Máquina Windows AD «Sequel» (EscapeTwo) de HackTheBox: de un xlsx corrupto con credenciales a MSSQL y C2 con Sliver, escalando vía ADCS (ESC) con Certipy hasta Administrator.
Máquina Windows AD «Cicada» de HackTheBox: de null session y SMB a credenciales por spraying, y root abusando de SeBackupPrivilege para volcar SAM/SYSTEM.
This very easy machine required performing fuzzing to find hidden directories and obtain a user. Then, we used Hydra to brute force and get the SSH credentials. Finally, to escalate to root, we used the vim binary which had sudo permissions.