/ tags/ ReadGMSAPassword

# HTB-Vintage

2026-01-30 5 min read

By mutating a wordlist to the naming convention of the user we already found we can find another user in the domain:

BloodHound BloodyAD ActiveDirectory dpapi kerbrute ReadGMSAPassword GenericWrite GenericAll RBCD

# HTB-Fries

2025-11-25 9 min read

When trying to log in using the provided ldap creds we get the following message:

BloodHound docker certipy-ad ADCS ffuf vhosts docker-escape nfs PostgreSQL PWM ReadGMSAPassword ESC7