Active Directory
Here are a set of commands, utilities and attacks to exploit the different vectors in Active Directory.
x4v1l0k's Blog | Cybersecurity Reports & Cheat Sheets
Welcome to x4v1l0k's cybersecurity blog — a hands-on library of penetration testing write-ups, Active Directory attack paths, and practical cheat sheets from real labs and certification work (including OSCP). Posts focus on reproducible steps: enumeration, privilege escalation, lateral movement, and post-exploitation notes you can reuse in authorized engagements.
Browse by type: penetration testing reports, offensive cheat sheets, and in-depth articles. Prefer topics? Open the full tag index for Active Directory, Windows, Linux, web attacks, and more. New to the author? See the About Me page.
Every write-up aims to be clear enough for learners and precise enough for practitioners: commands, screenshots, and reasoning — not just spoilers. Use the search box in the sidebar to jump into a technique or box name, then follow related posts from the tags on each page.
What you will find here
The feed below mixes long-form lab reports (VulnLab, HackMyVM, and similar), certification notes, and reference sheets for Kerberos, ADCS, privilege escalation, and web app testing. Content is written for authorized learning and professional Red Team practice — always stay in scope and respect the law.
Prefer a reading list? Start with the OSCP notes collection, the Active Directory reference, and the latest cards below. Subscribe via the RSS feed if you want updates without social media noise.
DLL Hijacking in Evope.Service – SYSTEM to GUI Shell
A privilege escalation vulnerability was discovered in Evope.Service, where a missing dependency loaded from the application directory allows an attacker to execute arbitrary code with NT AUTHORITY\SYSTEM privileges.
OSCP
Here are a set of commands, utilities and attacks collected for the OSCP certification.
HackMyVM - MagiFi
MagiFi is a machine with vulnerabilities like SSTI for remote execution, credential capture via WiFi attacks, and privilege escalation using a malicious binary disguised as a PNG.
Vulnlab - Breach
This post describes a complete attack chain executed in a practice lab environment. The process began with enumerating exposed services, followed by exploiting writable SMB shares to capture NTLMv2 hashes. The credentials obtained were used to perform Kerberoasting, and the cracked service account credentials facilitated a Silver Ticket attack to gain administrative control. Each step is detailed below, highlighting the vulnerabilities and exploitation techniques.
Vulnlab - Trusted
This report outlines the exploitation and escalation of a multi-domain Active Directory environment involving two servers: labdc.lab.trusted.vl and trusteddc.trusted.vl. The attack progression includes LFI (Local File Inclusion) leading to credential disclosure on labdc.lab.trusted.vl, command injection through database manipulation, credentials extraction to lateral movement and Cross-Domain Escalation using Golden Ticket.
Vulnlab - Hybrid
This write-up outlines the exploitation and escalation of a vulnerable infrastructure consisting of two hosts mail01.hybrid.vl and DC01.hybrid.vl. Key vulnerabilities include NFS Misconfiguration leading to file access and impersonation, command injection in a RoundCube plugin, Weak certificate template permissions allowing privilege escalation via ESC1 and Kerberos credential extraction enabling further lateral movement.
Vulnlab - Bamboo
This write-up documents the process of identifying and exploiting vulnerabilities on a server hosting a Squid proxy and a vulnerable instance of PaperCut NG. Privilege escalation is achieved by leveraging weak file permissions and a misconfigured scheduled execution of a trusted binary.
Vulnlab - Baby2
This write-up details the exploitation of a Windows domain controller vulnerable to several misconfigurations, leveraging SMB access, password spraying, and GPO abuse to escalate privileges from a low-privileged user to domain administrator.
Vulnlab - Sync
This post details the exploitation of a Linux server running FTP, HTTP, Rsync, and SSH services. The attack involves leveraging the Rsync service to retrieve sensitive information, crack hashed credentials, and ultimately escalate privileges to root.