Recent content on Guido Kroon
Enum mairon $ rustscan -a 10.129.8.223 --ulimit 5000 -- -A -sCV -oN mo nitorsfour.txt .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : :…
Let’s add our target machine to /etc/hosts : mairon $ echo 10.129.24.44 facts.htb | sudo tee -a /etc/hosts Next, enumeration: mairon $ rustscan -a facts.htb --ulimit 5000 -- -Pn -n -v --open -A -sCV | tee rustscan.txt .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-'…
Enum: mairon $ rustscan -a 10.129.232.128 --ulimit 5000 -- -Pn -n -v --open -A -sCV | tee rustscan.txt .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ :…
This was a real tough one, and I eventually got the System Flag in a very roundabout way. I really suspect there had to be easier ways to get that flag, but I could not figure out how to get around the walls I encountered left and right. Anyway, let’s get to it. Starting this machine, we already have basic credentials: As is common in real life Windows penetration tests, you will start the…
I haven’t been pentesting for over 5 years now due to moving to new positions / roles. But lately I decided to dust off some of my dormant pentesting skills. Over the past few days I’ve completed the HTB Starting Point machines after work. All but the VIP (paid) ones. I’m rusty, but most basic skills came back pretty quickly. After each machine I quickly regained courage to keep at it and try…
I covered the basics of cracking hashes using Hashcat in an earlier post , and I had since been meaning to play around with Hashtopolis , but never really gotten to it. Until now, that is. Hashtopolis is an open source platform based on Hashcat to crack password hashes in a distributed manner. For each large hash cracking task, it chops up the work and distributes each chunk to separate systems,…
These are some scribbles if I ever need to look up how to dump AD hashes (in various ways). I might expand on this later… ℹ️ This is nothing new, most of this stuff can be easily found on the Internet. This is just for my own reference. Please excuse my brevity. This posts strictly limits itself to post-exploitation, after already having obtained DA credentials. Dumping Requesting a Kerberos…
This machine was retired yesterday, so I decided to publish my writeup the day after. CodePartTwo is an easy machine, which runs a Flask web app vulnerable to RCE due to an outdated and vulnerable library it uses. Once exploited we can dump and crack the registered users' passwords hashes (MD5). That gives us a SSH access, along with the User Flag. Retrieving the Root Flag exploits a weakness in a…
This is my second writeup, after my first one covering the Conversor machine (machine not yet retired, therefore writeup not yet published). I fell into a few rabbit holes trying to pwn this one, I’m sad to say. We’ll get to that part as well, but first: enum. mairon $ nmap -Pn -n -v --open --top 5000 10.129.7.105 Starting Nmap 7.98 ( https://nmap.org ) at 2026-01-26 21:12 +0100 Initiating Connect…
My girlfriend and I bought a new house! And with it, an (older) Itho Daalderop CVE ECO 2SP mechanical ventilation unit. Itho Daalderop is a Dutch brand selling ventilation appliances and heating systems. I believe they mostly sell their products in The Netherlands. Figure 1. Our Itho Daalderop CVE ECO 2SP ventilation unit The above ventilation unit keeps the air in our house (specifically our…
These are some notes describing how to build a deliberately vulnerable Active Directory test lab to test some well-known misconfigurations or exploits. I might expand on this later… ℹ️ This is nothing new, most of this stuff can be easily found on the Internet. This is just for my own reference. Please excuse my brevity. This article assumes a Windows Server 2022 system (VM), and a non domain…
OpenWrt is an open source Linux project aimed at embedded devices to route network traffic (e.g. routers). I’ve consistently run OpenWrt on my home routers for over a decade now (I still remember the brief LEDE split), and it has since been my preferred home router OS. While I’ve also wanted to experiment with OPNsense (and pfSense before), I’ve never had a real reason to thus far, but I digress……
🔐 Passionate about InfoSec 🧑💻 Former pentester and Pentoo package maintainer 🌐 Open source, self-hosting and privacy advocate 🏛️ Digital sovereignty 📚 Tolkien enthusiast Views are my own unless stated otherwise. PGP fingerprint 2A9DF1D597A0539033C9B3EB394C398C531EFAB0 SSH public key ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICTtufd+r+Loakaa7Nj1bgbsthk0EPYeExak02KAFLNm CV
