[nitel@red-logs] ~ $ whoami
Offensive security professional specializing in web application penetration testing, network security assessments, and red team operations. I break things to help make them stronger.
Loading...
▸ 11 writeups — latest writeups
Restoring a tombstoned AD user to access a VSIX extension share, deploying a malicious VS Code extension for code execution as ryan.brooks, then abusing dMSA badSuccessor to compromise svc_deploy, and finally extracting the Administrator NTLM hash through memory forensics on a VM snapshot.
Starting with default domain credentials, abusing writable scriptPath for initial execution as l.wilson, then escalating through RBCD on an RODC, extracting the krbtgt_8245 hash via Mimikatz, forging an RODC golden ticket, and manipulating password replication groups to compromise the full domain.
Exploiting CVE-2026-23744 in MCPJam Inspector v1.4.2 for initial access, pivoting to analyst via Jupyter Lab RCE, then extracting root's SSH key through hidden API endpoints in a custom OPSMCP Flask server.
Exploiting CVE-2025-55182 (React2Shell) in Next.js 15.0.3 for initial code execution as node, cracking MD5 hashes from a SQLite database to pivot via SSH, then abusing the Node.js inspector debugger running as root for privilege escalation.
