https://3x0t1k.github.io/Security notes, write-ups and research by Andrii Horodov. 2026-08-17T07:37:15+00:00 Andrii Horodov https://3x0t1k.github.io/ Jekyll © 2026 Andrii Horodov /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2026-08-15T00:00:00+00:00 2026-08-16T08:44:00+00:00 https://3x0t1k.github.io/posts/local-privesc/ Andrii Horodov

Introduction At this point in our engagement we have credentials for r.nilson - obtained through password spraying, as covered in the first post. With those credentials we ran Kerberoasting against the domain and cracked svc_sql. That gives us access to the SQL server - svc_sql is the account we’ll use there, not r.nilson directly. This post covers an alternative path. In the previous post we...

2026-08-12T00:00:00+00:00 2026-08-14T06:27:21+00:00 https://3x0t1k.github.io/posts/kerberos-asreproasting-kerberoasting/ Andrii Horodov

Introduction In Active Directory Penetration Testing: How It All Starts I mentioned both AS-REP Roasting and Kerberoasting as techniques for getting a first credential. But I glossed over the details - what they actually are, how they differ from each other, and how Kerberos authentication differs from NTLM in the first place. This post fills in that gap. We’ll cover how Kerberos actually wor...

2026-08-12T00:00:00+00:00 2026-08-14T06:28:10+00:00 https://3x0t1k.github.io/posts/acl-abuse-dcsync/ Andrii Horodov

Introduction We’ve covered the path from a Linux foothold to Active Directory enumeration and getting first credentials in Active Directory Penetration Testing: How It All Starts. From there, we went deeper into specific techniques - how Responder, LLMNR, and NBT-NS actually work in that post, and the mechanics behind AS-REP Roasting and Kerberoasting in this one. Now the question becomes: we...

2026-08-11T00:00:00+00:00 2026-08-14T06:25:50+00:00 https://3x0t1k.github.io/posts/llmnr-nbtns-poisoning/ Andrii Horodov

Introduction In the previous post - Active Directory Penetration Testing: How It All Starts - I briefly showed how Responder fits into the picture when you’re stuck in a network segment with nothing useful to work with. We captured a NetNTLMv2 challenge-response, cracked it with hashcat, and got a valid credential. But what if the hash doesn’t crack? And more importantly - why does any of thi...

2026-08-11T00:00:00+00:00 2026-08-14T06:28:55+00:00 https://3x0t1k.github.io/posts/initial-enumeration-active-directory/ Andrii Horodov

Introduction If we’re talking about Active Directory pentesting, we’re already inside the client’s internal network. (Not a victim’s network - that would be illegal, and also a very different kind of blog post.) Most of the time, in my personal experience, the foothold machine is a Linux host. That’s because the most common path in is through a poorly written web application running on Apache...