~/home ./writeups ./bounties ./membership ./news ./forums ./tools ./about ./contact

~/home ./writeups ./membership ./news ./forums ./tools ./bounties ./about ./contact

Pirate - HTB Machine Writeup

Difficulty: Hard | OS: Windows | Status: Completed

Exploit a Pre-Windows 2000 machine account to dump gMSA hashes, pivot through a Ligolo-ng tunnel, and chain RBCD relay with SPN injection to achieve full Domain Admin on a multi-host Active Directory environment.

Tags: Active Directory, Kerberos Delegation, NTLM Relay

[ LOADING MACHINE DATA... ]

_

ONLINE

Privacy Policy Terms of Service

© 2026 0xJerry. All rights reserved.

|Built in the shadows///

Pirate - HTB Writeup | 0xJerry's Lab