Kerberos

mpgn’s Expedition CTF, a Lanfeust themed Active Directory lab across two domains. 12/12 flags plus both optional detours in 8h50. Every chain, every command, every dead end.

Here is a service principal name: cifs/DC1 And here is another one: cifs/DC1‌ They are not the same string. The second one ends with U+200C, a zero width non-joiner. Three bytes, e2 80 8c, that your terminal, your browser and your eyes all agree to pretend do not exist.

Complete exploitation of a Windows Active Directory machine highlighting Kerberos delegation RBCD techniques

HackTheBox - Redelegate # Hard difficulty Windows Active Directory machine - Anonymous FTP access leading to KeePass cracking and Kerberos constrained delegation