Access — Credential Sprawl Across Legacy Services
Anonymous FTP and archive recovery expose credentials that grant Telnet access, then escalate through cached credential abuse.
Security case studies
taktak.hu
I document offensive-security and digital-forensics work: repeatable methods, evidence, and analysis from Linux and Windows machines and DFIR investigations. Browse the curated highlights, then filter the full case-study explorer by focus or keyword.
70published studies
67machine studies
3DFIR studies
2content types
Browse by focus
Choose an analytical lens.
35
Linux machine
Web and service exploitation, credential recovery, and local privilege escalation.
32Windows machine
Active Directory attack paths, delegation, and domain escalation.
3DFIR / Sherlock
Timeline reconstruction, log analysis, and persistence.
↗Training & Profiles
Hands-on learning and profile links.
Latest additions
The six most recently added case studies, by portfolio-addition date.
Windows machine
EscapeTwo — AD CS ESC4 Template Abuse via WriteOwner and Shadow Credentials
A share readable by a low-privileged domain account exposes a live MSSQL sa credential, enabling command execution and configuration-file password reuse before AD CS ESC4 template abuse issues a certificate for the administrative identity.
- Objective
- Escalate from a low-privileged domain account to domain administrative access through credential discovery, MSSQL command execution, and AD CS template-permission abuse.
- Tools
- netexec, smbget, impacket, certipy, evil-winrm
- Skill demonstrated
- Active Directory escalation through credential reuse, MSSQL command execution, and AD CS certificate-template abuse
- Outcome
- Administrative certificate authentication through an ESC4-abused template, reached after shadow-credential recovery of the CA service account hash and configuration-file password reuse.
Bashed: Web Shell to Scheduled-Task Privilege Escalation
Web enumeration exposes an accessible PHP web shell for command execution, followed by a constrained sudo identity transition and a writable root-executed script to reach root.
Linux machineBlocky: Plugin Source Exposure to Privileged Access
Web enumeration exposes a custom Java plugin; decompilation reveals hardcoded credentials for SSH access, and an unrestricted sudo policy yields root.
Linux machineBoardLight — Dolibarr RCE to Enlightenment Privilege Escalation
Virtual host enumeration reveals a Dolibarr CRM instance with default credentials; authenticated RCE, credential reuse, and an Enlightenment SUID flaw chain to root.
Linux machineBroker: ActiveMQ Exposure and Unsafe Daemon Sudo
An Apache ActiveMQ deployment with a vulnerable OpenWire service and default console credentials yields a service-account shell; unrestricted nginx sudo enables a root file-write path.
Linux machineBuilder: Jenkins CLI File Read and Credential Exposure
Unauthenticated Jenkins CLI file read (CVE-2024-23897) exposes a password hash and Script Console access, and credential storage reveals a path to root.
Case-study explorer
70 results
Browse all 70 published case studies, then narrow by focus or keyword.
Active Directory Certificate Abuse via SMB Share Disclosure
An SMB share exposes a protected certificate archive, and PowerShell history leaks a service account with LAPS read access.
AD CS ESC1 Through Anonymous SMB and MSSQL Coercion
Anonymous SMB and MSSQL coercion recover credentials, then AD CS ESC1 certificate abuse yields the privileged account NT hash.
Administrator — Multi-Hop Active Directory Compromise
Misconfigured object permissions drive a multi-hop chain through Kerberoasting, credential capture, and DCSync to domain compromise.
Aero — ThemeBleed and CLFS Privilege Escalation
A malicious Windows theme upload on the ThemeBleed path yields a shell, then CLFS abuse escalates to SYSTEM.
AI Platform Attack-Chain Case Study
A password-reset token returned in an API response, unsafe dynamic configuration evaluation in an AI-agent platform, and container secret exposure chain through an internal service to privileged access.
Authority — AD CS ESC1 via Ansible Vault Credential Exposure
An exposed Ansible vault and rogue LDAP listener expose service credentials, enabling ESC1 certificate abuse for Domain Administrator.
Availability Checker — Git Exposure, Race Condition, and Unsafe Privilege Boundaries
Exposed version-control metadata and a custom-header development virtual host lead to an upload blocklist bypass and race condition for a web-service shell; a SUID Python 2 input() helper and a package-installer sudo rule reach root.
Bashed: Web Shell to Scheduled-Task Privilege Escalation
Web enumeration exposes an accessible PHP web shell for command execution, followed by a constrained sudo identity transition and a writable root-executed script to reach root.
Blocky: Plugin Source Exposure to Privileged Access
Web enumeration exposes a custom Java plugin; decompilation reveals hardcoded credentials for SSH access, and an unrestricted sudo policy yields root.
