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Hard Windows SNMP OSINT NetExec WinRM SID-Recycle-Bin Credential-Dumping SAM-SYSTEM-Dump Pass-the-Hash

1 post tagged

SQL-Injection

19 min read Nov 10, 2024

THM SQL Injection Lab Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Web-Pentesting SQL-Injection Manual-SQL-Injection SQLMap

1 post tagged

SQL-Injection-Bypass

13 min read Nov 11, 2024

HTB Magic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Medium SQL-Injection-Bypass File-Upload-Bypass Magic-Bytes PHP-Reverse-Shell BusyBox MySQL Port-Forwarding Credentials-in-DB-File SUID Relative-Path-Exploitation

1 post tagged

SQLMap

19 min read Nov 10, 2024

THM SQL Injection Lab Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Web-Pentesting SQL-Injection Manual-SQL-Injection SQLMap

5 posts tagged

SSH

6 min read Nov 12, 2024

THM UltraTech Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Medium Linux API Arbitrary-File-Read SSH GTFOBins-Shell Docker

8 min read Nov 12, 2024

THM Kenobi Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux SMB SMB-Null-Session RPC FTP Mount-NFS SSH SUID Linux-Relative-Path-Abuse

11 min read Nov 11, 2024

THM Thompson Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux Tomcat WAR-Reverse-Shell Bash-Script Cron-Job Etc-Shadow SSH Create-id_rsa

9 min read Nov 10, 2024

HTB Busqueda Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Searchor Git Gitea Password-Reuse SSH Docker Bash-Script Linux-Relative-Path-Abuse

8 min read Nov 9, 2024

HTB ServMon Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy FTP CVE Path-Traversal Password-Spraying SSH Port-Forwarding .bat

1 post tagged

SSH-Brute-Force

12 min read Nov 5, 2024

HTB Sunday Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Unix Easy SSH-Brute-Force Shadow Sudo-l

2 posts tagged

SUID

8 min read Nov 12, 2024

THM Kenobi Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux SMB SMB-Null-Session RPC FTP Mount-NFS SSH SUID Linux-Relative-Path-Abuse

13 min read Nov 11, 2024

HTB Magic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Medium SQL-Injection-Bypass File-Upload-Bypass Magic-Bytes PHP-Reverse-Shell BusyBox MySQL Port-Forwarding Credentials-in-DB-File SUID Relative-Path-Exploitation

1 post tagged

Script

5 min read Dec 11, 2024

HTB Brevi Moduli Solution (Without SageMath)

HTB Cryptography Challenge

Vorkharium in Solution HTB Challenges Python Script Cryptography RSA

1 post tagged

Searchor

9 min read Nov 10, 2024

HTB Busqueda Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Searchor Git Gitea Password-Reuse SSH Docker Bash-Script Linux-Relative-Path-Abuse

1 post tagged

Server-Operators

8 min read Nov 9, 2024

HTB Return Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory Passback-LDAP-Attack LDAP Printer Server-Operators sc.exe Service-Restart

1 post tagged

Service-Restart

8 min read Nov 9, 2024

HTB Return Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory Passback-LDAP-Attack LDAP Printer Server-Operators sc.exe Service-Restart

1 post tagged

Shadow

12 min read Nov 5, 2024

HTB Sunday Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Unix Easy SSH-Brute-Force Shadow Sudo-l

1 post tagged

Solution

5 min read Dec 11, 2024

HTB Brevi Moduli Solution (Without SageMath)

HTB Cryptography Challenge

Vorkharium in Solution HTB Challenges Python Script Cryptography RSA

1 post tagged

Stored-Credentials

4 min read Nov 18, 2024

HTB Access Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows FTP-Anonymous .mdb Telnet Stored-Credentials Runas.exe

2 posts tagged

Sudo-l

12 min read Nov 5, 2024

HTB Sunday Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Unix Easy SSH-Brute-Force Shadow Sudo-l

7 min read Nov 4, 2024

HTB Nibbles Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy CVE PHP-Reverse-Shell Sudo-l Bash-Script Alternative-Without-Metasploit

10 posts tagged

THM

8 min read Nov 19, 2024

THM Alfred Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Windows Jenkins Default-Credentials Groovy-Reverse-Shell Incognito.exe RDP rdesktop Alternative-Without-Metasploit

4 min read Nov 19, 2024

THM Retro Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Hard Windows WordPress RDP Windows-Kernel-Exploit CVE

10 min read Nov 17, 2024

THM Year of the Owl Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Hard Windows SNMP OSINT NetExec WinRM SID-Recycle-Bin Credential-Dumping SAM-SYSTEM-Dump Pass-the-Hash

