https://blog.disruption-academy.com/ Security research, exploit development, and technical write-ups covering various aspects of offensive security and penetration testing. en Mon, 10 Aug 2026 07:26:48 GMT https://blog.disruption-academy.com/blog/defcon-sg-range-village https://blog.disruption-academy.com/blog/defcon-sg-range-village Sun, 09 Aug 2026 00:00:00 GMT Active Directory A walkthrough of async.sg's Range Village at DEF CON Singapore - a 12-flag Active Directory range spanning a child domain, its parent, and a separate trusted forest. The path covers sudo and Polkit misconfigurations on a Linux jump host, NTLM relaying, Kerberoasting, SSTI-to-RCE on an internal web app, local privilege escalation via GodPotato, S4U2self abuse, cross-domain compromise through DCSync and inter-realm ticket capture, and ADCS template abuse in a third domain. https://blog.disruption-academy.com/blog/direct-syscalls https://blog.disruption-academy.com/blog/direct-syscalls Mon, 27 Jul 2026 00:00:00 GMT Windows Internals Malware Development Direct syscalls bypass user-mode API hooks by invoking Windows system calls directly from user space. This technique retrieves syscall numbers (SSNs) from ntdll.dll, assembles raw syscall stubs, and calls them directly, defeating EDR hooks that monitor hooked NT functions. https://blog.disruption-academy.com/blog/ronin-mask https://blog.disruption-academy.com/blog/ronin-mask Sat, 25 Jul 2026 00:00:00 GMT Ronin Easy Linux Chaining the Next.js CVE-2025-29927 middleware bypass to leak the app config and read files by path traversal, stealing jim's SSH key for a foothold, then a symlink through a root sudo cat rule to dump /etc/shadow and crack root. https://blog.disruption-academy.com/blog/ronin-recovery https://blog.disruption-academy.com/blog/ronin-recovery Sat, 25 Jul 2026 00:00:00 GMT Ronin Hard Windows Active Directory Null-bind LDAP/RPC leaks a description-field password, and a BloodHound-mapped chain - spray to j.ortega, shadow credentials on s.connery, a strings password from mount.exe, a WriteSPN kerberoast, then GenericAll on the DC - lands a DC01$ DCSync for Administrator. https://blog.disruption-academy.com/blog/ancpi-breach-en https://blog.disruption-academy.com/blog/ancpi-breach-en Sat, 18 Jul 2026 00:00:00 GMT Investigation An investigation into the July 2026 breach of ANCPI, Romania's national cadastre and land-registry agency, by the threat actor bytetobreach. It reconstructs the full attack chain from a ForgeRock OpenAM RCE to near-total domain compromise, weighs the evidence against the agency's public denials, profiles the actor, and closes with an exhaustive set of remediation recommendations. https://blog.disruption-academy.com/blog/ancpi-breach-ro https://blog.disruption-academy.com/blog/ancpi-breach-ro Sat, 18 Jul 2026 00:00:00 GMT Investigation O analiză a breșei din iulie 2026 suferite de ANCPI, agenția națională de cadastru și publicitate imobiliară, provocată de actorul bytetobreach. Reconstituie întregul lanț de atac, de la un RCE în ForgeRock OpenAM până la compromiterea aproape totală a domeniului, compară dovezile cu negările publice ale instituției, creionează profilul atacatorului și se încheie cu un set exhaustiv de recomandări de remediere. https://blog.disruption-academy.com/blog/hsm-shadowgate2 https://blog.disruption-academy.com/blog/hsm-shadowgate2 Thu, 16 Jul 2026 00:00:00 GMT HackSmarter Medium Windows Active Directory A medium Active Directory box that uncovers a hidden dev subdomain, bypasses its SQL login to plant NTLMv2-theft files and crack a reviewer's hash, walks a chain of ForceChangePassword, WriteOwner and GenericAll edges through MSSQL impersonation and a logonHours bypass, revives a deleted account from the AD Recycle Bin, and abuses AD CS ESC3 to authenticate as Administrator. https://blog.disruption-academy.com/blog/hsm-slayer https://blog.disruption-academy.com/blog/hsm-slayer Sat, 04 Jul 2026 00:00:00 GMT HackSmarter Easy Windows An easy standalone Windows box where phished user credentials lead to RDP access, an administrator password left behind in PowerShell history offers an unintended shortcut to full compromise, and the intended path abuses a weak service permission on SysMgmtAgent to rewrite its binPath and join the local Administrators group. https://blog.disruption-academy.com/blog/hsm-edge https://blog.disruption-academy.com/blog/hsm-edge Fri, 03 Jul 2026 00:00:00 GMT HackSmarter Easy Windows An easy Windows box that reuses assumed-breach credentials into a WinRM shell, dumps in-memory Microsoft Edge passwords to recover a VDI service account, breaks out of an RDP kiosk through a browser file download to spawn a shell, and loots a PuTTY config holding local administrator