CTF

Fluffy provides a strong introduction into AD Certificate Services, a relevant testing tool Certipy, and your common ACL abuse.

Discovering your foothold through a Jenkins web application, a test on file enumeration and uncovering alternate data streams.

Trick provides a field to practice Web Recon techniques, Local File Inclusion vulnerabilities to view environment configurations, and an interesting interaction with Fail2Ban.

Postman brings exposure to a misconfigured Redis instance, leading into a hunt for interesting readable files, and a finale interaction through a web-based system administration tool.

A demonstration of using File Disclosure to find sensitive keys enabling a Object Deserialization attack for command execution, followed by finding exposed credentials leading to SeDebugPrivilege abuse.

ombwatcher serves a straight forward demonstration for a Active Directory attack chain for Lateral Movement, where you discover deleted Active Directory Objects which contains permissions required to attack an Active Directory Certificate Services instance.

edia is unique for requiring a crafted video file for anNTLM Leak attack, followed by File System Redirection to an upload directory outside of webroot, then using SeTcbPrivilege to gain full system compromise.