10 min read Nov 16, 2024

THM Steel Mountain Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Windows CVE PowerUp.ps1 CanRestart Weak-File-Permission Unquoted-Service-Path

12 min read Nov 15, 2024

THM Skynet Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux SMB-Null-Session Login-Brute-Force CVE RFI Tar-Wildcard-Expansion

6 min read Nov 12, 2024

THM UltraTech Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Medium Linux API Arbitrary-File-Read SSH GTFOBins-Shell Docker

8 min read Nov 12, 2024

THM Kenobi Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux SMB SMB-Null-Session RPC FTP Mount-NFS SSH SUID Linux-Relative-Path-Abuse

11 min read Nov 11, 2024

THM Thompson Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux Tomcat WAR-Reverse-Shell Bash-Script Cron-Job Etc-Shadow SSH Create-id_rsa

19 min read Nov 10, 2024

THM SQL Injection Lab Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Web-Pentesting SQL-Injection Manual-SQL-Injection SQLMap

11 min read Nov 10, 2024

THM Mr Robot CTF Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Linux Medium WordPress Login-Brute-Force WP-Template-PHP-Reverse-Shell MD5-Hash Nmap-SUID

1 post tagged

Tar-Wildcard-Expansion

12 min read Nov 15, 2024

THM Skynet Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux SMB-Null-Session Login-Brute-Force CVE RFI Tar-Wildcard-Expansion

1 post tagged

Telnet

4 min read Nov 18, 2024

HTB Access Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows FTP-Anonymous .mdb Telnet Stored-Credentials Runas.exe

1 post tagged

Tomcat

11 min read Nov 11, 2024

THM Thompson Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux Tomcat WAR-Reverse-Shell Bash-Script Cron-Job Etc-Shadow SSH Create-id_rsa

3 posts tagged

Tools

23 min read Nov 2, 2024

Attacking Active Directory Cheatsheet

Cheatsheet for Attacking Active Directory

Vorkharium in Cheatsheets Tools Active-Directory Active-Directory-Enumeration SMB Kerberoasting AS-REP-Roasting DCSync ACLs MSSQL Credential-Dumping Credential-Hunting

8 min read Nov 2, 2024

NetExec and CrackMapExec Cheatsheet

Cheatsheet for NetExec and CrackMapExec

Vorkharium in Cheatsheets Tools Active-Directory Active-Directory-Enumeration SMB Credential-Dumping

6 min read Nov 2, 2024

Ligolo-ng Cheatsheet

Cheatsheet for Ligolo-ng

Vorkharium in Cheatsheets Tools Pivoting

1 post tagged

Unix

12 min read Nov 5, 2024

HTB Sunday Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Unix Easy SSH-Brute-Force Shadow Sudo-l

1 post tagged

Unquoted-Service-Path

10 min read Nov 16, 2024

THM Steel Mountain Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Windows CVE PowerUp.ps1 CanRestart Weak-File-Permission Unquoted-Service-Path

1 post tagged

Username-Pattern

8 min read Nov 8, 2024

HTB Forest Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory RPC-Null-Session LDAP-Anonymous Username-Pattern AS-REP-Roasting BloodHound PowerView.ps1 ACLs GenericAll WriteDacl DCSync Pass-the-Hash

2 posts tagged

Vhost-Enumeration

9 min read Nov 20, 2024

HTB Devvortex Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Vhost-Enumeration CVE Joomla MySQL Credentials-in-Database apport-cli

20 min read Nov 19, 2024

HTB Flight Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Hard Windows Active-Directory Vhost-Enumeration Domain-User-Enumeration AD-Password-Spraying Password-Reuse SMB-Share-Write-Permission-Abuse .ini Capturing-NTLMv2-Hashes-with-SMB-Server PHP-Reverse-Shell Chisel.exe Port-Forwarding RunasCs.exe RunasCs.exe-Reverse-Shell Microsoft-IIS cmdasp.aspx JuicyPotatoNG

1 post tagged

WAR-Reverse-Shell

11 min read Nov 11, 2024

THM Thompson Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux Tomcat WAR-Reverse-Shell Bash-Script Cron-Job Etc-Shadow SSH Create-id_rsa

1 post tagged

WP-Template-PHP-Reverse-Shell

11 min read Nov 10, 2024

THM Mr Robot CTF Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Linux Medium WordPress Login-Brute-Force WP-Template-PHP-Reverse-Shell MD5-Hash Nmap-SUID

