Technical Debt

Hack.lu2026

Task: Windows AD infra with a DC (ADDS+ADCS+DNS) and a member server exposing a leftover WDS REMINST share. Solution: de-obfuscate the unattend autologon password (strip trailing 'Password'), abuse a GPO the service account fully controls to run a SYSTEM command, dump the machine account, request an ESC17 cert and serve a rogue HTTPS WSUS.