• 

  HTB: Puppy

  Puppy is a medium Windows machine. This is a grey box machine with a supplied credential. With the credential, we can take advantage of GenericWrite to get access to specific shares. Then, we found a KeePass database file that contains a valid credential for another user account. This user account has GenericAll to another user account that belongs to the Remote Management Users group. There will be a backup file that contains another credential inside the machine. Using the credential, we found a saved credential in the DPAPI that contains a credential for administrative user account.

  4404Gh0st

  May 30, 2025

  8 min read

  WindowsMediumGenericWriteGenericAllDPAPI
• 

  HTB: Vintage

  Vintage is a challenging Active Directory machine characterized by disabled NTLM authentication, enabled antivirus protection, and complex security configurations. The machine involves exploiting a Pre-2000 computer account, leveraging multiple ACL/ACE vulnerabilities, decrypting Data Protection API (DPAPI) secrets, and manipulating Resource-Based Constrained Delegation.

  4404Gh0st

  January 15, 2025

  12 min read

  WindowsHardActive DirectoryPre2KKerberosDPAPIGenericWriteGenericAllTargeted ASREProastingRBCD