Guido Kroon

Enum mairon $ rustscan -a 10.129.8.223 --ulimit 5000 -- -A -sCV -oN mo nitorsfour.txt .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ |

Let’s add our target machine to /etc/hosts: mairon $ echo 10.129.24.44 facts.htb | sudo tee -a /etc/hosts Next, enumeration: mairon $ rustscan -a facts.htb --ulimit 5000 -- -Pn -n -v --open -A -sCV | tee rustscan.txt

Enum: mairon $ rustscan -a 10.129.232.128 --ulimit 5000 -- -Pn -n -v --open -A -sCV | tee rustscan.txt .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\

This was a real tough one, and I eventually got the System Flag in a very roundabout way.

I haven’t been pentesting for over 5 years now due to moving to new positions / roles.

I covered the basics of cracking hashes using Hashcat in an earlier post, and I had since been meaning to play around with Hashtopolis, but never really gotten to it.

These are some scribbles if I ever need to look up how to dump AD hashes (in various ways).

This machine was retired yesterday, so I decided to publish my writeup the day after.

This is my second writeup, after my first one covering the Conversor machine (machine not yet retired, therefore writeup not yet published).

My girlfriend and I bought a new house!

These are some notes describing how to build a deliberately vulnerable Active Directory test lab to test some well-known misconfigurations or exploits.

OpenWrt is an open source Linux project aimed at embedded devices to route network traffic (e.g. routers).

Languages Dutch (native) English (proficient) Swedish (beginner) Nationality Dutch Employment History May 2024 - present Holland Casino, Neptunusstraat 71, Hoofddorp, The Netherlands Information Security Manager Security advisory, monitoring, defining pol…

🔐 Passionate about InfoSec 🧑‍💻 Former pentester and Pentoo package maintainer 🌐 Open source, self-hosting and privacy advocate 🏛️ Digital sovereignty 📚 Tolkien enthusiast Views are my own unless stated otherwise.

When using NvChad, you may have come across the peculiar behaviour of Neovim exiting Insert mode when typing the letters j, and k, consecutively.

I finally started using Molly to send and receive messages via Signal.

Some time ago I documented how I configured WireGuard on my OpenWrt router at home, to connect securely to my home network (and the Internet, really) from wherever I am.

My previous post described how I migrated my girlfriend’s father from Windows 10 to Linux Mint.

The other day my girlfriend’s father briefly mentioned he was considering buying a new computer, because of Windows 10 being end-of-life soon, and his current computer’s specifications would be too low to upgrade to Windows 11 (I suspect the lack of TPM 2…

Last Friday, just before closing my laptop and enjoying my weekend I managed to break my EndeavourOS VM by accidentally shutting it down while it was still updating the kernel in another terminal session.

Troubling times ahead: Chat Control 2.0 is coming up, a law that would force all EU citizens to surrender their private messages, effectively breaking end-to-end encryption for everyone.

My previous post discussed the importance of EU’s digital sovereignty, especially considering historical and recent geopolitical developments, namely our overdependence on (US) Big Tech.

In an effort to practise digital sovereignty and reduce being dependent on (US) Big Tech, the EU is very, very slowly looking for secure digital alternatives, on its own soil.

My previous post discussed how to get a headless Steam instance running on TrueNAS SCALE.

These are some scribbles if I ever need to look up how to forge my own Kerberos Tickets, such as Silver, Golden, Diamond or Sapphire Tickets.

My previous post discussed the introduction of a Module-Lattice Key Encapsulation Mechanism (ML-KEM) post-quantum key exchange algorithm implementation in OpenSSH, and how to specify it in your SSH configurations.

OpenSSH 9.9, released on 2024-09-19, first introduced support for the new FIPS 203 Module-Lattice Key Encapsulation Mechanism (ML-KEM) post-quantum key exchange algorithm, previously known as Kyber.

I finally got hashcat running on Docker, with GPU support for NVIDIA cards.

After watching Lawrence Systems' video about why it’s time to move off TrueNAS CORE—which I had been putting off for too long already—I finally migrated to Community (SCALE).

These are some scribbles if I ever need to look up how to exploit Kerberoasting or AS-REP Roasting.

These are some scribbles if I ever need to look up how to exploit AD CS misconfigurations, such as ESC1.

This article has a personal touch.

I’ve been using Hashcat since I’ve been pentesting at my previous jobs, but I haven’t had the need to use it for a couple of years now.

GitLab Pages enables users to publish static web content via their repositories' CI/CD pipeline.

This post briefly describes how to configure an OpenWrt router to function as a WireGuard VPN server.

A Git presentation I made to onboard new hires.

An AsciiDoc presentation I made to onboard new hires.