JF / 2026 Reading ntdll.dll from disk to overwrite the EDR's userland hooks — the step-by-step technique, the two offset representations (1024 vs 4096), and the modern context: why unhooking alone is dead and what replaced it.
How to escalate from any domain credential to Domain Admin by coercing the DC to authenticate, relaying that authentication to Active Directory Certificate Services, and extracting a certificate for the machine account. A deep dive into the AD CS misconfiguration that requires no template abuse — and the Kerberos relay technique that bypasses a domain-wide NTLM block.
A practical workflow for running untrusted binaries in a controlled environment: how CAPE extracts behavior and IOCs, why anti-VM evasion breaks most sandboxes, and the configuration changes that make a VM look like a real machine.
A complete penetration test report of a Windows Active Directory environment: NFS unauthenticated export, plaintext credentials, Kerberos password spraying, PetitPotam coercion, NTLM relay to AD CS web enrollment, and DCSync. Four chained vulnerabilities leading to domain admin in under two hours.
Using an open-source terminal-native AI agent to autonomously enumerate and exploit HackTheBox machines. An honest evaluation of what LLM agents can do with Nemotron 3 Ultra 550B, where they fail, and the prompt engineering that makes the difference between a stalled session and a root shell.
A complete staged payload pipeline: Sliver mTLS beacon, XOR-obfuscated URL in a custom C stager, PEB process path spoofing, Startup-folder persistence, and delivery wrapped inside a fake Chrome installer with a spoofed Authenticode signature.
A .bat script that weaponizes an unlocked workstation and a USB port — disables Defender, dumps browser credentials with SharpChromium, restores Defender, gone in under a minute. A study of what physical access actually buys an attacker.