Active Directory

Working through HTB VulnCicada with Exegol Studio, from exposed profile files to ADCS and Kerberos relaying. A writeup of the run, including the mistakes, questions and documentation that helped me through it.

mpgn’s Expedition CTF, a Lanfeust themed Active Directory lab across two domains. 12/12 flags plus both optional detours in 8h50. Every chain, every command, every dead end.

The Hacker Recipes said remote SID History injection from Linux was impossible. pySIDHistory proves otherwise with two methods: DRSUAPI and DSInternals.

Building a cross-platform GoldenGMSA tool by reverse engineering Windows cryptographic DLLs and implementing NIST SP800-108 KDF from scratch

Complete exploitation of a Windows Active Directory machine highlighting Kerberos delegation RBCD techniques

Comprehensive guide to Active Directory exploitation with NetExec at the LeHack 2025 workshop

Complete Active Directory lab exploitation with Netexec - Advanced pentesting techniques