/ tags/ GenericWrite

# HTB-Vintage

2026-01-30 5 min read

By mutating a wordlist to the naming convention of the user we already found we can find another user in the domain:

BloodHound BloodyAD ActiveDirectory dpapi kerbrute ReadGMSAPassword GenericWrite GenericAll RBCD

# HTB-Certified

2026-01-24 3 min read

Using the provided creds I start off by running an enum scan of the target:

BloodHound BloodyAD certipy-ad ADCS enum4linux WriteOwner ESC9 GenericWrite GenericAll