https://domainsecurity.agency/posts/Recent content in Posts on Domain SecurityHugoenSat, 12 Sep 2026 00:00:00 +0000https://domainsecurity.agency/posts/htb-certified/Sat, 12 Sep 2026 00:00:00 +0000https://domainsecurity.agency/posts/htb-certified/An assumed-breach box with not a single software vulnerability in sight: the whole domain falls through five badly delegated permissions and one certificate template missing a security extension, chained together to turn an ordinary user into Domain Administrator.https://domainsecurity.agency/posts/htb-cascade/Fri, 11 Sep 2026 00:00:00 +0000https://domainsecurity.agency/posts/htb-cascade/A retired medium Windows Domain Controller where a custom, non-standard LDAP attribute leaks a working credential to anyone unauthenticated, and the trail that follows through a VNC config and a homemade audit tool ends with a deleted admin-equivalent account still sitting in the AD Recycle Bin.https://domainsecurity.agency/posts/htb-previse/Fri, 11 Sep 2026 00:00:00 +0000https://domainsecurity.agency/posts/htb-previse/A retired easy Linux box built entirely around one PHP habit gone wrong: a missing exit() after a login redirect lets an unauthenticated user create an account, source code recovered from an exposed backup reveals a textbook command injection, and a sudo script calling gzip without an absolute path hands over root.https://domainsecurity.agency/posts/htb-monteverde/Thu, 10 Sep 2026 00:00:00 +0000https://domainsecurity.agency/posts/htb-monteverde/A retired medium Windows Domain Controller where a leaked Azure AD sync credential in a home share gives a foothold, and a locally installed Azure AD Connect instance turns out to store the Domain Administrator’s password in a decryptable local database.https://domainsecurity.agency/posts/htb-resolute/Thu, 10 Sep 2026 00:00:00 +0000https://domainsecurity.agency/posts/htb-resolute/A retired medium Windows box that chains together the four most common ways real Active Directory environments leak: anonymous RPC enumeration, a password left in a user description, credential reuse, and a plaintext password in a PowerShell transcript, ending in a SYSTEM shell through the DnsAdmins group.https://domainsecurity.agency/posts/htb-sauna/Thu, 10 Sep 2026 00:00:00 +0000https://domainsecurity.agency/posts/htb-sauna/A retired easy Windows box where the whole chain grows out of a corporate website: employee names become usernames, one account has Kerberos pre-authentication disabled, and an autologon password in the registry leads to a DCSync and full domain compromise.