credentials. https://blog.disruption-academy.com/blog/just-enough-administration-jea https://blog.disruption-academy.com/blog/just-enough-administration-jea Fri, 03 Jul 2026 00:00:00 GMT Windows Windows Internals A deep dive into PowerShell Just Enough Administration (JEA) from an attacker's perspective - how JEA endpoints work, why their run-as accounts are high-value, how to enumerate and detect a constrained endpoint, and the full range of breakout techniques from dangerous cmdlets and language-mode abuse to output-stream exfiltration and session-configuration backdoors. https://blog.disruption-academy.com/blog/kiosk-breakout-cheatsheet https://blog.disruption-academy.com/blog/kiosk-breakout-cheatsheet Fri, 03 Jul 2026 00:00:00 GMT Windows Cheatsheet A consolidated kiosk and restricted-desktop breakout cheatsheet covering Windows, Citrix, RDP/VDI and iPad. Command execution, dialog-box pivots, path-restriction bypasses, browser tricks, alternative execution, file transfer, credential hunting and privilege escalation, all in one reference. https://blog.disruption-academy.com/blog/hsm-404bank https://blog.disruption-academy.com/blog/hsm-404bank Thu, 02 Jul 2026 00:00:00 GMT HackSmarter Medium Windows Active Directory A medium Active Directory box that decodes a hardcoded hash from a fake banking binary for a foothold, walks an ACL chain of ForceChangePassword and Shadow Credentials edges to loot credentials, pivots through ligolo to an internal admin app, re-enables a disabled service account, and abuses an AD CS ESC4 template to impersonate the Administrator. https://blog.disruption-academy.com/blog/hsm-triathlon https://blog.disruption-academy.com/blog/hsm-triathlon Thu, 02 Jul 2026 00:00:00 GMT HackSmarter Hard Windows Active Directory A hard three-host Active Directory box that builds a user list from real-world OSINT, chains AS-REP Roasting and Kerberoasting without pre-authentication for a foothold, relays a coerced NTLM hash across servers lacking SMB signing, cracks a cached domain credential, and forges a Golden Certificate from the compromised CA to DCSync the krbtgt hash. https://blog.disruption-academy.com/blog/hsm-dismay https://blog.disruption-academy.com/blog/hsm-dismay Wed, 01 Jul 2026 00:00:00 GMT HackSmarter Medium Windows Active Directory A medium three-host Active Directory box that pivots through a standalone WSUS server to loot credentials from Recycle Bin documents and a password-protected archive, chains ForceChangePassword and GenericAll edges across several users, and relays a coerced domain controller through AD CS ESC8 to DCSync the Administrator hash. https://blog.disruption-academy.com/blog/hsm-arasaka https://blog.disruption-academy.com/blog/hsm-arasaka Mon, 29 Jun 2026 00:00:00 GMT HackSmarter Easy Windows Active Directory An easy Active Directory box that Kerberoasts a service account, chains GenericAll and GenericWrite edges to reset a user and run a Shadow Credentials attack, then abuses an AD CS ESC1 template to impersonate a Domain Admin and recover its NT hash for a WinRM shell. https://blog.disruption-academy.com/blog/hsm-martiniad https://blog.disruption-academy.com/blog/hsm-martiniad Mon, 29 Jun 2026 00:00:00 GMT HackSmarter Easy Windows Active Directory An easy Active Directory box that starts with anonymous SMB access leaking a set of credentials, moves through LDAP signing restrictions and offline hash cracking to a WinRM foothold, and finishes by spotting password reuse between a service account and a Domain Admin to dump the krbtgt hash from NTDS. https://blog.disruption-academy.com/blog/hsm-past https://blog.disruption-academy.com/blog/hsm-past Mon, 29 Jun 2026 00:00:00 GMT HackSmarter Medium Windows Active Directory A medium Active Directory box that pivots from a Guest-readable share through a Timeroasting attack to take over a machine account, loots cleartext credentials from SYSVOL, bypasses an NTLM account restriction with Kerberos, and abuses a GenericAll edge over the domain controller to DCSync the domain. https://blog.disruption-academy.com/blog/hsm-shadowgate https://blog.disruption-academy.com/blog/hsm-shadowgate Mon, 29 Jun 2026 00:00:00 GMT HackSmarter Easy Windows Active Directory An easy Active Directory box that enumerates users over anonymous RPC, gains a foothold through AS-REP Roasting and offline cracking, abuses a GenericWrite edge with a Shadow Credentials attack to take over a second account, and chains AD CS ESC8 to compromise the domain controller and DCSync the krbtgt hash. https://blog.disruption-academy.com/blog/hsm-welcome https://blog.disruption-academy.com/blog/hsm-welcome Mon, 29 Jun 2026 00:00:00 GMT HackSmarter Easy Windows Active Directory An easy Active Directory