Tafadzwa Mwerenga — HTB Walkthroughs¶
Junior Penetration Tester · Active Directory & Web Exploitation · Harare, Zimbabwe
Welcome. This site is my personal collection of Hack The Box machine walkthroughs, focusing on Active Directory attack chains, Linux privilege escalation, and web application exploitation. Every machine documented here has been retired by HTB before publication.
Profile Snapshot¶
| HTB Username | phasetafadzwa |
| Rank | Apprentice — Grade 3 / 3 |
| Level | 30 (Season 11 active competitor) |
| Fully Rooted | 16 machines |
| Total Pwns | 24+ |
| Focus | Active Directory · Web App Pentesting · Linux Privesc |
Pwn Log¶
Fully Rooted (User + System)¶
| Date | Machine | OS | Track | Writeup |
|---|---|---|---|---|
| 5 May 2026 | Overwatch | Windows | AD | Read → |
| 25 Feb 2026 | DarkZero | Windows | AD | Coming soon |
| 9 Feb 2026 | CodePartTwo | Linux | Web/Code | Coming soon |
| 9 Feb 2026 | Signed | Linux | Crypto/Code | Coming soon |
| 13–14 Jan 2026 | Sauna | Windows | AD | Read → |
| 9 Jan 2026 | Trick | Linux | Web | Read → |
| 4–5 Jan 2026 | Authority | Windows | AD / ADCS | Read → |
| 4 Jan 2026 | Craft | Linux | API / Vault | Read → |
| 1 Jan 2026 | Return | Windows | AD | Read → |
| 30 Nov 2025 | Puppy | Mixed | AD | Coming soon |
| 28 Nov 2025 | Fluffy | Windows | AD | Coming soon |
| 19 Nov 2025 | Jerry | Windows | Web | Coming soon |
| 19 Nov 2025 | Active | Windows | AD | Coming soon |
| 8 Nov 2025 | Analysis | Windows | AD | Read → |
| 24–27 Oct 2025 | Vintage | Windows | AD | Coming soon |
| 3 Oct 2025 | Intelligence | Windows | AD | Coming soon |
User Flag (in progress)¶
| Date | Machine | OS | Status |
|---|---|---|---|
| 25 Mar 2026 | Office | Windows | Notes → |
| 5 Feb 2026 | Mentor | Linux | User flag captured |
| 27 Jan 2026 | PC | Linux | User flag captured |
| 25 Jan 2026 | HackNet | Linux | User flag captured |
| 15 Dec 2025 | Certificate | Windows | User flag captured |
| 1 Dec 2025 | TombWatcher | Windows | User flag captured |
| 26 Nov 2025 | Planning | Linux | User flag captured |
| 20 Nov 2025 | Jeeves | Windows | User flag captured |
| 2 Jan 2026 | Forest | Windows | Notes — privesc pending |
Featured Attack Chains¶
- Authority — Ansible vault decryption → PWM rogue LDAP capture → ADCS ESC1 abuse with Certipy → Domain Admin
- Return — LDAP credential interception via custom Python listener on port 389 → service account → Server Operators → SYSTEM
- Craft — Git commit history mining → API code execution → Docker pivot → HashiCorp Vault SSH OTP abuse → root
- Sauna — Web user enumeration → AS-REP Roasting → autologon registry → DCSync → Domain Admin
- Trick — DNS zone transfer → SQL injection → LFI → fail2ban action file privesc
Tools & Custom Scripts¶
Custom tooling used across these engagements is published in the Tools section →, including:
- A Python LDAP capture listener that intercepts service account binds on port 389 (used on Return)
- A reconnaissance automation harness for nmap, dirsearch, and vhost fuzzing
- Reverse shell payload templates for PHP and Windows
Contact¶
- Email: ts.mwerenga@gmail.com
- LinkedIn: linkedin.com/in/tafadzwamwerenga
- GitHub: github.com/ts1mwerenga
- HTB: app.hackthebox.com/profile/phasetafadzwa
About these writeups
Every machine documented on this site has been retired by Hack The Box before publication, in line with HTB's content disclosure policy. Walkthroughs include the full kill-chain — reconnaissance, foothold, privilege escalation — with annotated screenshots and the exact commands used.