BoardLight — Dolibarr RCE to Enlightenment Privilege Escalation
Virtual host enumeration reveals a Dolibarr CRM instance with default credentials; authenticated RCE, credential reuse, and an Enlightenment SUID flaw chain to root.
Breach: Active Directory Delegation Exposure
A guest-readable logon script and excessive directory permissions lead through Kerberos delegation abuse to domain compromise.
Broker: ActiveMQ Exposure and Unsafe Daemon Sudo
An Apache ActiveMQ deployment with a vulnerable OpenWire service and default console credentials yields a service-account shell; unrestricted nginx sudo enables a root file-write path.
Brutus — SSH Compromise Timeline and Persistence Analysis
HTB Sherlock case study covering SSH authentication analysis, session correlation, and privileged-account persistence.
Builder: Jenkins CLI File Read and Credential Exposure
Unauthenticated Jenkins CLI file read (CVE-2024-23897) exposes a password hash and Script Console access, and credential storage reveals a path to root.
Busqueda: Searchor Injection and Relative-Path Sudo Abuse
Unsafe evaluation in a Searchor search request yields command execution; exposed Git credentials, container environment inspection through sudo, and relative-path execution in a root script extend access.
Cascade: LDAP, SMB, and Recycle Bin Credential Exposure
Anonymous LDAP disclosure, SMB configuration artifacts, audit-app analysis, and AD Recycle Bin data combine into a credential-exposure chain.
CCTV: Chaining ZoneMinder SQL Injection and motionEye Command Injection
A time-based blind SQL injection in ZoneMinder recovers credential hashes for SSH access, then filename command injection in a root-run motionEye service leads to root.
Certified: Escalating an Active Directory ACL Chain Through ESC9
Group and account-control permissions form an ACL chain ending in AD CS ESC9 certificate abuse.
Cicada: Active Directory Credential Chaining via Guest SMB Access
Guest SMB, LDAP attributes, and embedded script credentials chain into Backup Operators hive extraction and domain compromise.
CMS CVE-2025-24893 to Monitoring-Agent PATH Hijack
XWiki SolrSearch unauthenticated Groovy code execution (CVE-2025-24893) provides a foothold; reused database credentials enable SSH, and a SUID Netdata ndsudo helper is hijacked through PATH to reach root.
Container Monitoring Lab — API IDOR to Privileged Container Escape
An API access-control flaw exposes password hashes, and an unauthenticated Docker daemon allows a privileged container escape to host root.
CozyHosting: Spring Boot Actuator Exposure and Command Injection
A Spring Boot Actuator session leak grants admin access and command injection in the SSH feature provides a foothold; credentials from the application JAR and an SSH ProxyCommand sudo rule lead to root.
Data: Grafana Path Traversal to Container Escape
Grafana path traversal (CVE-2021-43798) extracts the application database for offline credential cracking, and a permissive docker exec sudo rule mounts the host filesystem to reach root.
Delegate — Active Directory Unconstrained Delegation via NETLOGON Script Credentials
NETLOGON script credentials and GenericWrite over a delegation admin enable Kerberoasting, PetitPotam coercion, and DCSync.
EscapeTwo — AD CS ESC4 Template Abuse via WriteOwner and Shadow Credentials
A share readable by a low-privileged domain account exposes a live MSSQL sa credential, enabling command execution and configuration-file password reuse before AD CS ESC4 template abuse issues a certificate for the administrative identity.
Expressway: IKE Aggressive Mode to Sudo Hostname Bypass
IKE Aggressive Mode with PSK authentication exposes a crackable hash for SSH access, and a non-standard sudo binary is abused through a hostname-based policy bypass (CVE-2025-32463) to reach root.
Fries
A Gitea credential leak and pgAdmin container RCE lead through NFS certificate extraction and Docker control to ESC7 domain compromise.
Heist — Cisco Config Leak to Firefox Credential Extraction
A leaked Cisco configuration yields SMB and WinRM access, then Firefox process memory recovery exposes the Administrator password.
Helix: Apache NiFi CVE-2023-34468, Operator-Role SSH Key, and OPC UA Maintenance Window
Unauthenticated Apache NiFi command execution through CVE-2023-34468 and an H2 database driver, a recovered operator SSH key, and a cracked operations guide open an OPC UA maintenance window that grants root.
Help: GraphQL Credential Leak to HelpDeskZ Upload RCE
A GraphQL endpoint leaks HelpDeskZ credentials and an attachment-upload weakness stores rejected PHP files under predictable names for web-service code execution; a kernel eBPF flaw (CVE-2017-16995) escalates to root.
