https://bstell.ing/ Recent content on bstell.ing Hugo en-us Wed, 16 Sep 2026 00:00:00 +0000 https://bstell.ing/writeups/certified/ Wed, 16 Sep 2026 00:00:00 +0000 https://bstell.ing/writeups/certified/ <p><em>A write-up of the HackTheBox machine &ldquo;Certified&rdquo;. This box revolves around a vulnerable certificate template that we can abuse to achieve Domain Admin privileges.</em></p> <h2 id="the-target">The target</h2> <p><em>[Placeholder: platform and machine name (HackTheBox &ldquo;Certified&rdquo;) and difficulty rating.]</em></p> <p>The host is a domain controller for <code>certified.htb</code>, and we are handed one working account, <code>judith.mader</code>. The objective is the built-in <code>Administrator</code>. In outline the path runs from that account, through ownership of a group, to a service account, and finally to the certificate authority, where a misconfigured template lets us issue ourselves a certificate in the Administrator&rsquo;s name.</p> https://bstell.ing/writeups/eighteen/ Wed, 16 Sep 2026 00:00:00 +0000 https://bstell.ing/writeups/eighteen/ <p><em>A write-up of the HackTheBox machine &ldquo;Eighteen&rdquo;. This box revolves around turning application password hashes into an Active Directory foothold, then looks at the dMSA privilege-escalation path that Windows Server 2025 introduced.</em></p> <h2 id="the-target">The target</h2> <p><em>[Placeholder: platform and machine name (HackTheBox &ldquo;Eighteen&rdquo;) and difficulty rating.]</em></p> <p>The host is a domain controller for <code>eighteen.htb</code> (<code>DC01</code>), and we are given one SQL Server login, <code>kevin</code>. Three TCP services are exposed: an IIS site on 80, SQL Server 2022 on 1433, and WinRM on 5985. DNS on 53/udp confirms the domain controller role. The path runs from the SQL login, through an application database and the password hashes stored in it, to a domain account reachable over WinRM, and from there toward a delegated managed service account (dMSA) escalation specific to Server 2025.</p>