Languages Dutch (native) English (proficient) Swedish (beginner) Nationality Dutch Employment History May 2024 - present Holland Casino, Neptunusstraat 71, Hoofddorp, The Netherlands Information Security Manager Security advisory, monitoring, defining policies, supplier management, contract management, coordinating penetration tests, incident response, purple teaming. Implemented DAST, SAST. Jul…
When using NvChad , you may have come across the peculiar behaviour of Neovim exiting Insert mode when typing the letters j , and k , consecutively. This can be pretty annoying when writing in Dutch, using the -(e)lijk suffix (e.g. begrijpelijk , namelijk , wezenlijk ), which is pretty common. I found the following line (8) in ~/.config/nvim/lua/mappings.lua to be the culprit: 1 2 3 4 5 6 7 8 9 10…
I finally started using Molly to send and receive messages via Signal . Molly is a hardened fork of Signal for Android, offering features such as an encrypted message database , automatic locking, shredding no longer needed secrets from RAM, notifications via UnifiedPush , and Tor / SOCKS proxy support. This is by no means an alternative to Signal itself, but rather an alternative (and hardened)…
Some time ago I documented how I configured WireGuard on my OpenWrt router at home, to connect securely to my home network (and the Internet, really) from wherever I am. I feel safer connecting to public Wi-Fi this way, also abroad when it allows me to save extra roaming costs. However, during my travels I sometimes come across networks which seem to block VPN connections, sometimes including my…
My previous post described how I migrated my girlfriend’s father from Windows 10 to Linux Mint. While doing so, I used the default Ext4 filesystem, as opposed to Btrfs, for the root partition. No big deal, but Btrfs makes it a whole lot easier snapshotting the filesystem and rolling back if needed. Timeshift can automatically take care of all that, and it allows for some more peace of mind while…
The other day my girlfriend’s father briefly mentioned he was considering buying a new computer, because of Windows 10 being end-of-life soon, and his current computer’s specifications would be too low to upgrade to Windows 11 (I suspect the lack of TPM 2.0, but I’m not sure). The man is in his mid 70s and regularly uses his computer to browse the Internet, communicate using social media, reply on…
Last Friday, just before closing my laptop and enjoying my weekend I managed to break my EndeavourOS VM by accidentally shutting it down while it was still updating the kernel in another terminal session. It no longer booted as a result. To fix it, I found a helpful blog post by Edmund Goodman which proved useful, albeit slightly different from my environment. Goodman was using GRUB and Ext4 ,…
Troubling times ahead: Chat Control 2.0 is coming up, a law that would force all EU citizens to surrender their private messages, effectively breaking end-to-end encryption for everyone. I’m sad to see this issue is back on the table again (after previous failed attempts ), and even more saddened by the severe lack of critical thinking and media coverage around this topic. Just in case you missed…
My previous post discussed the importance of EU’s digital sovereignty, especially considering historical and recent geopolitical developments, namely our overdependence on (US) Big Tech. This post will focus on the Dutch elections coming up next month. So far I’ve seen some but overall little interest from most major parties to invest heavily in digital sovereignty, apart from of course the Pirate…
In an effort to practise digital sovereignty and reduce being dependent on (US) Big Tech, the EU is very, very slowly looking for secure digital alternatives, on its own soil. While the EU acknowledges this threat, it is not a new one, really. The classic example being Europe’s overdependence on Microsoft, and being turned into a Software Colony as a result. Even more so when Europe increasingly…
My previous post discussed how to get a headless Steam instance running on TrueNAS SCALE. I had a spare GPU which I wanted to repurpose to play (older) video games without first needing to boot my desktop. This post roughly documents how I run my Home Assistant instance on my TrueNAS SCALE server. The official website details several installation methods , which mainly comes down to two…
