john

A practical Linux privilege escalation reference covering high-impact enumeration checks, common misconfigurations, credential hunting, container escapes, and last-resort kernel exploits.

Active Directory machine capturing NTLM hashes from a writable SMB share, Kerberoasting a service account, forging an MSSQL Silver Ticket, and escalating via SeImpersonatePrivilege.

Windows box recovering Cisco device passwords, RID brute forcing usernames, password spraying, and pulling credentials from Firefox process memory.

Windows box abusing a path-traversal bug in hMailServer for credentials, capturing NTLM via a crafted email, and executing code through LibreOffice.

Windows machine recovering Umbraco credentials from a world-readable NFS share, exploiting an authenticated Umbraco RCE for a foothold, and decrypting a TeamViewer 7 password from the registry for SYSTEM.

Windows machine using MSSQL injection to force NTLM authentication, gain WinRM access, and abuse the UniFi Video service for SYSTEM.

Windows machine extracting MSSQL credentials from an Excel macro, capturing and cracking an NTLMv2 hash via xp_dirtree, enabling xp_cmdshell, and decrypting a Group Policy Preferences password for Administrator.

Windows machine using a Jenkins build step for remote code execution, a KeePass database for a Pass-the-Hash credential, and an alternate data stream hiding the root flag.

Linux machine exploiting a public OpenNetAdmin RCE, chaining reused database credentials into an internal-only site, and abusing a sudo-permitted nano binary for root.

Linux machine exploiting Joomla information disclosure and authenticated template editing to pull database credentials, then escalating via apport-cli.