/ tags/ nfs

# HTB-Scepter

2026-01-24 6 min read

Right away I noticed that an NFS port was open which is almost always low hanging fruit.

BloodHound BloodyAD certipy-ad ADCS forcechangepassword nfs GenericAll ESC14

# HTB-Fries

2025-11-25 9 min read

When trying to log in using the provided ldap creds we get the following message:

BloodHound docker certipy-ad ADCS ffuf vhosts docker-escape nfs PostgreSQL PWM ReadGMSAPassword ESC7

# HTB-Mirage

2025-11-22 8 min read

I started off by mounting the nfs share.

BloodHound kerberoasting BloodyAD ADCS forcechangepassword netexec ESC10 nats nfs