Sizzle

Verified writeups for the Sizzle machine of Hack The Box

Sizzle

$ tldr AD Cert Services + Kerberoasting → CLM/AppLocker bypass → DA

·	·
Operating system	Windows
Difficulty	Insane
Vector	Active Directory
IP	10.10.10.103
Retirement date	2019-06-01
Skills	SMBCacls Enumeration Malicious SCF File (Getting NetNTLMv2 Hash) Ldap Enumeration (LdapDomainDump) Abusing Microsoft Active Directory Certificate Services Creating Certificate Signing Requests (CSR) [Openssl] CLM / AppLocker Break Out (Escaping ConstrainedLanguage) PSByPassCLM Usage (CLM / AppLocker Break out) Msbuild (CLM / AppLocker Break Out) Kerberoasting Attack (Rubeus) Kerberoasting Attack (Chisel Port Forward - GetUserSPNs.py) WINRM Connections BloodHound Enumeration DCSync Attack (secretsdump.py) DCSync Attack (Mimikatz) PassTheHash (wmiexec.py)

Writeups

Language	Author	Format	Link
🇪🇸 ES	S4vitar	Vídeo	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	IppSec	Vídeo	Open

Skill resources

Curated documentation for each technique listed in the Skills column above. Sources: HackTricks, GTFOBins, PortSwigger, etc.

Skill	Source	Link
Active Directory	HackTricks	Open
Kerberoasting	HackTricks	Open
BloodHound	BloodHound docs	Open
DCSync	HackTricks	Open
Port Forwarding / Pivoting	HackTricks	Open
SMB (139/445)	HackTricks	Open

Related skills worth mastering

AS-REP Roasting · Group Policy Preferences (GPP) · GetNPUsers (Impacket) · EternalBlue (MS17-010) · MS08-067 (NetAPI)

If you liked this machine, try

• Search — Windows, Hard
• Cascade — Windows, Medium
• Blackfield — Windows, Hard
• MultiMaster — Windows, Insane
• Mantis — Windows, Hard

---

Comments & tips

Did the official writeup not work? Found a smarter trick? Share it here — comments live in GitHub Discussions.

Last updated: 2026-07-27