HTB: StreamIO

Wed, 03 Jun 2026 00:00:00 +0000

Windows AD box with a PHP streaming site on HTTPS. The attack chain is unusually web-heavy for an HTB Active Directory box: you spend more time in Burp than in evil-winrm before the domain even becomes relevant. The interesting part isn’t any single vulnerability. It’s how a SQL injection on one subdomain eventually feeds into an eval() backdoor on another, and how Firefox’s credential store hands over an AD account with a path nobody mentions until you look at it in BloodHound.

Rfi on kanyo's blog

HTB: StreamIO