Skip to content
BIG$HA crestBIG$HA

Writeups

Technical Writeups

Full attack-path documentation: enumeration, the reasoning behind each pivot, and impact — with commands and supporting output retained. Sensitive values and lengthy credentials may be shortened for readability.

31 writeups

HackSmarter

Martini-AD

Initial enumeration identified the target as a Windows Domain Controller.

  • Active Directory
  • Kerberoasting
  • Windows

HackSmarter

ShadowGate

Initial scan identified the target as a Windows Domain Controller.

  • Active Directory
  • ADCS
  • Kerberoasting
  • NTLM Relay

HackSmarter

ShadowGate2

Initial Nmap scan identified the target as a Windows Domain Controller running IIS and MSSQL.

  • Active Directory
  • ADCS
  • Kerberoasting
  • NTLM Relay

HackSmarter

Araksa

Starting credentials: faraday:hacksmarter123

  • Active Directory
  • ADCS
  • Kerberoasting
  • Windows

HackSmarter

Edge

Initial enumeration identified a Windows host named VANTARAOPS.

  • Windows

HackSmarter

Ascension

Target: 10.1.128.100 (ip-10-1-128-100, Ubuntu)

  • Privilege Escalation
  • Credential Exposure
  • Web Application
  • Linux

HackSmarter

BankSmarter

Walked SNMP with the default public community string to look for operator-supplied strings in the system MIB.

  • Privilege Escalation
  • Lateral Movement

HackSmarter

Welcome

Scope: phishing engagement — starting credentials e.hills:Il0vemyj0b2025!

  • Active Directory
  • ADCS
  • Kerberoasting
  • Privilege Escalation

HackSmarter

Samurai

Ran a custom scanner against the target before falling back to Nmap for service detail.

  • Privilege Escalation
  • Credential Exposure
  • Lateral Movement

HackSmarter

404Bank

I started on the web server on port 80. It was a static company site — nothing interactive to attack, but the content itself was the useful part.

  • Active Directory
  • ADCS
  • Kerberoasting
  • Privilege Escalation

HackSmarter

Triathlon

Scanned all three discovered hosts.

  • Active Directory
  • ADCS
  • Kerberoasting
  • NTLM Relay

HackSmarter

Talisman

Started with a leaked credential for the engagement.

  • Privilege Escalation
  • Credential Exposure

HackSmarter

SysAdmins

Initial Nmap enumeration identified FTP, SSH, and an HTTP service on an Ubuntu host, with anonymous FTP access flagged.

  • Privilege Escalation
  • Credential Exposure
  • Linux

HackSmarter

Health Smarter

Only SSH and an Express-based web application were exposed. The web app redirected unauthenticated requests to /login.html, so enumeration continued against port 80.

  • Privilege Escalation
  • Credential Exposure
  • Web Application

HackSmarter

Embedded

The brief handed me a standard user account (brian:HackSmarter123!), a leaked password of unknown ownership (cJ2yxWMs3XEHbO), and a list of candidate usernames. I started with a port scan.

  • Privilege Escalation
  • Credential Exposure
  • Web Application
  • Linux

HackSmarter

Casino

Started with a full service scan to map the attack surface.

  • SSTI
  • Privilege Escalation
  • Credential Exposure
  • Web Application

HackSmarter

Implicit

This engagement had two objectives: (1) a targeted penetration test of a new OAuth Implicit-Grant SSO integration, with the goal of logging in as the administrator, and (2) a secure code review — triage the vulnerable…

  • Web Application
  • OAuth

HackSmarter

Casper

Scanned both in-scope hosts.

  • Active Directory
  • Entra ID
  • ADCS
  • Shadow Credentials

HackSmarter

Polution

The scope described a staging build of a managed-SOC web portal, about to go to production. I had one set of credentials that "mirror a customer", and the question was whether that account could become an Administrator.

  • Web Application

HackSmarter

Walnut

The goal was to see how far those credentials could go.

  • Active Directory
  • Privilege Escalation
  • Linux
  • Lateral Movement

HackSmarter

Printer

A workgroup host (WIN-0MTGMLVOBBO, no domain) with an osTicket-style support portal on 80, a Flask app on 5000 titled "Printer Configuration Portal", and the usual RDP/WinRM surface.

  • NTLM Relay
  • Privilege Escalation
  • Credential Exposure
  • Web Application

HackSmarter

Verbose

The scope was an external test against a web application with unrestricted public registration, with the stated goal of reaching root on the host. Tyler's own note on the brief: there are at least three ways to solve…

  • SSTI
  • Credential Exposure
  • Web Application

HackSmarter

Beanstalk

The app's own description says "insecure secrets scenario" — worth taking literally. elasticbeanstalk:Describe* was granted, so I kept going down that path instead of the dead-end IAM one.

  • Privilege Escalation
  • Credential Exposure
  • Lateral Movement

HackSmarter

Assume

Two custom roles stood out against the AWS-managed service-linked ones: cg-debug-role-lab and cg-lambdaManager-role-lab. Checked who's allowed to assume each.

  • Privilege Escalation
  • Lateral Movement

HackSmarter

Wordplay

SSH, Apache serving WordPress 6.9.4, and an exposed NFS share.

  • Privilege Escalation
  • Credential Exposure
  • Web Application
  • Lateral Movement

EntraGoat

EntraGoat Scenario 1 - Misowned and Dangerous

Obtain access to the administrative account and retrieve the flag stored in extensionAttribute1.

  • Entra ID
  • Privilege Escalation
  • Windows
  • Graph API

EntraGoat

EntraGoat Scenario 2 — Graph Me the Crown (and Roles)

Gain access to the target administrator account and retrieve the flag from extensionAttribute1.

  • Entra ID
  • Shadow Credentials
  • Certificate Authentication
  • Graph API

EntraGoat

EntraGoat Scenario 3 – Group MemberShipwreck: Sailed into Admin Waters

Gain access to the target administrative account and retrieve the flag stored in the extensionAttribute1 attribute.

  • Entra ID
  • Privilege Escalation

EntraGoat

EntraGoat Scenario 4 - I (Eligibly) Own That

After authenticating, the objective was to identify a path that would lead to the target administrative account.

  • Entra ID
  • Privilege Escalation

EntraGoat

EntraGoat Scenario 5 – Department of Escalations (AU Ready for This?)

Objective: Gain access to the target administrative account and retrieve the flag stored in extensionAttribute1.

  • Privilege Escalation

EntraGoat

EntraGoat Scenario 6 – CBA (Certificate Bypass Authority)

I authenticated to Microsoft Graph with those leaked credentials to see what the service principal could actually do.

  • Entra ID
  • Privilege Escalation
  • Credential Exposure
  • Windows