https://bokkapig.pages.dev/tags/active-directory/Recent content in Active Directory on bokkapigHugoen-gbSat, 24 Jan 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/overwatch/Sat, 24 Jan 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/overwatch/Windows AD DC with anonymous SMB share leaking .NET app credentials, MSSQL linked server DNS poisoning for credential capture, and WCF SOAP service command injection for SYSTEM access.https://bokkapig.pages.dev/writeups/baby/Tue, 18 Nov 2025 00:00:00 +0000https://bokkapig.pages.dev/writeups/baby/LDAP anonymous bind leaks an initial password in a user description; the target user (Caroline.Robinson) has STATUS_PASSWORD_MUST_CHANGE set, allowing password reset via SAMR; Backup Operators group membership enables direct flag read via FILE_OPEN_FOR_BACKUP_INTENT over SMB.https://bokkapig.pages.dev/writeups/eighteen/Sat, 15 Nov 2025 00:00:00 +0000https://bokkapig.pages.dev/writeups/eighteen/Windows Server 2025 DC with MSSQL impersonation leading to credential extraction, password spray for WinRM access, and BadSuccessor dMSA privilege escalation to Domain Admin.