HTB Querier Writeup — MSSQL Exploitation (2026)
SMB guest access → Excel macro with MSSQL creds → Responder hash steal via xp_dirtree → xp_cmdshell → reverse shell.
Impacket — The Tools I Actually Use
Quick reference for the Impacket tools I use most — mssqlclient, GetUserSPNs, GetNPUsers, secretsdump, psexec, and more.
My Enumeration Workflow — What I Run and Why
The enumeration methodology I use on every box. Port scanning, service enumeration, and what to check first.
PG Algernon Writeup — SmarterMail Deserialization RCE (2026)
Proving Grounds box — anonymous FTP, SmarterMail on a weird port, .NET deserialization RCE straight to SYSTEM. No privesc needed.