Recent content on hun.io

 Introduction
 
 
 Link to heading 
 
 
 Note: The research and tooling covered in this post are not my original work,. All credit goes to Yaxxine7 for creating the ASRepCatcher tool and doing all the heavy lifting! 
 AS-REP roasting is a well-documented Kerberos attack where an attacker can obtain and crack hashes for accounts with preauthentication disabled.…

 Introduction
 
 
 Link to heading 
 
 
 NTLM downgrade attacks have been around for a while and are well known against systems like Windows Server 2012. After obtaining an NTLMv1 response with a custom challenge, it’s relatively straightforward to recover the victim user or machine’s raw NT hash via a rainbow table . 
 With newer versions of SMB, the…

 Introduction
 
 
 Link to heading 
 
 
 In June of 2025, a friend sent me a new .gov website that had recently been spun up less than 18 hours prior. I decided to look at the technologies the website was running and how information was displayed, and found an interesting URL parameter that looked something like this: 
…

 My current phone
 
 
 Link to heading 
 
 
 In December of 2022, I bought a refurbished iPhone X, and it has been a great daily driver. Even today, the battery still gets me through a full day of light use, and the camera continues to take incredible photos and videos. It’s been outstanding for a phone that released in September of 2017 - over eight years ago now.

 My current gaming setup - A2
 
 
 Link to heading 
 
 
 After recently downsizing my homelab , my original intention was to keep using my Windows 11 VM with my 2TB SSD and RTX A2000 passed into it, whom I’ve aptly named A2. :) 
 While this worked great using Apollo as the server - especially for its ability to dynamically change resolution based on a client…

 The problem
 
 
 Link to heading 
 
 
 A few weeks ago, I completed my homelab downsize , and it’s been absolutely amazing. Virtually perfect, except for one problem. In my Minisforum MS-01, the A2000 with its custom N3rdware cooler reaches temperatures that are way too high for comfort. 
 Sometimes the card idles around 70°C, climbing easily to 96°C during gaming…

 My current homelab
 
 
 Link to heading 
 
 
 Since I started my homelab journey in 2018, it has changed tremendously - from a pile of reused hardware to building new servers, and eventually consolidating everything into a 19" 12U rack. 
 
 It’s not actually in the bathroom - I just like this picture. :) 
 A few years ago, I took on a project to…

 Wild West Hackin’ Fest
 
 
 Link to heading 
 
 
 Wild West Hackin’ Fest , hosted by Black Hills Information Security , is an annual cybersecurity conference held in Deadwood, South Dakota and Denver, Colorado. Like other conferences, Wild West features booths with industry leaders, presentations from well-known speakers, competitions, official trainings,…

 Framework mystery boxes
 
 
 Link to heading 
 
 
 Framework , a company focused on manufacturing repairable and modular devices, offers a cool product called a mystery box. These mystery boxes contain various components that have been returned from their service centers, and instead of wasting the hardware, Framework instead puts together random assortments and sells…

 The inspiration behind this
 
 
 Link to heading 
 
 
 In Active Directory exploitation, Kerberos delegation is easily among my top favorite vectors of abuse, and in the years I’ve been learning Kerberos exploitation, I’ve noticed that Impacket doesn’t get nearly as much coverage as tools like Rubeus or Mimikatz. 
 From a penetration testing…

 TL;DR
 
 
 Link to heading 
 
 
 If you only have access to a valid machine hash, you can leverage the Kerberos S4U2Self proxy for local privilege escalation, which allows reopening and expanding potential local-to-domain pivoting paths, such as SEImpersonate! 
 
 Introduction
 
 
 Link to heading 
 
 
 
 What is Kerberos?
…

 Introduction
 
 
 Link to heading 
 
 
 One day, a friend and I were bored one night, so we decided to look for some fun Minecraft mod malware floating around on the internet. We each dug around for our own samples, and I came across this video on YouTube: 
 
 This just looks like a traditional cheat for gaining experience in the large Minecraft server,…

 What is noPac?
 
 
 Link to heading 
 
 
 NoPac, released in 2021, is an Active Directory privilege escalation exploit that abuses two vulnerabilities and one function in Active Directory: 
 
 CVE-2021-42278 : A vulnerability in the Windows Security Account Manager (SAM) that allows the spoofing of a computer’s sAMAccountName , or computer name. 
…
Within the last week, a group of friends and I spontaneously decided to compete in the 2025 Global Game Jam , a yearly competition where teams of any size have 48 hours to create a video game based on a specific theme. 
 Being cybersecurity students with absolutely zero game design experience, we thought this would be a tremendously fun weekend project and challenge, so we decided to…
Within the last two weeks, our team placed first in the world in a hacking competition, and I want to talk a little bit about it as well as what I’ve learned throughout this experience! 
 
 About the competition
 
 
 Link to heading 
 
 
 The Collegiate Penetration Testing Competition (CPTC) is essentially a competition where teams conduct a penetration test…
With the release of my first blogpost on this new site, I also wanted to do a quick writeup on what I did to build it! This setup is heavily inspired by NetworkChuck’s Obsidian + Hugo video , as this was perfect for my use, so definitely consider checking out his video too! 
 
 Tooling
 
 
 Link to heading 
 
 
 My blogpost workflow revolves around two amazing…
A few weeks ago, I decided to pick up an old 11-inch 2013 Macbook Air on eBay. When Action Retro released this phenomenal video about putting Linux on an old Macbook Air , I was heavily inspired to do this for myself. 
 With the M1 being the only laptop I own right now, why would I need another one? Aside from loving older hardware, I do have a few needs for a second device.
Throughout my time on Substack and YouTube, I’ve only very briefly mentioned my server and never really dived into the details at all. 
 As I’ve mentioned in my previous article , I do want this to change, and I have since been devoting tons of my spare time toward my home lab, offensive security, and related projects/extracurriculars, all of which are used on my server. 
 With…
I’ve been wanting to build my own router, as there are so many benefits. 
 From self-hosting my own DNS server, whole-home ad-blocking, hosting my own VPN, and more, the possibilities are endless. I’ve kind of procrastinated this project for a while, but the catalyst for doing it now was our home upgrade to fiber internet. 
 When our new ISP arrived, their DHCP range was…
Hey there! Hope you are doing well. 
 This is the Framework laptop, and it’s been one of my dream systems since its release in July of 2021. 
 
 For those who don’t know, the Framework laptop is a consumer and right-to-repair focused device. It’s modular, repairable, and recently, Framework has followed their promise for making the laptop upgradable with the release…