ITSEC Newsletter 2026-08-13

This article presents a complete, end-to-end attack chain using impacket-reg against a Windows Server 2019 domain controller in the ignite.local lab. It covers twenty-three techniques: four authentication methods, three enumeration targets, credential harvesting, RDP enablement, registry key lifecycle management, payload delivery, Run-key persistence, and a live reverse shell callback.

The public literature is a pile of individual tricks scattered across blog posts, CTF writeups and cheatsheets, and almost all of it quietly assumes a traditional server: a shell that somebody will eventually log into, a cron daemon, a full init system, an SSH server, a package manager. A lot of what we test today looks nothing like that. It is a distroless container running a couple of processes, with no cron, no SSH, no interactive login, a mostly read-only root filesystem and a userland stripped down to the application and its runtime. So we decided to do the boring, systematic work: catalog what actually exists, grade how useful each technique really is, and then go looking for what is missing.