> whoami

Most organisations now run at least one service built on a large language model (LLM), whether a customer-facing chatbot, an internal assistant, or a feature quietly embedded in a larger product. Each of these comes with a set of rules about what the model should and should not do. Jailbreaking is the practice of getting the model to break those rules. It helps to be clear about where the rules come from, because that decides how easily they give way. Some are trained into the model itself. A well-built model will decline to write malware or explain how to hurt someone even when nothing in its configuration tells it to refuse, because that behaviour was reinforced during training. Other rules are set at deployment time through a system prompt, the instructions an organisation gives the model before any user interacts with it: stay on the subject of our products, never discuss a competitor, do not give financial advice. The trained rules tend to be sturdier than the system-prompt rules, though neither is a hard boundary. Both can be worn down with the right input. ...

A write-up of the HackTheBox machine “Eighteen”. This box revolves around turning application password hashes into an Active Directory foothold, then looks at the dMSA privilege-escalation path that Windows Server 2025 introduced. The target The host is a domain controller for eighteen.htb (DC01), and we are given one SQL Server login, kevin. Three TCP services are exposed: an IIS site on 80, SQL Server 2022 on 1433, and WinRM on 5985. DNS on 53/udp confirms the domain controller role. The path runs from the SQL login, through an application database and the password hashes stored in it, to a domain account reachable over WinRM, and from there toward a delegated managed service account (dMSA) escalation specific to Server 2025. ...

A write-up of the HackTheBox machine “Certified”. This box revolves around a vulnerable certificate template that we can abuse to achieve Domain Admin privileges. The target The host is a domain controller for certified.htb, and we are handed one working account, judith.mader. The objective is the built-in Administrator. In outline the path runs from that account, through ownership of a group, to a service account, and finally to the certificate authority, where a misconfigured template lets us issue ourselves a certificate in the Administrator’s name. ...