HTB: Voleur

Sun, 07 Jun 2026 00:00:00 +0000

Windows AD box where NTLM authentication is completely disabled. That single constraint changes everything about how you operate: no pass-the-hash, no NTLM relay, every tool needs a TGT and Kerberos must be properly configured. The box hands you starting credentials upfront but then makes you earn the rest through a chain that’s worth understanding. A spreadsheet locked in an SMB share leaks passwords for accounts you can’t use yet. A service account with WriteSPN lets you kerberoast your way to WinRM. A group called Restore_Users hints at a deleted employee. And once you bring that employee back from tombstone, his archived DPAPI blobs hand you the next account’s credentials without any cracking at all.

HTB: TombWatcher

Sat, 06 Jun 2026 00:00:00 +0000

Windows AD box with starting credentials. The box name is a hint you’ll miss until it isn’t. The first half is a clean BloodHound chain: five ACL hops from henry to john, each one mechanical. The second half is what makes this box worth remembering. John has a right most people have never used, Reanimate-Tombstones, and the ADCS OU he controls looks empty until you remember that AD doesn’t actually delete objects immediately. The cert_admin account sitting in the deleted objects container has enrollment rights on a schema version 1 template, which is all you need for ESC15.

Reanimate-Tombstone on kanyo's blog

HTB: Voleur

HTB: TombWatcher