Tagged: Active Directory
12 posts · browse all tags
-
Old Kit, New Kit Part 11: AD Enumeration, BloodHound and Certipy vs ldapsearch and net
Enumerating a fresh Active Directory domain two ways — ldapsearch and net rpc against bloodhound-python and certipy-ad — including a full ESC1 certificate exploit, and checking what each one actually leaves in Wazuh.
-
The One DNS Patch That's Actually Wormable: Inside CVE-2026-62878 on Windows DNS Server
August 2026 Patch Tuesday shipped four separate Windows DNS Server RCE fixes. Only one is unauthenticated, needs no user interaction, and is a wormable stack-based buffer overflow: CVE-2026-62878, CVSS 9.8, on a service that's usually running directly on your domain controllers.
-
CVE-2026-45504 Part 1: Why On-Prem Exchange Is an Active Directory Attack Surface
On-prem Exchange has always been a heavily-trusted AD citizen, not a bolt-on app server. This series scopes a real, patched CVE against that history, and against a credential this blog already spent two other series getting a working password for.
-
CVE-2026-45504 Part 3: Why One Mailbox Credential Is Enough
svc-legacy-scan's cracked password has already powered two other series on this blog. CVE-2026-45504 shows what the same credential is worth against Exchange, with no ACL abuse and no privilege check required.
-
BloodHound Deep Dive Part 1: History, Community Edition, and Where It Sits in an Engagement
Where BloodHound came from, how Community Edition is actually built (Postgres, Neo4j, a single Go binary), and where attack-path analysis fits between recon and exploitation in a real engagement.
-
BloodHound Deep Dive Part 2: SharpHound and What It Actually Collects
SharpHound's real collection methods, the Stealth flag's documented behavior, and what a DCOnly run against CONTOSO.LOCAL would and wouldn't surface, taken from SpecterOps' own flag reference rather than guessed.
-
BloodHound Deep Dive Part 3: Ingestion, Postgres, Neo4j, and the Go API
How a SharpHound JSON upload becomes graph data, what Postgres versus Neo4j is actually responsible for, and standing up a real Neo4j instance in a sandbox with no Docker and no root to verify the graph layer directly.
-
BloodHound Deep Dive Part 4: Cypher and the Built-In Attack Path Queries
Running BloodHound's canned attack-path query patterns as real Cypher against the seeded CONTOSO.LOCAL graph, including a shortestPath query that comes back empty and what that empty result actually means.
-
BloodHound Deep Dive Part 5: Kerberoasting and AS-REP Roasting Through the Graph
BloodHound's real hasspn and dontreqpreauth properties point at the exact same two accounts Impacket Deep Dive found by hand, and a clean shortestPath query with no results shows why being roastable isn't the same as being worth roasting.
-
BloodHound Deep Dive Part 6: From GenericAll to a Working Credential
Turning the GenericAll to ForceChangePassword chain from Part 4 into an actual credential with bloodyAD, the real cross-platform ACL abuse tool that pairs with Impacket's own SOCKS-proxy-friendly design.
-
BloodHound Deep Dive Part 8: A Full Walkthrough, From Foothold to a Graph-Confirmed Credential
Tying all seven parts together against CONTOSO.LOCAL: collection, ingestion, querying, and ACL abuse in order, and what it means that the graph runs out of edges before Domain Admins.
-
Password Cracking and Wordlist Engineering Part 1: The Hash Landscape and Why Offline Cracking Is a Different Game
Every post in the Impacket series ended with a hash. This one starts there: what NTLM, Kerberoast, and AS-REP hashes actually are, why offline cracking is a fundamentally different problem from an online login attempt, and the hash landscape the rest of this series works through.