Blackfield

Thu, 30 Jul 2026 10:00:00 -0500

Summary
#

Blackfield is an Active Directory box that rewards patience with SMB. Anonymous access to a share leaks a user list; one of those users has Kerberos pre-authentication disabled, which means an AS-REP roast and an offline crack. That foothold can force a password reset on a second account, which can read a memory dump of LSASS left on a backup share — and the hash inside it opens a door with SeBackupPrivilege, enough to walk out with the entire domain database.

Hard on SirZak

Blackfield

Summary #

Summary
#