Hackini on kanyo's blog

HackINI 2026: Corp Monitor

Tue, 26 May 2026 00:00:00 +0000

A Linux machine running a Drupal intranet CMS with an anonymous FTP server sitting next to it. The FTP turned out to be more of a hint than an attack surface. The real entry was Drupalgeddon2, a 2018 RCE that still shows up everywhere. Once inside, Grafana 8.2.6 was hiding on port 3000, running an unauthenticated path traversal that handed over root’s SSH key directly.

Did this one with Aymen. Always more fun when someone’s hunting alongside you and just as locked in. Big shoutout to him.

HackINI 2026: IT Workstation

Tue, 26 May 2026 00:00:00 +0000

The second machine in the chain. A Windows workstation with WinRM exposed and nothing else obviously interesting until you’re inside. Autologon credentials stored in plaintext in the registry handed over local Administrator, then Mimikatz pulled a cleartext domain password out of Credential Manager. That opened the door to the Active Directory machine.

Ran through this one with Aymen. Two people piecing together a chain like this makes a real difference: every dead end gets shorter when someone’s right there with you. Big shoutout to him.

HackINI 2026: Legacy

Tue, 26 May 2026 00:00:00 +0000

The fourth machine in the chain. A Linux server running two web services on non-standard ports. One was an older Anuko Time Tracker instance with a known SQL injection CVE, the other was a Webmin panel that opened up once you had the right credentials. The interesting part here was that this machine didn’t require brute-forcing or clever guessing: the credentials came from earlier in the chain, and the exploit path came from recognizing the software version and knowing where to look.

HackINI 2026: Shell-DC

Tue, 26 May 2026 00:00:00 +0000

This was the most satisfying machine in the chain. A full Active Directory environment, ad.shell.local on Windows Server 2019, with a deliberate series of layered misconfigurations that build on each other. You start with a regular domain user and work your way through Kerberoasting, a BloodHound ACL chain, Shadow Credentials, gMSA password abuse, and finally tombstone reanimation to reach Domain Admin.

Solved this one together with Aymen. We spent the better part of a day working through this chain side by side, and a lot of what made it click came from having someone just as deep in it to think out loud with. Big shoutout to him.