HTB Craft — eval() Injection, Credential Reuse, and Vault SSH OTP
Leaked Gogs source exposes hardcoded API credentials and a Flask eval() call for container root; database credential reuse, a Gogs SSH key, and HashiCorp Vault SSH OTP then provide host root.
Intelligence — PDF Metadata Enumeration, DNS Injection, and GMSA Silver Ticket
PDF metadata and a default onboarding password enable DNS record injection and NTLM capture, then GMSA silver-ticket abuse reaches Domain Administrator.
Interpreter — Mirth Connect Unauthenticated RCE and Flask eval() Privilege Escalation
Mirth Connect XStream deserialization (CVE-2023-43208) provides an unauthenticated shell; database credentials and a PBKDF2 hash give SSH access, then a double eval() in a root-owned Flask service yields root.
Jerry: Tomcat Default Credentials to SYSTEM Shell
Default Tomcat Manager credentials allow WAR deployment, producing an immediate SYSTEM shell.
Keeper — Default Credentials to KeePass Memory Disclosure
Default Request Tracker credentials and a password stored in a comment field provide user access; KeePass master-password recovery from a crash dump (CVE-2023-32784) unlocks an unencrypted root SSH key.
Knife: PHP Supply Chain Backdoor and Sudo Binary Escalation
A backdoored PHP 8.1.0-dev build executes code through the User-Agentt header, and an unrestricted sudo rule for the Chef knife tool is abused via knife exec to reach root.
Linux Lab — Exposed Git, CMS RCE, and Symlink Protection Bypass
An exposed .git directory on a development virtual host reveals a CMS password for authenticated RCE; a sudo cleanup script with a user-controlled glob and a two-hop symlink chain bypass kernel symlink protection to read a protected file.
Linux Web Service Backup Disclosure and Local Privilege Escalation
Virtual host enumeration exposes an administrative interface and a pre-authentication backup disclosure that leaks AES key material; decrypting the application database recovers an SSH credential, and local enumeration identifies a privilege-escalation path.
LogJammer: Windows Event Log Incident Reconstruction
HTB Sherlock case study reconstructing a single-host Windows event-log timeline with Chainsaw: interactive logon, discovery-tool detection, audit-policy tampering, scheduled-task persistence, and Firewall log clearing.
Magic: SQL Injection, File Upload Bypass, and PATH Hijack
SQL injection in a login page and PNG magic-byte upload evasion provide a foothold; MySQL credentials tunneled through Chisel and reused admin credentials enable lateral movement, and a SUID sysinfo binary is hijacked through PATH to reach root.
Manager — AD CS ESC7 via Certificate Authority Abuse
RID brute forcing, password spraying, and a legacy backup expose ManageCA rights, enabling the AD CS ESC7 abuse chain to domain compromise.
Monteverde — Azure AD Sync Credential Extraction
Guest SMB null authentication and a stored CliXml credential lead to Azure AD Sync database decryption and a domain administrator password.
MSSQL Impersonation, Shadow Credentials, and DCSync on Windows AD
A weakly secured MSSQL database yields cracked credentials, then badsuccessor OU delegation and DCSync complete domain compromise.
NanoCorp — NTLM Relay Chain to Domain Dominance via MSI Repair Abuse
A zip-upload SSRF captures an NTLMv2 hash, and delegation abuse plus an MSI repair flaw create a domain administrator.
Networked: CentOS Web Shell Upload and Command Injection Chain
A leaked backup exposes upload source with weak MIME and extension checks, enabling a double-extension PHP web shell; command injection through filenames in a cron script and input validation gaps in a sudo network script lead to privileged access.
Orion: Craft CMS pre-auth RCE to local telnet bypass
Craft CMS pre-authentication RCE (CVE-2025-32432) and plaintext database credentials lead to an administrator hash and SSH access; a GNU inetutils telnet authentication bypass (CVE-2026-24061) on loopback yields root.
Outbound: Roundcube RCE to Symlink Privilege Escalation
Authenticated Roundcube RCE (CVE-2025-49113) and session-table password decryption with the application DES key lead to SSH access; a symlink attack on the below utility's error log (CVE-2025-27591) yields root.
Overwatch — ADIDNS Poisoning and WCF SOAP Command Injection
A monitoring binary leaks MSSQL credentials; ADIDNS poisoning captures more, and WCF command injection returns a SYSTEM shell.
Pandora
SNMP enumeration leaks credentials for SSH access; an internal Pandora FMS instance reached through SSH dynamic forwarding is SQL-injected for session hijacking, and a SUID backup binary calling tar by relative name enables PATH hijacking to root.
