Checkpoint - HTB Machine Writeup

Difficulty: Medium | OS: Windows | Status: Completed

A walkthrough of HTB's Checkpoint machine, chaining AD object restoration, a malicious VS Code extension upload, Kerberos delegation, and DMSA BadSuccessor abuse to extract an admin hash from a VMware memory snapshot for full domain compromise.

Tags: Active Directory, BadSuccessor/DMSA Abuse, Malicious VSCode Extension