Platform Hack The Box Difficulty Easy OS Windows Points 20 Release 2020-02-22 Tags AD, AS-REP Roasting, DCSync Sauna is a deceptively rich Active Directory box. Despite its Easy rating, it walks you through three classic AD attack primitives — AS-REP Roasting, credential reuse via AutoLogon, and DCSync — making it one of the best beginner boxes for anyone preparing for OSCP, CRTP, or AD-heavy red team interviews. ...
The Windows privilege escalation surface has narrowed since the days of unquoted-service-path goldmines, but it hasn’t disappeared. Token abuse, misconfigured services, and overlooked AutoLogon registry entries still net SYSTEM on a meaningful percentage of corporate hosts. Step 0: Baseline whoami /all systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type" hostname whoami /all is the single most informative command. Look at: ...
Kerberoasting remains the highest-ROI Active Directory attack: any authenticated domain user can request a service ticket for any account with a Service Principal Name (SPN), and crack that ticket offline. No special privileges. No exploits. Just Kerberos working as designed. ...