/ tags/ WriteOwner

# HTB-Certified

2026-01-24 3 min read

Using the provided creds I start off by running an enum scan of the target:

BloodHound BloodyAD certipy-ad ADCS enum4linux WriteOwner ESC9 GenericWrite GenericAll

# HTB-EscapeTwo

2026-01-23 4 min read

Using the enum4linux-ng tool I was able to enumerate the following information:

BloodyAD ADCS netexec ESC4 ESC1 WriteOwner