box that cracks a password-protected PDF to recover a temporary password, pivots through a GenericAll edge to reset a chain of service accounts, and abuses an AD CS ESC1 template to impersonate the Domain Admin and recover its NT hash. https://blog.disruption-academy.com/blog/htb-haze https://blog.disruption-academy.com/blog/htb-haze Fri, 26 Jun 2026 00:00:00 GMT HackTheBox Hard Windows Active Directory Haze is a hard difficulty Windows machine focused on web exploitation, domain abuse, and Windows privilege escalation. Initial access is gained by exploiting a Splunk Arbitrary File Read (CVE-2024-36991) to extract an LDAP bind password, which is then decrypted using splunk.secret. With valid credentials, a BloodHound scan reveals further accounts, and password spraying provides access to a user with GMSA management rights. This allows abuse of the PrincipalsAllowedToRetrieveManagedPassword property to dump hashes and pivot into a privileged service account. Using Shadow Credentials, access is escalated to another user. Backup files expose more credentials, eventually giving admin access to Splunk. Finally, a custom app upload enables a reverse shell, and SeImpersonatePrivilege is abused to impersonate SYSTEM, completing the escalation chain. https://blog.disruption-academy.com/blog/htb-overwatch https://blog.disruption-academy.com/blog/htb-overwatch Wed, 24 Jun 2026 00:00:00 GMT HackTheBox Medium Windows Active Directory Overwatch is a medium-difficulty Windows machine focused on Active Directory enumeration, MSSQL abuse, and insecure .NET application development. Initial access is obtained through an anonymously accessible SMB share containing a custom .NET monitoring application, from which hardcoded MSSQL credentials are recovered. Further enumeration reveals a linked server configuration that can be abused through malicious DNS record injection to coerce MSSQL authentication and capture additional credentials using Responder, ultimately leading to WinRM access. For privilege escalation, the monitoring application is reverse-engineered, revealing a SOAP-based service vulnerable to PowerShell command injection, allowing arbitrary command execution as NT AUTHORITY\\SYSTEM. https://blog.disruption-academy.com/blog/htb-sweep https://blog.disruption-academy.com/blog/htb-sweep Wed, 24 Jun 2026 00:00:00 GMT HackTheBox Medium Windows Active Directory Sweep is a medium difficulty Windows box that involves Active Directory and Lansweeper, a technology asset intelligence tool. The attacker abuses an enabled guest account to gain access to Lansweeper, which has Map Credentials configured, which are login/password combinations for accessing and scanning network assets remotely. The attacker deploys a honeypot SSH server to read the configured credentials. The compromised account is a member of the Lansweeper Discovery group, which has GenericAll ACL over the Lansweeper Admins group. Any account member of the Lansweeper Admins group has administrator privileges on the Lansweeper dashboard. The attacker creates and deploys a package on the Domain Controller to gain complete control. https://blog.disruption-academy.com/blog/htb-scrambled https://blog.disruption-academy.com/blog/htb-scrambled Tue, 23 Jun 2026 00:00:00 GMT HackTheBox Medium Windows Active Directory Scrambled is a medium Windows Active Directory machine. Enumerating the website hosted on the remote machine a potential attacker is able to deduce the credentials for the user ksimpson. On the website, it is also stated that NTLM authentication is disabled meaning that Kerberos authentication is to be used. Accessing the Public share with the credentials of ksimpson, a PDF file states that an attacker retrieved the credentials of an SQL database. This is a hint that there is an SQL service running on the remote machine. Enumerating the normal user accounts, it is found that the account SqlSvc has a Service Principal Name (SPN) associated with it. An attacker can use this information to perform an attack that is knows as kerberoasting and get the hash of SqlSvc. After cracking the hash and acquiring the credentials for the SqlSvc account an attacker can perform a silver ticket attack to forge a ticket and impersonate the user Administrator on the remote MSSQL service. Enumeration of the database reveals the credentials for user MiscSvc, which can be used to execute code on the remote machine using PowerShell remoting. System enumeration as the new user reveals a .NET application, which is listening on port 4411. Reverse engineering the application reveals that it is using the insecure Binary Formatter class to transmit data, allowing the attacker to upload their own payload and get code execution as nt