1 post tagged

Weak-Credentials

11 min read Nov 3, 2024

HTB Monteverde Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Weak-Credentials RPC-Null-Session Password-Spraying SMB-Shares Azure-AD-Connect

1 post tagged

Weak-File-Permission

10 min read Nov 16, 2024

THM Steel Mountain Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Windows CVE PowerUp.ps1 CanRestart Weak-File-Permission Unquoted-Service-Path

1 post tagged

Web-Pentesting

19 min read Nov 10, 2024

THM SQL Injection Lab Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Web-Pentesting SQL-Injection Manual-SQL-Injection SQLMap

2 posts tagged

WinRM

11 min read Nov 18, 2024

HTB Mailing Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows Path-Traversal CVE Capturing-NTLMv2-Hashes WinRM Credential-Dumping Pass-the-Hash

10 min read Nov 17, 2024

THM Year of the Owl Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Hard Windows SNMP OSINT NetExec WinRM SID-Recycle-Bin Credential-Dumping SAM-SYSTEM-Dump Pass-the-Hash

1 post tagged

WinRM-.pem

10 min read Nov 9, 2024

HTB Timelapse Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory SMB-Null-Session SMB-Shares .PFX WinRM-.pem PowerShell-History LDAP LDAP-Saved-Password

20 posts tagged

Windows

20 min read Nov 19, 2024

HTB Flight Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Hard Windows Active-Directory Vhost-Enumeration Domain-User-Enumeration AD-Password-Spraying Password-Reuse SMB-Share-Write-Permission-Abuse .ini Capturing-NTLMv2-Hashes-with-SMB-Server PHP-Reverse-Shell Chisel.exe Port-Forwarding RunasCs.exe RunasCs.exe-Reverse-Shell Microsoft-IIS cmdasp.aspx JuicyPotatoNG

8 min read Nov 19, 2024

THM Alfred Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Windows Jenkins Default-Credentials Groovy-Reverse-Shell Incognito.exe RDP rdesktop Alternative-Without-Metasploit

4 min read Nov 19, 2024

THM Retro Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Hard Windows WordPress RDP Windows-Kernel-Exploit CVE

4 min read Nov 18, 2024

HTB Access Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows FTP-Anonymous .mdb Telnet Stored-Credentials Runas.exe

4 min read Nov 18, 2024

HTB Arctic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows ColdFusion CVE Arbitrary-File-Upload JuicyPotato MSFVenom

11 min read Nov 18, 2024

HTB Mailing Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows Path-Traversal CVE Capturing-NTLMv2-Hashes WinRM Credential-Dumping Pass-the-Hash

10 min read Nov 17, 2024

THM Year of the Owl Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Hard Windows SNMP OSINT NetExec WinRM SID-Recycle-Bin Credential-Dumping SAM-SYSTEM-Dump Pass-the-Hash

10 min read Nov 16, 2024

THM Steel Mountain Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Windows CVE PowerUp.ps1 CanRestart Weak-File-Permission Unquoted-Service-Path

17 min read Nov 10, 2024

HTB Chatterbox Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium AChat Buffer-Overflow Credentials-in-Registry Password-Reuse PsExec

8 min read Nov 9, 2024

HTB Return Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory Passback-LDAP-Attack LDAP Printer Server-Operators sc.exe Service-Restart

10 min read Nov 9, 2024

HTB Timelapse Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory SMB-Null-Session SMB-Shares .PFX WinRM-.pem PowerShell-History LDAP LDAP-Saved-Password

8 min read Nov 9, 2024

HTB ServMon Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy FTP CVE Path-Traversal Password-Spraying SSH Port-Forwarding .bat

7 min read Nov 9, 2024

HTB Sauna Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory AS-REP-Roasting BloodHound DCSync Pass-the-Hash

8 min read Nov 8, 2024

HTB Forest Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory RPC-Null-Session LDAP-Anonymous Username-Pattern AS-REP-Roasting BloodHound PowerView.ps1 ACLs GenericAll WriteDacl DCSync Pass-the-Hash

12 min read Nov 8, 2024

HTB Querier Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium SMB-Null-Session SMB-Shares MSSQL PowerUp.ps1 PsExec

7 min read Nov 8, 2024

HTB Jeeves Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium Jenkins Groovy-Reverse-Shell KeePass-.kdbx

7 min read Nov 6, 2024

HTB SecNotes Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium XSRF PHP-Reverse-Shell SMB-Shares Bash-History SMB-PsExec

