Barbhack 2025 CTF (NetExec AD Lab) - Pirates

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://0xdf.gitlab.io/2026/01/29/barbhack-2025-ctf.html
• Blog Title: Barbhack 2025 CTF (NetExec AD Lab) - Pirates
• Suggested Section: Windows Hardening -> Active Directory Methodology (NTLM Relay / LDAP relay prerequisites) and/or Network Services Pentesting -> 139,445 - Pentesting SMB (NetExec tips); plus Web Pentesting -> Information Disclosure (passwords in HTML / hidden fields)

🎯 Content Summary

Post scope / lab context
Writeup of the Barbhack 2025 “Pirates” NetExec Active Directory lab (CTF) showing how a small set of common Windows/AD misconfigurations and information leaks can be chained into an AD foothold (and setting up for eventual full domain compromise). Domain: PIRATES.BRB. Author’s network uses 10.2.10.0/24 with attack VM 10.2.10.99.

Targets (Windows Server 2022 domain)
Four servers are identified:
- <b...

🔧 Technical Details

NetExec workspace + credential DB (“nxcdb”) for engagement state management: Use nxcdb to create per-target workspaces (e.g., workspace create pirates.brb) so host discovery and credentials found by netexec are persisted in per-protocol SQLite DBs under ~/.nxc/workspaces/<name>. Switch protocol views with proto smb|mssql|winrm and list stored secrets with creds. Since real credentials can be captured, sanitize by deleting the workspace directory (rm -rf ~/.nxc/workspaces/<name>).

Client-side secret disclosure in web UIs (masked password still in HTML): When an admin password field is “hidden” in the UI but embedded in the raw HTML (often as an input value), any user can recover it via view-source/devtools and then authenticate to protected endpoints. In this case, the leaked admin:hplaserbarbhack credential unlocked HTTP Ba...

🤖 Agent Actions

Updated windows-hardening/active-directory-methodology/README.md with a new NetExec-driven AD recon section covering workspace handling, SMB/LDAP signing posture checks for relay feasibility, hosts-file generation, and relay-to-LDAP considerations. Added guidance on harvesting hidden printer credentials in HTML, bulk validating paired user/password lists with NetExec, and appended the Barbhack 2025 CTF blog to references.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://0xdf.gitlab.io/2026/01/29/barbhack-2025-ctf.html

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening -> Active Directory Methodology (NTLM Relay / LDAP relay prerequisites) and/or Network Services Pentesting -> 139,445 - Pentesting SMB (NetExec tips); plus Web Pentesting -> Information Disclosure (passwords in HTML / hidden fields)".

Repository Maintenance:

• MD Files Formatting: 944 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0