https://chaelsoo.me/tags/tombstone-reanimation/Recent content in Tombstone-Reanimation on kanyo's blogHugo -- gohugo.ioen-gbTue, 26 May 2026 00:00:00 +0000https://chaelsoo.me/writeups/hackini-shell-dc/Tue, 26 May 2026 00:00:00 +0000https://chaelsoo.me/writeups/hackini-shell-dc/<p>This was the most satisfying machine in the chain. A full Active Directory environment, <code>ad.shell.local</code> on Windows Server 2019, with a deliberate series of layered misconfigurations that build on each other. You start with a regular domain user and work your way through Kerberoasting, a BloodHound ACL chain, Shadow Credentials, gMSA password abuse, and finally tombstone reanimation to reach Domain Admin.</p> <p><em>Solved this one together with <a href="https://www.linkedin.com/in/aymen-drid-36bba4243/">Aymen</a>. We spent the better part of a day working through this chain side by side, and a lot of what made it click came from having someone just as deep in it to think out loud with. Big shoutout to him.</em></p>