Password Spraying

Linux machine chaining SNMP community-string enumeration, SSH password spraying, a world-writable cron script hijack, a Unix socket pivot, and a PATH-hijacked SUID binary for root.

Active Directory box enumerating users over SMB, reusing a weak password, abusing a writable logon script, and escalating through GPO.

Active Directory machine combining anonymous LDAP enumeration, password reset abuse, SeRestorePrivilege execution, and a manual NTDS extraction.

Windows box recovering Cisco device passwords, RID brute forcing usernames, password spraying, and pulling credentials from Firefox process memory.

Active Directory box where exposed SMB shares leak credentials that get reused, then Backup Operators membership is abused to dump domain hashes.

Machine built around an Azure AD Connect misconfiguration that leaks credentials and leads to domain compromise.