HTB Certified Writeup — Shadow Credentials, ACL Chains & ADCS ESC9 (2026)
Assumed breach AD box. WriteOwner abuse on a group, double shadow credentials chain, and ADCS ESC9 certificate abuse to Domain Admin.
Acl-Abuse
HTB Forest Writeup — AS-REP Roasting, BloodHound & DCSync (2026)
Second AD box. AS-REP Roasting with no creds, BloodHound attack path through 5 nested groups, ACL abuse to DCSync.