<Tag: easy />

MartiniAD is an Easy-difficulty Active Directory lab hosted by HackSmarter. The domain `DRY.MARTINI.BARS` is fronted by a single Domain Controller (`DC01`) that permits unauthenticated SMB null/guest sessions. This allows enumeration of a non-default share containing plaintext credentials for a low-privileged domain user. Those credentials are used to Kerberoast a service account, whose cracked password grants a foothold via WinRM. Password reuse between the service account and a linked human Tier-0 admin account (which sits in Domain Admins) then provides full domain compromise, culminating in a DCSync attack to extract the KRBTGT hash.

Compromising the ShadowGate Active Directory lab through a chained attack path — from AS-REP roasting and ACL abuse via Shadow Credentials, to coercing the Domain Controller with PetitPotam and relaying its authentication into a certificate-based DCSync — culminating in full domain compromise via the krbtgt hash.

Predictable hash function that results in breaking the decisional problem by enumerating all group elements.

Line Tap demonstrates how a forgotten Telnet maintenance interface on an ICS host can be turned into instant, unauthenticated root via CVE-2026-24061 by abusing the NEW-ENVIRON USER=-f root trick, making the challenge a clean lesson in legacy service risk, argument injection, and critical exposure in operational technology environments.