LOG · Transmissions

The Log

Notes on web application security, engine and audio tooling, music production, and the platforms behind the label.

09.23.2026 · Johnytiger

HTB: Blackfield

A guest-readable profiles share hands over hundreds of usernames, one of which AS-REP roasts. Account Operators lets us reset an auditor’s password, the forensic share holds an lsass dump from a previous breach, and the restore privilege finishes it as SYSTEM.

securityctfwriteuphackthebox

09.20.2026

HTB: Fuse

A PaperCut print log leaks the staff list and a document name that doubles as the corporate password. Every account demands a password change, a printer description hides a service credential in plaintext, and the load driver privilege finishes it through a vulnerable signed driver.

securityctfwriteup

09.19.2026

HTB: Lightweight

The site hands you an SSH account named after your own IP. tcpdump has the capabilities to sniff loopback without root, so the site’s own LDAP bind gives up a password in cleartext, and a copy of openssl carrying the setuid capability loads a shared object straight into a root shell.

securityctfwriteup

09.19.2026

HTB: Scrambled

NTLM is switched off across the domain, so everything runs over Kerberos. A username sprayed as its own password opens the door, a kerberoasted SQL service account gets cracked, and a forged silver ticket walks straight past the login the admins thought they had locked down.

securityctfwriteup

09.19.2026

HTB: Resolute

A password left sitting in an Active Directory account description opens the first door. A forgotten PowerShell transcript on disk hands over a second account, and DnsAdmins membership turns a DLL into a SYSTEM shell.

securityctfwriteup

09.18.2026

HTB: Intelligence

PDF metadata builds the user list and a forgotten onboarding guide supplies the default password. From there a scheduled script that resolves every web DNS record gets coerced into authenticating to Responder, and a group managed service account finishes it through constrained delegation.

securityctfwriteup

09.17.2026

HTB: Monteverde

Spraying every username as its own password lands a service account. That account can read an azure.xml holding a second password, and membership of Azure Admins means the local ADSync database will hand over the domain administrator credential in plaintext.

securityctfwriteup

09.16.2026

HTB: Nest

A guest SMB session, an HR welcome email handing out a temp password, a VB.NET config whose decryption key ships in the source next to it, a password hidden in an alternate data stream, and a debug console that gives up the Administrator credential.

securityctfwriteup

09.16.2026

HTB: Sauna

The bank’s Meet The Team page is the user list. Permuting those names finds an account with Kerberos preauth disabled, an autologon password sits in the registry, and the service account behind it quietly holds DCSync.

securityctfwriteup

09.15.2026

HTB: Active

A null session reads the Replication share, and Group Policy Preferences hands over a service account password Microsoft published the decryption key for. That account kerberoasts the Administrator SPN and the domain controller falls.

securityctfwriteup

09.14.2026

HTB: Forest

A domain controller with no preauth on a service account. AS-REP roasting gives up svc-alfresco, Account Operators lets us mint an account into Exchange Windows Permissions, and WriteDacl on the domain turns into DCSync.

securityctfwriteup

09.08.2026

VulnNet: Active

A Windows domain controller running Redis 2.8 with no auth. A Lua dofile() call coerces the box to authenticate to Responder, the cracked hash opens a writable share, and a swapped scheduled script leads to SYSTEM.

securityctfwriteup

09.07.2026

Obscure

A TryHackMe box that runs on patience: anonymous FTP hands over a password-recovery binary, Ghidra hands over its hardcoded ID, an Odoo 10 RCE gets a shell in a container, and a ret2libc ROP chain over pwntools finishes it as root.

securityctfwriteup

09.06.2026

MartiniAD

A hacksmarter.org Active Directory box: guest access on an SMB share leaks manager credentials, kerberoasting gets a service account, and password reuse turns into DCSync and the krbtgt hash.

securityactive directoryctf

01.01.2026

Welcome to the Blog

A new home for notes on security research, music production, and building things from one studio.

announcements