/ tags/ ActiveDirectory

# HTB-Pirate

2026-03-05 5 min read

In order to avoid clock skew errors I used the following commands to adjust the time to that of the target:

BloodHound forcechangepassword ActiveDirectory SPN-Jacking S4U2Proxy

# HTB-Vintage

2026-01-30 5 min read

By mutating a wordlist to the naming convention of the user we already found we can find another user in the domain:

BloodHound BloodyAD ActiveDirectory dpapi kerbrute ReadGMSAPassword GenericWrite GenericAll RBCD

# HTB-Voleur

2025-07-06 4 min read

I tried logging into ssh 2222 but got denied:

BloodHound kerberoasting pass-the-key pass-the-ticket ActiveDirectory dpapi