https://chaelsoo.me/tags/ntlm-coercion/Recent content in Ntlm-Coercion on kanyo's blogHugo -- gohugo.ioen-gbMon, 15 Jun 2026 00:00:00 +0000https://chaelsoo.me/writeups/htb-flight/Mon, 15 Jun 2026 00:00:00 +0000https://chaelsoo.me/writeups/htb-flight/<p><img src="https://chaelsoo.me/images/writeups/htb-flight/flight-pwned.png" alt="Flight has been Pwned by kanyo - 15 Jun 2026, 850 XP"></p> <p>There&rsquo;s something satisfying about a box that commits to a theme. Flight runs NTLM coercion twice, through two completely different surfaces, and neither of them is the obvious one. The first is a PHP <code>?view=</code> parameter that looks like a boring LFI. The second is a shared network folder that users actually browse to. Same technique, different packaging. Once you understand why the first one works, the second one clicks immediately.</p>