netexec

Active Directory machine capturing NTLM hashes from a writable SMB share, Kerberoasting a service account, forging an MSSQL Silver Ticket, and escalating via SeImpersonatePrivilege.

Active Directory box enumerating users over SMB, reusing a weak password, abusing a writable logon script, and escalating through GPO.

Active Directory machine combining anonymous LDAP enumeration, password reset abuse, SeRestorePrivilege execution, and a manual NTDS extraction.

Windows box recovering Cisco device passwords, RID brute forcing usernames, password spraying, and pulling credentials from Firefox process memory.

Windows box abusing a path-traversal bug in hMailServer for credentials, capturing NTLM via a crafted email, and executing code through LibreOffice.

Windows machine exploiting an unprotected change-password endpoint via CSRF to hijack an account, planting a PHP webshell through an SMB-writable IIS site, and recovering Administrator credentials from a WSL bash history file.

Windows machine recovering Umbraco credentials from a world-readable NFS share, exploiting an authenticated Umbraco RCE for a foothold, and decrypting a TeamViewer 7 password from the registry for SYSTEM.

Windows machine using MSSQL injection to force NTLM authentication, gain WinRM access, and abuse the UniFi Video service for SYSTEM.

Windows machine extracting MSSQL credentials from an Excel macro, capturing and cracking an NTLMv2 hash via xp_dirtree, enabling xp_cmdshell, and decrypting a Group Policy Preferences password for Administrator.

Windows machine chaining PHP session poisoning for code execution, SMB-hosted RFI for a webshell, reused database credentials, and a malicious CHM help file for administrator.