HTB · Tier 0

PingPong

Two-domain AD forest under Assumed Breach. NTLM disabled globally. TCP port 88 asymmetrically filtered — a custom impacket monkey-patch unblocks Kerberos. ESC13 on TemporaryWinRM template grants WinRM shell on DC1. ……

April 27, 2026 · 7 min · crAIzy
MSSQL RCE