Most people think VeraCrypt = unbreakable. But if you can extract the 512-byte header, it's just a hash.

I made a video walking through the full pipeline:

1. PowerShell extraction (container or raw disk)

2. Header prep for Hashcat

3. Mode selection and cracking

4. Verification

No physical access to the unlocked volume needed — just the header.

Full tutorial: https://youtu.be/iGPKBEYSdIw

I just finished the ShadowGate Active Directory lab on Hack Smarter and put together a full walkthrough.

The lab starts with VPN access and no credentials, and the attack chain ended up being much more interesting than I expected.

The progression was roughly:
- Anonymous SMB enumeration
- AS-REP Roasting
- Credential recovery
- BloodHound relationship/ACL enumeration
- GenericWrite abuse
- Targeted Kerberoasting
- AD CS enumeration
- ESC8 discovery
- NTLM relay
- Domain Controller certificate
- PKINIT authentication
- NTDS extraction
- KRBTGT compromise
- Full domain compromise

What I liked about this lab was that the individual findings weren't necessarily the whole story. The real lesson was understanding how multiple weaknesses can be chained together until an attacker eventually has control of the entire domain.

A properly hardened Active Directory environment should have controls in place that can break the attack chain at multiple points.

- Require Kerberos preauthentication
- Regularly audit dangerous permissions such as GenericAll, GenericWrite, WriteDACL and WriteOwner
- Use BloodHound or equivalent tools defensively to identify dangerous attack paths before an attacker does
- Monitor for unusual Kerberos service-ticket requests

You don't necessarily need to prevent every individual technique. If you can stop AS-REP roasting, prevent dangerous ACL abuse, eliminate NTLM relay paths, properly secure AD CS, and detect credential access, you can turn a potential zero-to-domain-admin attack chain into a series of blocked attempts.

I recorded the entire process here:

https://youtu.be/oOxTEfrdX7M

I'd be interested to hear how other people approached the attack chain, especially the AD CS / ESC8 portion.

What controls are you putting in place today to prevent this type of attack in your own AD environments?