smbclient

Linux machine chaining SMB enumeration, new-line command injection on an in-development router panel, cron job abuse, and a patched Diamorphine LKM rootkit for root.

Active Directory machine capturing NTLM hashes from a writable SMB share, Kerberoasting a service account, forging an MSSQL Silver Ticket, and escalating via SeImpersonatePrivilege.

Active Directory box enumerating users over SMB, reusing a weak password, abusing a writable logon script, and escalating through GPO.

Windows box abusing a path-traversal bug in hMailServer for credentials, capturing NTLM via a crafted email, and executing code through LibreOffice.

Windows machine exploiting an unprotected change-password endpoint via CSRF to hijack an account, planting a PHP webshell through an SMB-writable IIS site, and recovering Administrator credentials from a WSL bash history file.

Windows machine extracting MSSQL credentials from an Excel macro, capturing and cracking an NTLMv2 hash via xp_dirtree, enabling xp_cmdshell, and decrypting a Group Policy Preferences password for Administrator.

Active Directory machine where MSSQL abuse leaks credentials that feed into an AD CS certificate attack for full domain compromise.

Active Directory box where exposed SMB shares leak credentials that get reused, then Backup Operators membership is abused to dump domain hashes.

Active Directory machine covering AS-REP Roasting, BloodHound-guided lateral movement, LSASS credential extraction, and Backup Operators abuse.

Active Directory box capturing NTLM hashes, abusing SMB access and password reuse, pivoting through IIS, and escalating via SeImpersonatePrivilege.