↓ Skip to main content
bubka hacks stuff

Kerberoasting

ELK-Perfect Survey

ELK SOC SIEM Log Analysis Active Directory Kerberoasting SQL Injection CVE-2021-24762 WordPress RBCD AD CS Privilege Escalation Sqlmap WPScan
An attacker conducted reconnaissance with Nmap and WPScan against a WordPress site, exploited CVE-2021-24762 in the Perfect Survey plugin via SQLi to extract wp_users password hashes, then pivoted into Active Directory by Kerberoasting alonso.x, creating a rogue computer account, abusing RBCD, and escalating to domain administrator via AD CS certificate abuse.