YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 14 · 13 min readHackTheBox : Sweep WriteupSummary Sweep is an Active Directory box built around a self-hosted Lansweeper instance (an IT asset-management platform). The box is a good example of how Lansweeper's own scanning and deployment fea00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 10 · 35 min readHackTheBox: Phantom WriteupExecutive Summary Phantom is an Active Directory box where the entire path from unauthenticated guest to Domain Admin comes down to credential reuse and secrets sitting in accessible file shares. Ther00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jun 24 · 7 min readHackTheBox: Baby WriteupSummary Baby is an Easy Windows AD box (baby.vl, DC: BABYDC). Null LDAP bind enumerates the full domain user list, including a description field that leaks a default password (BabyStart123!) for newly00
WMWilliam Mainwillsec.hashnode.dev·Sep 6, 2024 · 3 min readHTB Notes: FunnelFTP We begin by scanning the box with nmap. We find two ports open on the machine: 21 (ftp) and 22 (ssh) We can access the ftp server using the anonymous user account. An interesting note is we could use either the anonymous or ftp user and we co...00
JGJames Gallagherinjamesonhacking.hashnode.dev·Mar 15, 2023 · 5 min readDefeating Rate Limiting with FireproxI've been using fireprox to defeat rate limiting with great success. This tool sets up a pass-through-proxy in AWS API Gateway which is mapped to a specific target URL. It allows an attacker to rotate their egress IP address between hundreds of egres...00
