User-Anarchy on kanyo's bloghttps://chaelsoo.me/tags/user-anarchy/Recent content in User-Anarchy on kanyo's blogHugo -- gohugo.ioen-gbMon, 01 Jun 2026 00:00:00 +0000HTB: Saunahttps://chaelsoo.me/writeups/htb-sauna/Mon, 01 Jun 2026 00:00:00 +0000https://chaelsoo.me/writeups/htb-sauna/<p>Windows AD box, no credentials given. The website is running for a fictional bank called Egotistical Bank, and it&rsquo;s the only initial foothold surface. What makes this box interesting is the AS-REP roasting step, a technique that often gets lumped in with Kerberoasting in tool menus, but the mechanism is completely different and worth understanding on its own. The escalation is clean: Winlogon autologon keys exposing a service account, that service account having DCSync rights.</p>