Blog¶

Stuff I find out. Short notes, quick wins, things worth keeping.

June 8, 2026
in Red Team
6 min read

Commvault Vault: Decrypting V5 Blobs with Live JVM Injection

So, CMV stores the db passwords in V5 encrypted blobs. I tried different offline ways to crack these, but all failed. Couldn't find anything relatable on the internet, so I went through some docu and different links. After that, I realized that CMV's runtime already has the V5 key context loaded. That made me look into how to inject the process, not crash the app and decrypt the blobs.

Full source is on GitHub: 0xCZR1/Commvault-JVMInjection.

June 8, 2026
in Red Team
4 min read

LSA Secrets: Reading SC Service Passwords with the Registry Copy Trick

So, if you happen to be on a Windows box as SYSTEM and you find a non-gMSA service, then you are able to actually use LsaRetrievePrivateData on it, but not directly. You need a simple trick.

June 1, 2026
in Red Team, Active Directory
3 min read

ExtraSid Diamond Ticket: Patching Impacket for Fully Patched KDCs

So, you want to escalate from child domain krbtgt to forest root domain krbtgt or simply to forest root. You are in a hardened domain and you fight 2 things, a patched KDC and no RC4 intra-forest. Unfortunately, stock ticketer.py doesn't fix neither.