These are some scribbles if I ever need to look up how to forge my own Kerberos Tickets, such as Silver, Golden, Diamond or Sapphire Tickets. I might expand on this later… ℹ️ This is nothing new, most of this stuff can be easily found on the Internet. This is just for my own reference. Please excuse my brevity. Environment Previously , I’ve documented (also for myself) how to Kerberoast and…
My previous post discussed the introduction of a Module-Lattice Key Encapsulation Mechanism (ML-KEM) post-quantum key exchange algorithm implementation in OpenSSH, and how to specify it in your SSH configurations. ML-KEM is the new FIPS 203 standard, previously known as Kyber, which was standardized by NIST on 2024-08-13. OpenSSH’s implementation of ML-KEM is a PQ/T hybrid approach that combines…
OpenSSH 9.9 , released on 2024-09-19, first introduced support for the new FIPS 203 Module-Lattice Key Encapsulation Mechanism (ML-KEM) post-quantum key exchange algorithm, previously known as Kyber. ML-KEM was formally standardized by NIST on 2024-08-13, and is designed to be secure against quantum attacks, making it a suitable choice for future-proofing cryptographic systems. The OpenSSH…
I finally got hashcat running on Docker, with GPU support for NVIDIA cards. First, I needed to install Docker and NVIDIA Container Toolkit on my system, and add my user to the docker group. root $ pacman -S --needed docker nvidia-container-toolkit root $ systemctl enable --now docker.service root $ usermod -aG docker user Then I created a Dockerfile to set up the hashcat environment with NVIDIA…
After watching Lawrence Systems' video about why it’s time to move off TrueNAS CORE—which I had been putting off for too long already—I finally migrated to Community (SCALE). I guess it was the last push I needed, really. I even migrated most of my services inside my VMs to either separate TrueNAS Apps, or vanilla docker containers I manage via Dockge (such as Nextcloud AIO ). But then I also…
These are some scribbles if I ever need to look up how to exploit Kerberoasting or AS-REP Roasting. I might expand on this later… ℹ️ This is nothing new, most of this stuff can be easily found on the Internet. This is just for my own reference. Please excuse my brevity. Environment For this article, we’re assuming the following (change accordingly): user $ echo $SHELL /usr/bin/ fish user $ which…
These are some scribbles if I ever need to look up how to exploit AD CS misconfigurations, such as ESC1. I might expand on this later… ℹ️ This is nothing new, most of this stuff can be easily found on the Internet. This is just for my own reference. Please excuse my brevity. Environment For this article, we’re assuming the following environment (change accordingly): user $ echo $SHELL /usr/bin/…
This article has a personal touch. Sure, it’s a (somewhat) technical article, but I mainly did this for my girlfriend. I never documented this, but now that I made a personal website with Hugo , I decided it’s worth a post. This took place somewhere in late spring / early summer 2023. Me and my girlfriend only knew each other a couple of months and we were just getting steady. We didn’t live…
I’ve been using Hashcat since I’ve been pentesting at my previous jobs, but I haven’t had the need to use it for a couple of years now. Recently I had another use case for it but I still don’t need to use nearly as often as I once did. I therefore decided to document some of this to easily look things up in the future. Extracting All Hashes from Active Directory To copy all hashes from Active…
GitLab Pages enables users to publish static web content via their repositories' CI/CD pipeline. You can use any static site generator, like Gatsby, Jekyll, Hugo, Middleman, Harp, Hexo, or Brunch. You can also publish any website written directly in plain HTML, CSS, and JavaScript. ℹ️ Pages does not support dynamic server-side processing, for instance, as .php and .asp requires. For more…
This post briefly describes how to configure an OpenWrt router to function as a WireGuard VPN server. This enables me to have my phone always be securely connected to my home router, from wherever I am. This is what it roughly looks like: First, install the necessary WireGuard kernel module: root # opkg update root # opkg install kmod-wiregard Generate a new private and public key pair for the…
An AsciiDoc presentation I made to onboard new hires.
A Git presentation I made to onboard new hires.