Pong | Akash Bhavsar

Attack Path Overview
Enumeration
Environment Setup
Foothold Recap — c.roberts
Cross-realm gMSA → c.carlssen
User Flag — c.carlssen on DC2
DC2 Local Admin — RBCD + MSSQL + GodPotato
DCSync R.Martinelli on DC2
ESC4 — Template Edit on SmartcardAuthentication
ESC1 — PKINIT as PING\Administrator
Root Flag
Key Lessons
Tools Used
Flags

The rest of this writeup is locked

Contact me on Discord or LinkedIn for the password.

HackTheBox policy restricts publishing walkthroughs for active-season machines. This writeup is password-protected to respect that policy while keeping the content available to those who already have access.

Table of Contents

The rest of this writeup is locked