reading list
HackSmarter: 23Aug Release
This is a list of HackSmarter Labs that I Released their blogs on Aug 23
15 articles
HackSmarter: ShadowGate
Shadowgate is an Easy Active Directory machine that chains AS-REP roasting and targeted Kerberoasting into ADCS exploitation. Starting from anonymous smb user enumeration to compromise jtrueblood and pivoting via BloodHound to bbrown, the attack abuses ESC8 via NTLM relay and coercion to obtain a Domain Controller certificate as dc01$ and perform DCSync.
HackSmarter: 404 Bank
404_bank is an AD machine rated Medium that covers Kerbrute, Shadow Credentials, RDP, Thunderbird, Zip cracking, ESC4 to ESC1
HackSmarter: Anomaly
anomaly is an AD machine rated Medium that covers Jenkins RCE, krb5.keytab, command injection, BloodHound, ESC1, WMIExec, GPO abuse
HackSmarter: Arasaka
arasaka is an AD machine rated Easy that covers Kerberoasting, Shadow Credentials, AD CS ESC1, Certipy, WinRM
HackSmarter: CityCouncil
CityCouncil is an AD machine rated Medium that covers Insecure LDAP sniffing, Kerberoasting, NTLM coercion, Targeted Kerberoasting, DPAPI, GenericAll, SeImpersonate
HackSmarter: Dismay
HSM dismay is an AD machine rated Medium that covers RDP, Recycle Bin, GenericAll, Shadow Credentials, ESC8, NTLM relay, DCSync
HackSmarter: Past
HSM Past is an AD machine rated Medium that covers Timeroasting, SYSVOL script, RBCD, S4U2Proxy, DCSync, PowerShell History
HackSmarter: ShadowGate2
HSM ShadowGate2 is an AD machine rated Medium that covers SQL injection, CVE-2026-32202, ACL abuse, Shadow Credentials, MSSQL, Logon Hours, ESC7, ESC3
HackSmarter: Slayer
Slayer is a Windows machine rated easy that covers SMB, RDP, Management folder, PowerShell History, Runas
HackSmarter: LumonIndustries
LumonIndustries is an AD machine rated Medium that covers SMB write, NTLM theft, Intranet portal, ForceChangePassword, LAPS, LSA Secrets, DCC2
HackSmarter: MartiniAD
martiniAD is an AD machine rated Easy that covers SMB Guest, Kerberoasting, Password reuse, DCSync, Secretsdump
HackSmarter: ShareThePain
ShareThePain is an AD machine rated Medium that covers SMB Guest, library-ms, NetNTLMv2, GenericAll, WinRM, MSSQL xp_cmdshell, SeImpersonate
HackSmarter: StellarComms
StellarComms is a Windows machine rated Medium that covers Anonymous FTP, WriteOwner, ForceChangePassword, WinRM, Firefox credentials, GMSA, DCSync
HackSmarter: Sysco
sysco is a Windows machine rated Medium that covers Fuzzing, Roundcube, AS-REP Roasting, Cisco Type 5, Password reuse, PuTTY plaintext, GPO abuse
HackSmarter: Welcome
Welcome is an AD machine rated Easy that covers SMB share, PDF cracking, Password spraying, Shadow Credentials, ForceChangePassword, ESC1