18 min read Nov 3, 2024

HTB Blackfield Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Hard Active-Directory SMB-Null-Session SMB-Shares AS-REP-Roasting BloodHound RPC Credential-Dumping Pass-the-Hash

11 min read Nov 3, 2024

HTB Monteverde Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Weak-Credentials RPC-Null-Session Password-Spraying SMB-Shares Azure-AD-Connect

7 min read Nov 3, 2024

HTB Active Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory SMB-Null-Session SMB-Shares GPP-cPassword Kerberoasting

1 post tagged

Windows-Kernel-Exploit

4 min read Nov 19, 2024

THM Retro Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Hard Windows WordPress RDP Windows-Kernel-Exploit CVE

2 posts tagged

WordPress

4 min read Nov 19, 2024

THM Retro Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Hard Windows WordPress RDP Windows-Kernel-Exploit CVE

11 min read Nov 10, 2024

THM Mr Robot CTF Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Linux Medium WordPress Login-Brute-Force WP-Template-PHP-Reverse-Shell MD5-Hash Nmap-SUID

35 posts tagged

Write-ups

9 min read Nov 20, 2024

HTB Devvortex Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Vhost-Enumeration CVE Joomla MySQL Credentials-in-Database apport-cli

20 min read Nov 19, 2024

HTB Flight Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Hard Windows Active-Directory Vhost-Enumeration Domain-User-Enumeration AD-Password-Spraying Password-Reuse SMB-Share-Write-Permission-Abuse .ini Capturing-NTLMv2-Hashes-with-SMB-Server PHP-Reverse-Shell Chisel.exe Port-Forwarding RunasCs.exe RunasCs.exe-Reverse-Shell Microsoft-IIS cmdasp.aspx JuicyPotatoNG

8 min read Nov 19, 2024

THM Alfred Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Windows Jenkins Default-Credentials Groovy-Reverse-Shell Incognito.exe RDP rdesktop Alternative-Without-Metasploit

4 min read Nov 19, 2024

THM Retro Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Hard Windows WordPress RDP Windows-Kernel-Exploit CVE

4 min read Nov 18, 2024

HTB Access Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows FTP-Anonymous .mdb Telnet Stored-Credentials Runas.exe

4 min read Nov 18, 2024

HTB Arctic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows ColdFusion CVE Arbitrary-File-Upload JuicyPotato MSFVenom

11 min read Nov 18, 2024

HTB Mailing Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Easy Windows Path-Traversal CVE Capturing-NTLMv2-Hashes WinRM Credential-Dumping Pass-the-Hash

10 min read Nov 17, 2024

THM Year of the Owl Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Hard Windows SNMP OSINT NetExec WinRM SID-Recycle-Bin Credential-Dumping SAM-SYSTEM-Dump Pass-the-Hash

10 min read Nov 16, 2024

THM Steel Mountain Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Windows CVE PowerUp.ps1 CanRestart Weak-File-Permission Unquoted-Service-Path

12 min read Nov 15, 2024

THM Skynet Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux SMB-Null-Session Login-Brute-Force CVE RFI Tar-Wildcard-Expansion

7 min read Nov 14, 2024

HTB Sau Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy CVE

15 min read Nov 12, 2024

HTB Editorial Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Blind-SSRF Fuzzing API Git Git-Commit Python-Script CVE Command-Injection

6 min read Nov 12, 2024

THM UltraTech Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Medium Linux API Arbitrary-File-Read SSH GTFOBins-Shell Docker

8 min read Nov 12, 2024

THM Kenobi Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux SMB SMB-Null-Session RPC FTP Mount-NFS SSH SUID Linux-Relative-Path-Abuse

13 min read Nov 11, 2024

HTB Magic Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Medium SQL-Injection-Bypass File-Upload-Bypass Magic-Bytes PHP-Reverse-Shell BusyBox MySQL Port-Forwarding Credentials-in-DB-File SUID Relative-Path-Exploitation

11 min read Nov 11, 2024

THM Thompson Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Linux Tomcat WAR-Reverse-Shell Bash-Script Cron-Job Etc-Shadow SSH Create-id_rsa

19 min read Nov 10, 2024

THM SQL Injection Lab Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Web-Pentesting SQL-Injection Manual-SQL-Injection SQLMap

17 min read Nov 10, 2024

HTB Chatterbox Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium AChat Buffer-Overflow Credentials-in-Registry Password-Reuse PsExec

11 min read Nov 10, 2024

THM Mr Robot CTF Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Linux Medium WordPress Login-Brute-Force WP-Template-PHP-Reverse-Shell MD5-Hash Nmap-SUID