Pirate: AD Chain from Time Skew to Domain Controller Compromise
Kerberos clock-skew alignment, gMSA enumeration, and an NTLM relay pivot lead through delegation abuse to domain controller compromise.
Ransom — PHP Type Juggling and ZipCrypto Known-Plaintext
A PHP loose-comparison flaw bypasses authentication; a ZIP archive's ZipCrypto encryption is broken via known-plaintext to recover an SSH key, and a hardcoded credential in Laravel source provides root.
Reaper: Correlating an NTLM Relay Investigation
Correlating a packet capture with Windows Security event logs to investigate a suspected NTLM relay and authenticated SMB share activity.
Resolute: LDAP Credential Exposure and DNSAdmins Privilege Escalation
An LDAP description attribute and PowerShell transcripts expose administrative credentials, then DNSAdmins abuse loads a malicious DLL for SYSTEM.
Retro: AD CS ESC1 via Guest SMB Disclosure and Pre-created Computer Account
Guest SMB notes and a pre-created computer account lead to an ESC1 certificate template and administrator impersonation.
Return — LDAP Credential Capture via Printer Admin Panel
A printer admin panel's LDAP configuration is redirected to capture service credentials, then Server Operators escalation reaches Administrator.
Sau — SSRF Chain to Maltrail Command Injection and Pager Escape
SSRF in request-baskets (CVE-2023-27163) reaches an internal Maltrail service vulnerable to command injection, and a NOPASSWD systemctl status rule is escalated through a less-pager escape (CVE-2023-26604) to root.
Scrambled — Weak Password Reset and Kerberos Ticket Forgery in Active Directory
A weak password reset enables Kerberoasting and silver-ticket forgery, then SeImpersonate abuse escalates to SYSTEM via GodPotato.
Soccer: Web Application Access to dstat Privilege Escalation
Default credentials on exposed file-management software and an executable upload provide a web-service shell; WebSocket SQL injection recovers an SSH credential, and a doas rule for dstat is abused through plugin loading to reach root.
SSRF to GitPython Privilege Escalation
SSRF in a book-cover upload exposes an internal API and development credentials; Git history reveals production credentials, and a sudo-permitted GitPython script vulnerable to CVE-2022-24439 yields root.
Strutted — Legacy Struts Upload and tcpdump Sudo Hook
An exposed application archive identifies legacy Apache Struts upload handling, and CVE-2024-53677 path traversal yields a service-account shell; a stored credential enables SSH, and a sudo tcpdump post-rotate hook reaches root.
Support — Credential Exposure and Delegation Risk
Guest-accessible tooling, reversible credential obfuscation, and excessive computer-object permissions form a path to privileged access.
TheFrizz — Gibbon LMS Access and Active Directory Escalation Path
Gibbon LMS enumeration and database credential recovery lead to a Group Policy Creator Owners path toward Domain Administrator.
Titanic — Path Traversal to ImageMagick Shared-Library Hijacking
A download endpoint's path traversal exposes Gitea configuration and database data for password recovery and SSH access; an ImageMagick shared-library hijack (CVE-2024-41817) in a scheduled process provides elevated access.
Usage: SQL Injection, Upload Validation Bypass, and 7-Zip Wildcard Abuse
SQL injection in a password-reset workflow and a Laravel-admin upload-validation bypass provide a foothold; reused Monit credentials enable SSH, and wildcard and @listfile handling in a sudo 7-Zip backup reach a protected root key.
Voleur — Active Directory Credential and Backup Abuse Chain
Share-hosted documents, Kerberoasting, AD Recycle Bin recovery, and a WSL pivot lead into offline directory-backup analysis.
Wifinetic: Backup Exposure, Credential Reuse, and WPS Escalation
Anonymous FTP exposes an OpenWrt backup containing a wireless key reused for SSH access; a raw-packet-capable reaver and a default WPS PIN recover a WPA key that grants root SSH.
WifineticTwo — ICS and Wireless Pivot
Default OpenPLC credentials and a Structured Text C extension provide container root; wireless scanning and a WPS PixieDust attack recover a WPA passphrase, and association leads to passwordless root SSH on a router.
Windows AD Lab — Log Leak, Shadow Credentials, and Rogue Update Service
A log-file credential leak, Shadow Credentials abuse, and a rogue update server chain to SYSTEM code execution.
Windows Mail Lab — Path Traversal to Client and Document-Processor Escalation
A mail server path traversal exposes a configuration hash, and a crafted document triggers privileged code execution on a client host.
No studies match filters. Try another focus or search term.