/ tags/ ESC1

# HTB-Authority

2026-01-25 5 min read

Using a random username I enumerated the system:

certipy-ad ADCS ESC1 ansible-vault smbclientng

# HTB-Escape

2026-01-24 4 min read

Using kerbrute I was able to find the following service accounts present:

ADCS kerbrute enum4linux ESC1

# HTB-EscapeTwo

2026-01-23 4 min read

Using the enum4linux-ng tool I was able to enumerate the following information:

BloodyAD ADCS netexec ESC4 ESC1 WriteOwner