DarkZero
Full Active Directory compromise, replayed step by step. Real commands, real output, the whole foothold chain including what failed first.
Active Directory · HTB · Hard
Certifa
Loading environment0%
Offensive Security Student / NL
Break systems. Document truth.
I break Active Directory, Linux, and web targets on HackTheBox, then write down exactly how. Looking for my first red-team seat.
Certifa / DarkZero · HTB · Hard
Why know a little when you can know it all.
The Lab
Windows Server 2022 + two workstations
Every chain I read about gets rebuilt at home, outside the platform. Kerberos abuse, BloodHound paths, NTLM relay.
The Targets
Active Directory, Linux, web
HackTheBox machines, taken apart and written up in full. 9 on the record so far.
The Study
Cybersecurity & Cloud BSc
Hogeschool Utrecht. In progress, alongside everything else here.
# open ports come from the grepable "Ports:" line.# regex on free text kept missing them.entries = [e.strip() for e in ports_field.split(",")]for e in entries: parts = e.split("/") if len(parts) >= 3: port_s, state, proto = parts[0], parts[1], parts[2] if proto == "tcp" and state == "open" and port_s.isdigit(): open_ports.append(port_s) open_ports = sorted(set(open_ports), key=lambda x: int(x))
Master
0points
1902 / 2826 XP to level 76
0
Machines
0
Challenges
0
Global rank
The Paper · CJCA earned
CJCA
CPTS
CCNA
One down, two to go. This is the order they land in.
The Record · 9 machines
Pirate
Pre-Windows 2000 accounts leak a gMSA hash over Kerberos for WinRM on the DC. NTLM coercion relayed to unsigned LDAP sets up RBCD, then an SPN moved onto the DC reaches Domain Admin.
windows · active-directory · rbcd
Kobold
A wildcard TLS certificate leaks a subdomain running MCPJam Inspector, whose connect endpoint executes commands with no authentication. Privesc via docker group membership.
linux · web · subdomain-enum
CCTV
Default credentials on an exposed ZoneMinder console lead to blind SQL injection (CVE-2024-51482). Root via a loopback-bound motionEye reached over an SSH tunnel (CVE-2025-60787).
linux · web · zoneminder