https://itsavery.me/blog/Security engineering writeups, malware analysis, and homelab projects by Avery Hughes. 2026-10-27T19:30:04-04:00 Avery Hughes https://itsavery.me/blog/ Jekyll © 2026 Avery Hughes /blog/assets/img/favicons/favicon.ico /blog/assets/img/favicons/favicon-96x96.png 2026-09-01T14:30:00-04:00 2026-10-27T19:29:45-04:00 https://itsavery.me/blog/posts/teams-vishing-msi-python-rat/ Avery Hughes

A real-world intrusion attempt that started with a Microsoft Teams call from "IT support" and ended with an encrypted, in-memory Python RAT. Full kill chain, C2 infrastructure, and IoCs.

2025-10-13T21:30:00-04:00 2025-10-13T21:30:00-04:00 https://itsavery.me/blog/posts/baby-htb/ Avery Hughes

Baby is an easy Windows machine. Anonymous LDAP enumeration reveals a hidden OU with an account flagged to change its password at next logon. Once in, that user turns out to be a Backup Operator, which we abuse with diskshadow and SeBackupPrivilege to copy NTDS.dit off the domain controller and dump every hash in the domain.

2025-10-08T01:30:00-04:00 2025-10-08T01:30:00-04:00 https://itsavery.me/blog/posts/certified-htb/ Avery Hughes

Certified is a medium Windows machine built entirely around Active Directory permission abuse and ADCS. Starting from low-privileged credentials, we take ownership of a group, run a shadow credential attack to steal a service account, force-change another account's password, and finish by exploiting ADCS ESC9 to authenticate as the domain Administrator.

2025-09-01T12:36:00-04:00 2025-09-01T12:36:00-04:00 https://itsavery.me/blog/posts/object-htb/ Avery Hughes

Object is a hard Windows machine running Jenkins automation server. The automation server is found to have registration enabled and the registered user can create builds. Builds can be triggered remotely by configuring an api token. Foothold is obtained by decrypting the Jenkins secrets. The foothold user is found to have ForceChangePassword permissions on another user called smith. This privilege abuse allows us to gain access to smith. smith has GenericWrite permissions on maria. Abusing this privilege allows us to gain access to the server as this user. maria has WriteOwner permissions on Domain Admins group, whose privileges we exploit to get a SYSTEM shell.

2025-08-29T10:40:21-04:00 2025-08-29T10:40:21-04:00 https://itsavery.me/blog/posts/active-htb/ Avery Hughes

Active is an easy to medium difficulty machine, which features two very prevalent techniques to gain privileges within an Active Directory environment.