Search
HTB: Pirate Writeup | thepentesting.ninja

🔒 Protected Content

This post is password protected. Please enter the password to view the content.

Incorrect password. Please try again.

Connect With Me

HTB: Pirate Writeup

HTB: Pirate Writeup

thepentesting.ninja's Picture
thepentesting.ninja in pirate htb hackthebox windows pirate.htb

You may also like

HTB: EscapeTwo Writeup
15 min read

HTB: EscapeTwo Writeup

EscapeTwo is an easy Windows Active Directory machine on HackTheBox. Starting with provided credentials, we enumerate SMB shares to recover plaintext credentials from Excel files, pivot through MSSQL to a shell as sql_svc, recover ryan credentials from a SQL installer config, then abuse ESC4 via the ca_svc account to forge an administrator certificate and own the domain.

thepentesting.ninja's Picture
thepentesting.ninja in escapetwo hackthebox windows active-directory mssql adcs esc4 kerberoasting smb
HTB: Eighteen Writeup
13 min read

HTB: Eighteen Writeup

Eighteen is a Windows Server 2025 domain controller where MSSQL impersonation leads to a cracked PBKDF2 hash and a password spray foothold, then BadSuccessor dMSA abuse escalates to Domain Admin.

thepentesting.ninja's Picture
thepentesting.ninja in eighteen hackthebox windows mssql active-directory badsuccessor kerberos password-spray
HTB: DarkZero Writeup
15 min read

HTB: DarkZero Writeup

Hard Windows Active Directory machine featuring MSSQL linked server lateral movement across two forests, CVE-2024-30088 kernel LPE to SYSTEM, and unconstrained delegation abuse for domain takeover.

thepentesting.ninja's Picture
thepentesting.ninja in darkzero hackthebox windows hard active-directory mssql kerberos cve-2024-30088

Latest Posts

HTB: EscapeTwo Writeup
15 min read

HTB: EscapeTwo Writeup

thepentesting.ninja's Picture
thepentesting.ninja
HTB: Eighteen Writeup
13 min read

HTB: Eighteen Writeup

thepentesting.ninja's Picture
thepentesting.ninja

Explore Tags

acl-abuse active-directory adcs administrator ai ansible-vault api apisec atlantis authentication-bypass authority badsuccessor bash-injection bloodhound browsed bscp burpsuite bytecode-poisoning capenx cbbh certifications charcol citycouncil codeparttwo command-injection conversor craft crushftp cspt ctf cve-2019-12840 cve-2024-30088 cve-2024-4577 cve-2024-5932 cve-2025-31161 cve-2026-29000 cwes darkzero dcsync dns docker dom-poisoning dpapi easy eighteen erlang esc1 esc4 esc8 escapetwo eval-injection exception expressway exslt fail2ban