<CTF Writeups />

Compromising the ShadowGate Active Directory lab through a chained attack path — from AS-REP roasting and ACL abuse via Shadow Credentials, to coercing the Domain Controller with PetitPotam and relaying its authentication into a certificate-based DCSync — culminating in full domain compromise via the krbtgt hash.

In this HackSmarter SysAdmins lab, I chained anonymous FTP disclosure, OSINT, SNMPv3 username and credential reuse, and a critical sudo privilege escalation (CVE-2025-32463) to move from initial access to full root compromise.

This is a Medium AWS Challenge Lab, it is an IAM privilege escalation via access key rotation abuse.

Exploit a standard implementation of the Hidden Field Equations protocol via Groebner Basis

Predictable hash function that results in breaking the decisional problem by enumerating all group elements.

Recover RSA private key given leaked information from PEM file using Coppersmith's small roots