Nathaniel Cyber Security
About meSocial
  • About Me
  • Homelab
    • Change SSH Port
    • Install Docker Ubuntu
    • Portainer
    • Install Active Directory
    • Setting up Wireguard
    • Managing WireGuard Logs with Systemd and Logrotate 🔥
    • Cloudflare Tunnels: The Cybersecurity Pro's Secret Weapon for Secure Cloud Access
    • 🧠💥 How I Routed My Entire Lab's HTB Traffic Through a Single VPN Box
    • Opening SSH with Root Access to the World: A Controlled Honeypot Experiment
  • CyberSecurity
    • Insecure Direct Object References (IDOR)
    • HTTP Verb Tampering
    • SSH Attack
    • Basic Bash
    • Nmap
    • DNS Attacks
      • DNS Zone Transfer Attack
    • IMAP & POP Attack
    • SMTP
      • SMTP Attacks
    • SMB Attack
    • NFS Attacks
    • SNMP Attack
    • MYSQL attacks
    • IPMI
    • SSL Attacks
    • Transferring Files
    • Linux Configured WebServer with Upload
    • PowerShell Web Downloads
    • Personal web server
    • Windows Authentication Process
    • Attacking SAM
    • CrackMapExec
    • Attacking LSASS
    • Create SMB server Linux (HACK)
    • Pypykatz
    • Attacking Active Directory & NTDS.dit
    • Evil-WinRM
    • WinRM Attacks
    • Active Directory Terminology
    • Active Directory Objects
    • Active Directory
    • Active Directory Functionality
    • NTLM Authentication
    • Active Directory Rights and Privileges
    • Pass the Ticket (PtT)
    • Kerberos
    • Pass the Ticket (PtT) from Windows
    • FTP Bounce Attack
    • MSSQL Attacks
    • RDP Attack
    • crowbar
    • Local File Inclusion (LFI)
    • Remote File Inclusion (RFI)
    • Linux Shared Libraries Attacks
    • Linux Shared Object Hijacking
    • Microsoft Guide to all Windows command
    • Windows Event Log Readers
    • Windows DnsAdmins Attacks
    • Hyper-V Administrators Attacks
    • Windows Print Operators
    • Windows Server Operators
    • Windows User Account Control Bypass
    • Extracting Clipboard data Windows
    • Windows Credential Hunting
    • Cmdkey Saved Credentials
    • Retrieving Saved Credentials from Chrome windows
    • Extracting KeePass Hash
    • Online Hash Crackers
    • Hashcat
    • Creating Custom wordlists
    • Extracting windows wifi password
    • Wordpress Attacks
    • Joomla Attacks
    • Drupal Attack
    • Tomcat Attacks
    • Jenkins Attacks
    • Splunk Attacks
    • PRTG Network Monitor Attacks
    • Gitlab Attacks
    • Tomcat CGI Attacks
    • Attacking Thick Client Applications
    • LLMNR Poisoning
    • Inveigh
    • InveighZero
    • Password Spraying - Making a Target User List ACTIVE Directory
    • Kerbrute
    • statistically-likely-usernames
    • linkedin2username
    • windapsearch
    • Internal Password Spraying - from Linux ACTIVE Directory
    • Internal Password Spraying - from Windows ACTIVE Directory
    • DomainPasswordSpray
    • Local Administrator Password Solution (LAPS)
    • LAPSToolkit
    • LDAP Filtering Explained
    • Kerberoasting
    • Mimikatz
    • Bypass Powershell Execution Policy
    • Bypassing AV Signatures for PowerShell
    • Setup Static IP Linux
    • iptables-linux
    • auditd
    • Setup Static IP linux
    • Install Wiregard VPN
    • List Dangerous PHP functions
  • Blog
    • The Journey of how I passed CISSP
    • How Nmap gets what OS is running by using different probes
    • How PsExec or similar tools operate over SMB to achieve remote command execution
    • Beyond Session Hijacking: Using JavaScript Libraries for Comprehensive User Profiling Through XSS
    • Why does encoded message have a = or ==
    • What Does "/bin/bash -p" Do?
    • Extract username from private SSH key
    • Purpose of Service Principal Names (SPN) in Active Directory
    • Get Passwords from Teamviewer windows (No Metasploit)
    • Difference between actively logged on users, locally logged on users and remotely logged users
    • Packet Flow in RouterOS
    • Depixelating information in the document (finding what was not supposed to be found)
    • Spotting Spoofing Securing Your Email with DMARC, DKIM, and SPF
    • Stop Telling People to “Just Look at the URL”: You're Not That Special
    • 🧠 NFS Isn’t Just File Sharing — It’s RPC in Disguise
    • 😤 I Had Write Permissions... So Why Was Linux Saying "No"?
    • 🧠 Post-Root Enlightenment: Why You Really Pwn Boxes — Thanks to IppSec
    • From Chaos to Compliance A Smart Audit Logging Strategy for MariaDB
  • CTF-Walkthrough
    • Exploiting the HTB “Networked” Box: From Recon to Root
    • Exploiting Ghosts from the Past — Irked | Hack The Box
    • 🧠 Real-World Security Lessons from HTB’s Postman: Misconfig to Root📮
    • 🕵️ HTB: OpenAdmin – RCE, Privilege Escalation, and the Art of Improvisation
    • 📦 HTB: Time – Deserialization, Java Shenanigans & Root in Style
    • HTB-Forge: Double SSRF to Root Breaking Forge from the Inside Out 🧨
    • 🔥 HTB: Traverxec – From RCE to Root with a Nostalgic Bang
    • 🪄 HTB Walkthrough – making a magical walkthrough with Magic
    • 🛡️ HTB Writeup: Passage – From News to Root
Powered by GitBook
On this page
Edit on GitHub
  1. CyberSecurity

Pass the Ticket (PtT)

  • read into Kerberos

Attack Windows

  • Pass the Ticket (PtT) from Windows

PreviousActive Directory Rights and PrivilegesNextKerberos

Last updated 11 months ago