- HTB: Certified · from WriteOwner to Domain Admin by chaining ACLs, Shadow Credentials and ESC9
hacktheboxactive-directorywindowsadcsprivilege-escalationcertipybloodhound
- HTB: Cascade · from an anonymous LDAP dump to Domain Admin via the AD Recycle Bin
hacktheboxactive-directorywindowsprivilege-escalationreverse-engineeringvnc
- HTB: Previse · from a broken PHP redirect to root via command injection
hacktheboxlinuxwebprivilege-escalationcommand-injectionbroken-access-control
- HTB: Monteverde · leaked Azure AD Connect credentials to Domain Admin
hacktheboxactive-directorywindowsprivilege-escalationazure-ad-connectpassword-spraying
- HTB: Resolute · from anonymous RPC to Domain Admin via DnsAdmins
hacktheboxactive-directorywindowsprivilege-escalationdnsadmins
- HTB: Sauna · AS-REP Roasting to DCSync on a read-only foothold
hacktheboxactive-directorywindowsprivilege-escalationasreproastdcsync