JF / 2026 How schema version 1 certificate templates enable arbitrary EKU injection (ESC15 / CVE-2024-49019), and how the Reanimate-Tombstones permission can be abused to recover a deleted certificate admin account and chain both techniques into a full Active Directory compromise.
Reading ntdll.dll from disk to overwrite the EDR's userland hooks — the step-by-step technique, the two offset representations (1024 vs 4096), and the modern context: why unhooking alone is dead and what replaced it.
How to escalate from any domain credential to Domain Admin by coercing the DC to authenticate, relaying that authentication to Active Directory Certificate Services, and extracting a certificate for the machine account. A deep dive into the AD CS misconfiguration that requires no template abuse — and the Kerberos relay technique that bypasses a domain-wide NTLM block.
A complete penetration test report of a Windows Active Directory environment: WriteSPN for Kerberoasting, gMSA password extraction, WriteOwner abuse, ADCS ESC15 exploitation, and tombstone restoration to recover a deleted certificate admin account. From assumed-breach user to Domain Admin in a single chain.
A complete penetration test report of a Windows Active Directory environment: NFS unauthenticated export, plaintext credentials, Kerberos password spraying, PetitPotam coercion, NTLM relay to AD CS web enrollment, and DCSync. Four chained vulnerabilities leading to domain admin in under two hours.
Using an open-source terminal-native AI agent to autonomously enumerate and exploit HackTheBox machines. An honest evaluation of what LLM agents can do with Nemotron 3 Ultra 550B, where they fail, and the prompt engineering that makes the difference between a stalled session and a root shell.
A complete staged payload pipeline: Sliver mTLS beacon, XOR-obfuscated URL in a custom C stager, PEB process path spoofing, Startup-folder persistence, and delivery wrapped inside a fake Chrome installer with a spoofed Authenticode signature.