GENERICALL

Genericall

PUBLISHED ON
Blog Published on: October 13, 2025
Hack-The-Box - Medium - Windows - TombWatcher
ALL-BLOGS Hack-The-Box Pentesting Season-8 Windows Medium Active-Directory AD-CS ESC-15 CVE-2024-49019 Kerberoasting GMSA ACL WriteSPN Password-Change Shadow-Credentials Writeowner GenericAll Tombstone-Restoration Certipy-AD NetExec
A full writeup of the HTB TombWatcher machine, covering a multi-stage AD privilege-escalation path. Starting from user access, it chains WriteSPN abuse, GMSA password extraction, shadow credentials, OU control, tombstone restoration, and finally an ESC15 ADCS exploit to forge an Administrator certificate and gain system compromise.
PUBLISHED ON
Blog Published on: September 28, 2025
Hack-The-Box - Medium - Windows - Puppy
ALL-BLOGS Hack-The-Box Pentesting Machines Writeup Season-8 Windows Medium Active-Directory Bloodhound Kerberos Smb Keepass Password-Spraying Genericwrite GenericAll DPAPI Evil-WinRM NetExec
Walkthrough of the HTB Puppy machine: starting with levi.james, the tester abuses HR’s GenericWrite to join DEVELOPERS, accesses a DEV SMB share, cracks a KeePass DB, and sprays creds to gain ant.edwards. Using SENIOR DEVS’ GenericAll, they activate adam.silver, find backups revealing steph.cooper creds, decrypt DPAPI data, and escalate to admin.