authority\system. https://blog.disruption-academy.com/blog/htb-streamio https://blog.disruption-academy.com/blog/htb-streamio Mon, 22 Jun 2026 00:00:00 GMT HackTheBox Medium Windows Active Directory StreamIO is a medium machine that covers subdomain enumeration leading to an SQL injection in order to retrieve stored user credentials, which are cracked to gain access to an administration panel. The administration panel is vulnerable to LFI, which allows us to retrieve the source code for the administration pages and leads to identifying a remote file inclusion vulnerability, the abuse of which gains us access to the system. After the initial shell we leverage the SQLCMD command line utility to enumerate databases and obtain further credentials used in lateral movement. As the secondary user we use WinPEAS to enumerate the system and find saved browser databases, which are decoded to expose new credentials. Using the new credentials within BloodHound we discover that the user has the ability to add themselves to a specific group in which they can read LDAP secrets. Without direct access to the account we use PowerShell to abuse this feature and add ourselves to the Core Staff group, then access LDAP to disclose the administrator LAPS password. https://blog.disruption-academy.com/blog/beacon-object-file https://blog.disruption-academy.com/blog/beacon-object-file Sat, 20 Jun 2026 00:00:00 GMT Malware Development Windows Internals A complete guide to Beacon Object Files - starting from what they are and why they exist, through writing your first BOF, mastering Dynamic Function Resolution, all the way to advanced evasion techniques like AMSI patching, ETW bypasses, and NTDLL unhooking. https://blog.disruption-academy.com/blog/windbg-red-teamers-practical-guide https://blog.disruption-academy.com/blog/windbg-red-teamers-practical-guide Sat, 20 Jun 2026 00:00:00 GMT Windows Internals Red Team A practical guide to WinDbg from a red team perspective - covering essential commands, process inspection, live EDR hook detection, IAT analysis, and step-by-step investigation workflows for identifying what a security product is watching inside your process. https://blog.disruption-academy.com/blog/dll-proxing https://blog.disruption-academy.com/blog/dll-proxing Tue, 16 Jun 2026 00:00:00 GMT Malware Development Windows Internals A practical walkthrough of DLL proxying - finding hijackable DLLs with Process Monitor, enumerating exports, building a proxy DLL that forwards every legitimate call to the original while executing your payload, and deploying it against a real application. https://blog.disruption-academy.com/blog/pe-peb-and-teb-exploration https://blog.disruption-academy.com/blog/pe-peb-and-teb-exploration Mon, 15 Jun 2026 00:00:00 GMT Windows Internals Malware Development A deep dive into the Portable Executable format, the Process Environment Block and the Thread Environment Block - the three fundamental Windows structures every malware developer and analyst must understand. https://blog.disruption-academy.com/blog/pivoting-tunneling-and-lateral-movement https://blog.disruption-academy.com/blog/pivoting-tunneling-and-lateral-movement Mon, 15 Jun 2026 00:00:00 GMT Red Team A practical reference covering every pivoting and tunneling technique you will reach for on an internal engagement - SSH, Ligolo-NG, Chisel, Chisel, socat, sshuttle, DNS/ICMP tunneling - plus a full lateral movement playbook for Windows environments. https://blog.disruption-academy.com/blog/vsix-initial-access https://blog.disruption-academy.com/blog/vsix-initial-access Sun, 14 Jun 2026 00:00:00 GMT Initial Access Red Team Developer tooling is a soft target. Here is how a VSCode extension turns a trusted IDE into a code-execution primitive, how to build a proof-of-concept VSIX, the delivery vectors that actually land, and how blue teams catch it. https://blog.disruption-academy.com/blog/htb-soulmate https://blog.disruption-academy.com/blog/htb-soulmate Sat, 13 Jun 2026 00:00:00 GMT HackTheBox Easy Linux Soulmate is an easy difficulty Linux machine that showcases exploitation of an authentication bypass vulnerability in CrushFTP, allowing players to access an admin user account. By uploading a malicious PHP file to the application's web root, remote command execution is achieved. For privilege escalation, another remote command execution vulnerability in the Erlang/OTP SSH server is exploited to gain root access. https://blog.disruption-academy.com/blog/welcome-to-the-blog https://blog.disruption-academy.com/blog/welcome-to-the-blog Thu, 11 Jun 2026 00:00:00 GMT Getting Started How this blog is built, and how to publish your own write-ups by creating a folder with a markdown file and its images.