https://varadkj.github.io/Cybersecurity portfolio focusing on Active Directory exploitation, Black Box penetration testing, and HTB writeups. 2026-05-16T05:02:17-04:00 Varad KJ https://varadkj.github.io/ Jekyll © 2026 Varad KJ /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2026-05-16T00:00:00-04:00 2026-05-16T00:00:00-04:00 https://varadkj.github.io/posts/htb-authority/ Varad KJ

Authority is a medium-rated Windows AD box from the HTB CPTS track. it starts with guest-readable SMB shares leaking Ansible playbooks containing vault-encrypted credentials. after cracking the vault and intercepting cleartext LDAP creds through a misconfigured PWM instance, we get a foothold as a service account. for privesc, we exploit a classic ADCS ESC1 misconfiguration — a certificate temp...

2026-05-12T00:00:00-04:00 2026-05-12T01:40:08-04:00 https://varadkj.github.io/posts/voleur-htb-writeup/ Varad KJ

Voleur — HackTheBox Writeup Difficulty: Medium OS: Windows Server (Active Directory) Key Concepts: Kerberos-only authentication, Targeted Kerberoasting (WriteSPN), AD Tombstone Object Restoration, DPAPI Credential Decryption, WSL Pivot, NTDS.dit Dump Overview Voleur is a medium-rated Windows AD box where NTLM is completely disabled — every authentication step must go through Kerberos. We s...

2026-05-08T00:00:00-04:00 2026-05-10T05:40:08-04:00 https://varadkj.github.io/posts/streamio-htb-writeup/ Varad KJ

StreamIO — HackTheBox (Medium) StreamIO was a medium rated Windows box, but honestly it felt somewhere between medium and hard — and it was very lengthy. The attack chain goes: SQL injection on a movie search page → credential dumping → LFI/RFI to RCE → lateral movement through backup DB creds and Firefox saved passwords → AD ACL abuse via WriteOwner → LAPS password read → Domain Admin. Let’s...

2026-05-06T00:00:00-04:00 2026-05-14T21:36:19-04:00 https://varadkj.github.io/posts/silentium-htb-writeup/ Varad KJ

Walkthrough of HackTheBox Silentium — a medium Linux box chaining Flowise account takeover (CVE-2025-58434) and RCE (GHSA-3gcm-f6qx-ff7p) with Docker container escape and Gogs symlink arbitrary file write (CVE-2025-8110) for root.

2026-05-04T00:00:00-04:00 2026-05-04T00:00:00-04:00 https://varadkj.github.io/posts/htb-administrator/ Varad KJ

Administrator — HackTheBox Difficulty: Medium OS: Windows Server 2022 IP: 10.129.28.107 As is common in real life Windows pentests, you start this box with credentials for the following account: Olivia:ichliebedich. The box is a pure AD ACL abuse chain — enum, enum, and more enum. Reconnaissance Nmap Full port scan first: └─$ nmap 10.129.28.107 -vv -o...