CYBERSECURITY on hun.io

Obtaining AS-REP hashes through ARP poisoning

Thu, 25 Jun 2026 00:00:00 +0000

Introduction Link to heading

Note: The research and tooling covered in this post are not my original work,. All credit goes to Yaxxine7 for creating the ASRepCatcher tool and doing all the heavy lifting!

AS-REP roasting is a well-documented Kerberos attack where an attacker can obtain and crack hashes for accounts with preauthentication disabled.

However, instead of looking for accounts that manually have preauthentication disabled, ASRepCatcher performs a man-in-the-middle attack between clients and the domain controller, allowing an attacker to obtain AS-REP hashes from authenticating users regardless of whether preauthentication is normally required.

Cracking downgraded NTLMv1 SSP hashes with rainbow tables

Wed, 15 Apr 2026 00:00:00 +0000

Introduction Link to heading

NTLM downgrade attacks have been around for a while and are well known against systems like Windows Server 2012. After obtaining an NTLMv1 response with a custom challenge, it’s relatively straightforward to recover the victim user or machine’s raw NT hash via a rainbow table.

With newer versions of SMB, the introduction of ESS, and more, this path became less and less viable. However, it turns out that Windows Server 2022 environments can still allow for a successful NTLM downgrade if NTLMv1 is permitted, and the (mis)configuration of the domain is identical to that of older versions of Windows Server.

I hacked a .gov site

Mon, 05 Jan 2026 00:00:00 +0000

Introduction Link to heading

In June of 2025, a friend sent me a new .gov website that had recently been spun up less than 18 hours prior. I decided to look at the technologies the website was running and how information was displayed, and found an interesting URL parameter that looked something like this:

https://domain.gov/next/image?url=%2Fpath%2Fto%2Fimage.png&w=256&q=75

This potentially looked like a classic case of Server-Side Request Forgery!

Our first black badge

Wed, 15 Oct 2025 00:00:00 +0000

Wild West Hackin’ Fest Link to heading

Wild West Hackin’ Fest, hosted by Black Hills Information Security, is an annual cybersecurity conference held in Deadwood, South Dakota and Denver, Colorado. Like other conferences, Wild West features booths with industry leaders, presentations from well-known speakers, competitions, official trainings, and more. It’s a great opportunity for both learning and networking.

Back in January, when our team won CPTC Globals, we were offered free attendance to the 2025 Wild West Deadwood conference! While planning what we wanted to do, we noticed that Wild West offers a black badge to the winners of their Capture the Flag (CTF) competition, hosted by MetaCTF.

Abusing delegation with Impacket

Thu, 25 Sep 2025 00:00:00 +0000

The inspiration behind this Link to heading

In Active Directory exploitation, Kerberos delegation is easily among my top favorite vectors of abuse, and in the years I’ve been learning Kerberos exploitation, I’ve noticed that Impacket doesn’t get nearly as much coverage as tools like Rubeus or Mimikatz.

From a penetration testing perspective, especially when operating from a remote dropbox, being able to interface Kali to the domain controller provides tremendous value, as we don’t need to drop binaries on disk, nor do we need to worry about host-based detections.

Abusing S4U2Self for Active Directory pivoting

Fri, 18 Apr 2025 00:00:00 +0000

TL;DR Link to heading

If you only have access to a valid machine hash, you can leverage the Kerberos S4U2Self proxy for local privilege escalation, which allows reopening and expanding potential local-to-domain pivoting paths, such as SEImpersonate!

Introduction Link to heading

What is Kerberos? Link to heading

Kerberos is a ticket-based authentication protocol that enables secure communication in untrusted environments by first establishing mutual trust through a mutual third party. As a result, Kerberos requires three parties:

Fun with Minecraft infostealer malware

Wed, 05 Mar 2025 00:00:00 +0000

Introduction Link to heading

One day, a friend and I were bored one night, so we decided to look for some fun Minecraft mod malware floating around on the internet. We each dug around for our own samples, and I came across this video on YouTube:

This just looks like a traditional cheat for gaining experience in the large Minecraft server, Hypixel. So, I downloaded the file, decompiled the Java, and spent some time reversing its functionality.

Having fun with noPac

Fri, 14 Feb 2025 00:00:00 +0000

What is noPac? Link to heading

NoPac, released in 2021, is an Active Directory privilege escalation exploit that abuses two vulnerabilities and one function in Active Directory:

CVE-2021-42278: A vulnerability in the Windows Security Account Manager (SAM) that allows the spoofing of a computer’s sAMAccountName, or computer name.
CVE-2021-42287: A vulnerability in the Kerberos Privilege Attribute Certificate (PAC) that allows an attacker to obtain a Kerberos service ticket for a more privileged user than themselves.
Machine Account Quota: A domain-level attribute that allows users to attach up to 10 computers to a domain.

How noPac works Link to heading

If you can obtain credentials for a domain-attached user, you can abuse their Machine Account Quota to arbitrarily create computers under their account. At a high level, here are the steps to exploit noPac:

My reflections on a global achievement

Wed, 29 Jan 2025 00:00:00 +0000

Within the last two weeks, our team placed first in the world in a hacking competition, and I want to talk a little bit about it as well as what I’ve learned throughout this experience!

About the competition Link to heading

The Collegiate Penetration Testing Competition (CPTC) is essentially a competition where teams conduct a penetration test and generate a report for a client within a finite amount of time. It’s an absolute blast—maybe a little stressful at times—but a great time overall.