Domain Security

HTB: Certified · from WriteOwner to Domain Admin by chaining ACLs, Shadow Credentials and ESC9

Sat, 12 Sep 2026 00:00:00 +0000

An assumed-breach box with not a single software vulnerability in sight: the whole domain falls through five badly delegated permissions and one certificate template missing a security extension, chained together to turn an ordinary user into Domain Administrator.

HTB: Cascade · from an anonymous LDAP dump to Domain Admin via the AD Recycle Bin

Fri, 11 Sep 2026 00:00:00 +0000

A retired medium Windows Domain Controller where a custom, non-standard LDAP attribute leaks a working credential to anyone unauthenticated, and the trail that follows through a VNC config and a homemade audit tool ends with a deleted admin-equivalent account still sitting in the AD Recycle Bin.

HTB: Previse · from a broken PHP redirect to root via command injection

Fri, 11 Sep 2026 00:00:00 +0000

A retired easy Linux box built entirely around one PHP habit gone wrong: a missing exit() after a login redirect lets an unauthenticated user create an account, source code recovered from an exposed backup reveals a textbook command injection, and a sudo script calling gzip without an absolute path hands over root.

HTB: Monteverde · leaked Azure AD Connect credentials to Domain Admin

Thu, 10 Sep 2026 00:00:00 +0000

A retired medium Windows Domain Controller where a leaked Azure AD sync credential in a home share gives a foothold, and a locally installed Azure AD Connect instance turns out to store the Domain Administrator’s password in a decryptable local database.

HTB: Resolute · from anonymous RPC to Domain Admin via DnsAdmins

Thu, 10 Sep 2026 00:00:00 +0000

A retired medium Windows box that chains together the four most common ways real Active Directory environments leak: anonymous RPC enumeration, a password left in a user description, credential reuse, and a plaintext password in a PowerShell transcript, ending in a SYSTEM shell through the DnsAdmins group.

HTB: Sauna · AS-REP Roasting to DCSync on a read-only foothold

Thu, 10 Sep 2026 00:00:00 +0000

A retired easy Windows box where the whole chain grows out of a corporate website: employee names become usernames, one account has Kerberos pre-authentication disabled, and an autologon password in the registry leads to a DCSync and full domain compromise.

About

Mon, 01 Jan 0001 00:00:00 +0000

How I got here

I do not come from a computer science degree or a master’s. I arrived at security the long way round, which is breaking things at home, working out why they broke, and putting them back together better. Everything I know comes from reading documentation, building labs, and getting it wrong plenty of times in private before touching anything that mattered.

Being self taught has one obvious problem: nobody signs a piece of paper saying you can do the job. The answer I settled on is to publish the work. If someone wants to know whether I can move through a Windows domain, they do not have to take my word for it, they can read a full writeup and judge for themselves.

Contact

Mon, 01 Jan 0001 00:00:00 +0000

Email domsec@keemail.me LinkedIn GitHub

What to tell me

You do not need to know what you need, that is my job. This gives me a good picture from the first email:

What the business does and how many people work with computers.
What you have running, even roughly: your own servers, a Windows domain, several sites, point of sale, cameras, guest WiFi.
What specifically worries you, or whether it is a general review because nobody has ever done one.
Any dates or constraints, for example that nothing can be touched during peak season.

I reply within a couple of working days. If what you need is not what I do, I will say so, and if I know someone better suited I will point you to them.

Legal notice and privacy

Mon, 01 Jan 0001 00:00:00 +0000

Site owner

This website belongs to Álvaro Irún, who publishes and maintains it in a personal capacity from Spain.

Portfolio

Mon, 01 Jan 0001 00:00:00 +0000

Intrusion writeups

Complete solutions for retired Hack The Box machines, start to finish: reconnaissance, initial access, lateral movement and escalation to full control. They include the commands, the reasoning behind each decision, and the attempts that failed, which are usually the most useful part.

Most of them are Windows environments with Active Directory, which is where I am focusing my specialisation, and there are Linux machines too.

HTB: Certified · from WriteOwner to Domain Admin by chaining ACLs, Shadow Credentials and ESC9
hacktheboxactive-directorywindowsadcsprivilege-escalationcertipybloodhound 12 Sep 2026
HTB: Cascade · from an anonymous LDAP dump to Domain Admin via the AD Recycle Bin
hacktheboxactive-directorywindowsprivilege-escalationreverse-engineeringvnc 11 Sep 2026
HTB: Previse · from a broken PHP redirect to root via command injection
hacktheboxlinuxwebprivilege-escalationcommand-injectionbroken-access-control 11 Sep 2026
HTB: Monteverde · leaked Azure AD Connect credentials to Domain Admin
hacktheboxactive-directorywindowsprivilege-escalationazure-ad-connectpassword-spraying 10 Sep 2026
HTB: Resolute · from anonymous RPC to Domain Admin via DnsAdmins
hacktheboxactive-directorywindowsprivilege-escalationdnsadmins 10 Sep 2026

See all writeups

Services

Mon, 01 Jan 0001 00:00:00 +0000

Security audit for small businesses

The most complete engagement, and the natural starting point if you have never had a security review. It combines real offensive testing with a defensive configuration review, because each one finds things the other cannot.

A methodology on two fronts

Offensive, black box. I start with no prior information about your infrastructure and simulate specific attacker positions rather than generic ones: someone connected to the guest WiFi, an office machine that has been compromised, or someone on the internet who can only see what you expose. From each of those positions I get as far as I can and document the exact path.