HTB: Voleur

Sun, 07 Jun 2026 00:00:00 +0000

Windows AD box where NTLM authentication is completely disabled. That single constraint changes everything about how you operate: no pass-the-hash, no NTLM relay, every tool needs a TGT and Kerberos must be properly configured. The box hands you starting credentials upfront but then makes you earn the rest through a chain that’s worth understanding. A spreadsheet locked in an SMB share leaks passwords for accounts you can’t use yet. A service account with WriteSPN lets you kerberoast your way to WinRM. A group called Restore_Users hints at a deleted employee. And once you bring that employee back from tombstone, his archived DPAPI blobs hand you the next account’s credentials without any cracking at all.

HackINI 2026: Shell-DC

Tue, 26 May 2026 00:00:00 +0000

This was the most satisfying machine in the chain. A full Active Directory environment, ad.shell.local on Windows Server 2019, with a deliberate series of layered misconfigurations that build on each other. You start with a regular domain user and work your way through Kerberoasting, a BloodHound ACL chain, Shadow Credentials, gMSA password abuse, and finally tombstone reanimation to reach Domain Admin.

Solved this one together with Aymen. We spent the better part of a day working through this chain side by side, and a lot of what made it click came from having someone just as deep in it to think out loud with. Big shoutout to him.

Kerberoasting on kanyo's blog

HTB: Voleur

HackINI 2026: Shell-DC