9 min read Nov 10, 2024

HTB Busqueda Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Searchor Git Gitea Password-Reuse SSH Docker Bash-Script Linux-Relative-Path-Abuse

8 min read Nov 9, 2024

HTB Return Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory Passback-LDAP-Attack LDAP Printer Server-Operators sc.exe Service-Restart

10 min read Nov 9, 2024

HTB Timelapse Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory SMB-Null-Session SMB-Shares .PFX WinRM-.pem PowerShell-History LDAP LDAP-Saved-Password

8 min read Nov 9, 2024

HTB ServMon Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy FTP CVE Path-Traversal Password-Spraying SSH Port-Forwarding .bat

8 min read Nov 9, 2024

HTB Builder Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Medium Jenkins CVE

7 min read Nov 9, 2024

HTB Sauna Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory AS-REP-Roasting BloodHound DCSync Pass-the-Hash

8 min read Nov 8, 2024

HTB Forest Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory RPC-Null-Session LDAP-Anonymous Username-Pattern AS-REP-Roasting BloodHound PowerView.ps1 ACLs GenericAll WriteDacl DCSync Pass-the-Hash

12 min read Nov 8, 2024

HTB Querier Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium SMB-Null-Session SMB-Shares MSSQL PowerUp.ps1 PsExec

7 min read Nov 8, 2024

HTB Jeeves Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium Jenkins Groovy-Reverse-Shell KeePass-.kdbx

13 min read Nov 7, 2024

HTB Pilgrimage Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Git CVE Arbitrary-File-Read pspy binwalk

7 min read Nov 6, 2024

HTB SecNotes Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium XSRF PHP-Reverse-Shell SMB-Shares Bash-History SMB-PsExec

12 min read Nov 5, 2024

HTB Sunday Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Unix Easy SSH-Brute-Force Shadow Sudo-l

7 min read Nov 4, 2024

HTB Nibbles Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy CVE PHP-Reverse-Shell Sudo-l Bash-Script Alternative-Without-Metasploit

18 min read Nov 3, 2024

HTB Blackfield Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Hard Active-Directory SMB-Null-Session SMB-Shares AS-REP-Roasting BloodHound RPC Credential-Dumping Pass-the-Hash

11 min read Nov 3, 2024

HTB Monteverde Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Weak-Credentials RPC-Null-Session Password-Spraying SMB-Shares Azure-AD-Connect

7 min read Nov 3, 2024

HTB Active Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory SMB-Null-Session SMB-Shares GPP-cPassword Kerberoasting

1 post tagged

WriteDacl

8 min read Nov 8, 2024

HTB Forest Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory RPC-Null-Session LDAP-Anonymous Username-Pattern AS-REP-Roasting BloodHound PowerView.ps1 ACLs GenericAll WriteDacl DCSync Pass-the-Hash

1 post tagged

XSRF

7 min read Nov 6, 2024

HTB SecNotes Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Medium XSRF PHP-Reverse-Shell SMB-Shares Bash-History SMB-PsExec

1 post tagged

apport-cli

9 min read Nov 20, 2024

HTB Devvortex Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Vhost-Enumeration CVE Joomla MySQL Credentials-in-Database apport-cli

1 post tagged

binwalk

13 min read Nov 7, 2024

HTB Pilgrimage Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Git CVE Arbitrary-File-Read pspy binwalk

1 post tagged

cmdasp.aspx

20 min read Nov 19, 2024

HTB Flight Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Hard Windows Active-Directory Vhost-Enumeration Domain-User-Enumeration AD-Password-Spraying Password-Reuse SMB-Share-Write-Permission-Abuse .ini Capturing-NTLMv2-Hashes-with-SMB-Server PHP-Reverse-Shell Chisel.exe Port-Forwarding RunasCs.exe RunasCs.exe-Reverse-Shell Microsoft-IIS cmdasp.aspx JuicyPotatoNG

1 post tagged

pspy

13 min read Nov 7, 2024

HTB Pilgrimage Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Linux Easy Git CVE Arbitrary-File-Read pspy binwalk

1 post tagged

rdesktop

8 min read Nov 19, 2024

THM Alfred Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups THM OSCP+ Easy Windows Jenkins Default-Credentials Groovy-Reverse-Shell Incognito.exe RDP rdesktop Alternative-Without-Metasploit

1 post tagged

sc.exe

8 min read Nov 9, 2024

HTB Return Write-up

Part of the OSCP+ Preparation Series

Vorkharium in Write-ups HTB OSCP+ Windows Easy Active-Directory Passback-LDAP-Attack LDAP Printer Server-Operators sc.exe Service-Restart