GS-037: SHADOWGATE (P2) + WEBVERSE — AD CS Abuse + NTLM Relay | 2026-08-20
Source: YouTube · HaxrByte · published Aug 21, 2026 · 2:36:06
[BLUF] Axabyte conducts a live pentesting stream, attempting to exploit an Active Directory ESC8 vulnerability on the "Shadowgate" machine, followed by solving web application challenges on WebVerse Labs, while troubleshooting significant technical issues with both his tools and streaming platforms.
Key Takeaways:
• The streamer begins by setting up the "Shadowgate" lab and analyzing BloodHound data to identify a user, B Brown, who has outbound control over domain users and is a member of the ADCS Readers group 2:15.
• He identifies the ESC8 vulnerability, which allows an attacker to enroll for a certificate with an Application Policy Client Service (APC) mapping to the Enterprise Admins group, effectively granting domain admin privileges 14:00.
• Attempting to exploit this via a certificate relay, Axabyte encounters persistent errors with Certipy and NTLRelay, highlighting the importance of having a robust, tested toolset for complex AD attacks 25:00.
• Due to technical difficulties, the stream shifts to WebVerse Labs, where he solves the "Gatekeeper" challenge by exploiting a SQL injection in the login form to bypass authentication and retrieve the master provision key 46:00.
• He then tackles the "Yard Lines" e-commerce challenge, using SQLMap to identify and exploit a SQL injection in the category filter to dump the database and find the flag 22:00.
• Throughout the stream, Axabyte emphasizes the value of hands-on practice and solving CTFs blind to demonstrate real-world troubleshooting and thought processes rather than just polished walkthroughs 17:00.
Closing Statement:
The stream highlights the complexities of real-world pentesting, from navigating AD certificate services to debugging web app vulnerabilities, while also showcasing the WebVerse platform as a valuable resource for learning web security.
Sources:
- 2:15 Reviewing BloodHound relationships for the Shadowgate machine.
- 14:00 Identifying the ESC8 vulnerability in Active Directory.
- 25:00 Troubleshooting Certipy and relay tools.
- 46:00 Solving the Gatekeeper SQL injection challenge.
- 22:00 Exploiting the Yard Lines SQL injection with SQLMap.
- 17:00 Discussion on the importance of blind CTF practice.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 2 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
And we are live. Hey everyone, I hope everyone is doing well. Welcome to the stream. My name is Axabyte. I run this YouTube channel. Uh I also stream on on Twitch, Kick, LinkedIn, and uh yeah, I normally stream on Thursdays, but uh yeah, we we are here to train your hacker brain or well, I should say, let's train our hacker brains together. So, it's good to see everyone. Uh let me just check if everything looks okay. Hey, Dog Trace. Hope you're doing well. Bristol Pete. Nice. Welcome back again. Nice to see you again. Sweet. I'm not on mute. No, I [clears throat] should be good. Let's um let's see. I think we should just dive right in. Um, and whoever whoever joins joins and they can just ask questions. How's everybody doing? Nice. Dr. says he did some really good hack the box machines ove…