Search
HTB: Overwatch Writeup | thepentesting.ninja

🔒 Protected Content

This post is password protected. Please enter the password to view the content.

Incorrect password. Please try again.

Connect With Me

HTB: Overwatch Writeup

HTB: Overwatch Writeup

thepentesting.ninja's Picture
thepentesting.ninja in overwatch htb hackthebox windows overwatch.htb

You may also like

HackSmarter: ShadowGate Writeup
14 min read

HackSmarter: ShadowGate Writeup

Black-box Windows AD engagement against a single DC. AS-REP roasting yields initial credentials, shadow credential abuse pivots to a domain user, and ESC8 relay achieves DCSync.

thepentesting.ninja's Picture
thepentesting.ninja in shadowgate hacksmarter windows easy active-directory adcs esc8 asreproasting
HTB: Redelegate Writeup
19 min read

HTB: Redelegate Writeup

Hard Windows Active Directory box involving FTP enumeration, KeePass cracking, MSSQL credential abuse, ForceChangePassword ACL exploitation, and constrained delegation abuse to achieve DCSync.

thepentesting.ninja's Picture
thepentesting.ninja in redelegate htb windows active-directory kerberos constrained-delegation mssql keepass
HTB: EscapeTwo Writeup
15 min read

HTB: EscapeTwo Writeup

EscapeTwo is an easy Windows Active Directory machine on HackTheBox. Starting with provided credentials, we enumerate SMB shares to recover plaintext credentials from Excel files, pivot through MSSQL to a shell as sql_svc, recover ryan credentials from a SQL installer config, then abuse ESC4 via the ca_svc account to forge an administrator certificate and own the domain.

thepentesting.ninja's Picture
thepentesting.ninja in escapetwo hackthebox windows active-directory mssql adcs esc4 kerberoasting smb

Latest Posts

HackSmarter: ShadowGate Writeup
14 min read

HackSmarter: ShadowGate Writeup

thepentesting.ninja's Picture
thepentesting.ninja
HTB: Redelegate Writeup
19 min read

HTB: Redelegate Writeup

thepentesting.ninja's Picture
thepentesting.ninja

Explore Tags

acl-abuse active-directory adcs administrator ai ansible-vault api apisec asreproasting atlantis authentication-bypass authority badsuccessor bash-injection bloodhound browsed bscp burpsuite bytecode-poisoning capenx cbbh certifications charcol citycouncil codeparttwo command-injection constrained-delegation conversor craft crushftp cspt ctf cve-2019-12840 cve-2023-23752 cve-2024-30088 cve-2024-4577 cve-2024-5932 cve-2025-31161 cve-2026-29000 cwes darkzero dcsync dns docker dom-poisoning dpapi easy eighteen erlang esc1 esc4 esc8 escapetwo eval-injection exception