Pirate

Pirate - hack the-box retired machine walkthrough.

Approach

Pre-Windows 2000 Compatible Access group membership

LSA Secrets storing cleartext domain credentials

RBCD abuse via NTLM relay to LDAPS

SPN write privileges for non-admin accounts

Dump domain credentials

Loading writeup from GitHub...