https://josupalacios99.github.io/blog/en/tags/active-directory/Recent content in active-directory on root@j0suHugoen-US2026 root@j0su · think like the adversaryTue, 30 Jun 2026 10:00:00 +0200https://josupalacios99.github.io/blog/en/posts/adcs-ntlmrelayx-sid-extension/Tue, 30 Jun 2026 10:00:00 +0200https://josupalacios99.github.io/blog/en/posts/adcs-ntlmrelayx-sid-extension/ADCS relay with ntlmrelayx generates certificates that certipy v5 rejects with ‘Object SID mismatch’. The root cause is KB5014754: modern DCs require the certificate to contain the user’s SID in a Microsoft-proprietary extension. ntlmrelayx doesn’t include it. Here’s why and how to fix it.https://josupalacios99.github.io/blog/en/posts/adws-enumeracion-sigilosa-active-directory/Thu, 18 Jun 2026 10:00:00 +0200https://josupalacios99.github.io/blog/en/posts/adws-enumeracion-sigilosa-active-directory/Almost all Active Directory enumeration goes through LDAP (389/636), which is precisely the most watched channel in the domain. ADWS is a side door on port 9389 that accepts the same LDAP queries but is barely monitored. How it works under the hood, why its OPSEC is so good, and why it isn’t invisible.https://josupalacios99.github.io/blog/en/posts/veeam-backup-llave-maestra/Mon, 05 May 2025 09:57:36 +0000https://josupalacios99.github.io/blog/en/posts/veeam-backup-llave-maestra/Veeam Backup: what would happen if this protection solution became the entry point for a malicious actor? Two approaches to dump the SAM and extract DPAPI master keys while evading AV/EDR, using Veeam as a pivot toward critical services.