JOHNYTIGER

LOG · Transmissions

The Log

Notes on web application security, engine and audio tooling, music production, and the platforms behind the label.

HTB: VulnCicadaLatest

10.13.2026 · Johnytiger

HTB: VulnCicada

NFS hands over a list of domain usernames, and a password hiding on a sticky note inside a stego'd PNG gets us our first Kerberos login. From there AD CS is vulnerable to ESC8, but the relay only fires once we feed Active Directory a marshalled DNS record that points the coercion right back at us, ending in a DCSync for Domain Admin.

securityctfwriteuphackthebox
HTB: Multimaster

10.07.2026

HTB: Multimaster

A full-width apostrophe walks straight past the filter and opens a SQL injection. The app’s own user table is a decoy, so the real domain accounts get resolved through the injection itself, and root comes from a code editor left listening with its debugger open.

securityctfwriteup
HTB: Sizzle

10.07.2026

HTB: Sizzle

Two writable folders on an anonymous share are enough to coerce a domain user into authenticating to Responder. The certificate authority then issues a login certificate, and because Kerberos is firewalled off, the kerberoast has to happen from inside the box.

securityctfwriteup
HTB: Granny

10.07.2026

HTB: Granny

A Windows Server 2003 box running IIS 6 with WebDAV write methods left enabled. The upload filter checks the extension rather than the file, so you upload as text and rename it into something the server will execute, then take SYSTEM with a token impersonation tool from the same era.

securityctfwriteup
HTB: Baby

10.02.2026

HTB: Baby

An anonymous LDAP bind hands over the user list, and one account has its initial password typed into the description field. A disabled account missed by the summary turns into a shell, and the backup privilege turns that shell into the whole directory.

securityctfwriteup
HTB: Bounty

10.01.2026

HTB: Bounty

One open port and a picture of a wizard. An upload page that rejects everything except a web config, which IIS will happily execute, and the impersonate privilege on the service account turns that foothold into SYSTEM.

securityctfwriteup
HTB: Swagshop

09.30.2026

HTB: Swagshop

An unpatched Magento 1.9 storefront. A blind injection writes us our own admin account, an authenticated exploit turns those credentials into code execution, and sudo rights on vi hand over root through a shell escape.

securityctfwriteup
HTB: Usage

09.28.2026

HTB: Usage

A time-based blind injection on a forgotten-password form gives up the admin hash one character at a time. An avatar upload checks the filename rather than the file, a monitoring config leaks a password in plaintext, and a 7-Zip argument quirk prints the root SSH key.

securityctfwriteup
HTB: Dog

09.27.2026

HTB: Dog

A .git directory left exposed at the web root hands over the whole site, including the database password. The admin reused it on their own account, the CMS module installer runs whatever archive you point it at, and a sudo-able command line tool finishes it as root.

securityctfwriteup
HTB: Search

09.26.2026

HTB: Search

A password left legible in a stock photo on the company website opens the door. Kerberoasting gives up a service account, LDAP descriptions expose the HelpDesk temp password, and a machine account plus a careless certificate authority turns into Domain Admin.

securityctfwriteup
HTB: Blackfield

09.23.2026

HTB: Blackfield

A guest-readable profiles share hands over hundreds of usernames, one of which AS-REP roasts. Account Operators lets us reset an auditor’s password, the forensic share holds an lsass dump from a previous breach, and the restore privilege finishes it as SYSTEM.

securityctfwriteup
HTB: Fuse

09.20.2026

HTB: Fuse

A PaperCut print log leaks the staff list and a document name that doubles as the corporate password. Every account demands a password change, a printer description hides a service credential in plaintext, and the load driver privilege finishes it through a vulnerable signed driver.

securityctfwriteup
HTB: Lightweight

09.19.2026

HTB: Lightweight

The site hands you an SSH account named after your own IP. tcpdump has the capabilities to sniff loopback without root, so the site’s own LDAP bind gives up a password in cleartext, and a copy of openssl carrying the setuid capability loads a shared object straight into a root shell.

securityctfwriteup
HT

09.19.2026

HTB: Scrambled

NTLM is switched off across the domain, so everything runs over Kerberos. A username sprayed as its own password opens the door, a kerberoasted SQL service account gets cracked, and a forged silver ticket walks straight past the login the admins thought they had locked down.

securityctfwriteup
HTB: Resolute

09.19.2026

HTB: Resolute

A password left sitting in an Active Directory account description opens the first door. A forgotten PowerShell transcript on disk hands over a second account, and DnsAdmins membership turns a DLL into a SYSTEM shell.

securityctfwriteup
HTB: Intelligence

09.18.2026

HTB: Intelligence

PDF metadata builds the user list and a forgotten onboarding guide supplies the default password. From there a scheduled script that resolves every web DNS record gets coerced into authenticating to Responder, and a group managed service account finishes it through constrained delegation.

securityctfwriteup
HTB: Monteverde

09.17.2026

HTB: Monteverde

Spraying every username as its own password lands a service account. That account can read an azure.xml holding a second password, and membership of Azure Admins means the local ADSync database will hand over the domain administrator credential in plaintext.

securityctfwriteup
HTB: Nest

09.16.2026

HTB: Nest

A guest SMB session, an HR welcome email handing out a temp password, a VB.NET config whose decryption key ships in the source next to it, a password hidden in an alternate data stream, and a debug console that gives up the Administrator credential.

securityctfwriteup
HTB: Sauna

09.16.2026

HTB: Sauna

The bank’s Meet The Team page is the user list. Permuting those names finds an account with Kerberos preauth disabled, an autologon password sits in the registry, and the service account behind it quietly holds DCSync.

securityctfwriteup
HTB: Active

09.15.2026

HTB: Active

A null session reads the Replication share, and Group Policy Preferences hands over a service account password Microsoft published the decryption key for. That account kerberoasts the Administrator SPN and the domain controller falls.

securityctfwriteup
HTB: Forest

09.14.2026

HTB: Forest

A domain controller with no preauth on a service account. AS-REP roasting gives up svc-alfresco, Account Operators lets us mint an account into Exchange Windows Permissions, and WriteDacl on the domain turns into DCSync.

securityctfwriteup
VulnNet: Active

09.08.2026

VulnNet: Active

A Windows domain controller running Redis 2.8 with no auth. A Lua dofile() call coerces the box to authenticate to Responder, the cracked hash opens a writable share, and a swapped scheduled script leads to SYSTEM.

securityctfwriteup
Obscure

09.07.2026

Obscure

A TryHackMe box that runs on patience: anonymous FTP hands over a password-recovery binary, Ghidra hands over its hardcoded ID, an Odoo 10 RCE gets a shell in a container, and a ret2libc ROP chain over pwntools finishes it as root.

securityctfwriteup
MartiniAD

09.06.2026

MartiniAD

A hacksmarter.org Active Directory box: guest access on an SMB share leaks manager credentials, kerberoasting gets a service account, and password reuse turns into DCSync and the krbtgt hash.

securityactive directoryctf
WE

01.01.2026

Welcome to the Blog

A new home for notes on security research, music production, and building things from one studio.

announcements
Drive
Johnytiger