HTB: VulnCicada

Tue, 09 Jun 2026 00:00:00 +0000

This one genuinely surprised me at almost every step. The entry was a photo on an NFS share with a password on a sticky note, an Easy-box trick on what turns out to be a Medium machine. Then the environment punches back: NTLM is disabled domain-wide, so every standard relay tool, every classic pass-the-hash shortcut, just bounces. The ADCS scan comes back with ESC8, web enrollment over HTTP. Normally that’s an NTLM relay to certsrv. Without NTLM it looks dead. But “NTLM is disabled” doesn’t mean relay attacks are impossible. It means you have to do it with Kerberos instead, which is a completely different mechanism that’s conceptually harder to grasp. You control the DNS name, so you control the SPN the DC requests a ticket for, so you can be the legitimate endpoint that ticket was meant for and turn around and use it at certsrv. I didn’t know this was even a thing before this box. Tons of learning, exactly what a good Medium should feel like.

HTB: Voleur

Sun, 07 Jun 2026 00:00:00 +0000

Windows AD box where NTLM authentication is completely disabled. That single constraint changes everything about how you operate: no pass-the-hash, no NTLM relay, every tool needs a TGT and Kerberos must be properly configured. The box hands you starting credentials upfront but then makes you earn the rest through a chain that’s worth understanding. A spreadsheet locked in an SMB share leaks passwords for accounts you can’t use yet. A service account with WriteSPN lets you kerberoast your way to WinRM. A group called Restore_Users hints at a deleted employee. And once you bring that employee back from tombstone, his archived DPAPI blobs hand you the next account’s credentials without any cracking at all.

Ntlm-Disabled on kanyo's blog

HTB: VulnCicada

HTB: Voleur