WORLD WATCH · October 24, 2026 · REDTEAM
HTB Checkpoint allows AD privilege escalation
An assume breach Active Directory box allowed escalation through AD Recycle Bin rights.
- Reported by
- 0xdf
- Outlets reporting
- 1
- Category
- REDTEAM
- Newest report
- October 24, 2026
Plain-English brief. Written for readers who work in a second language.
Key takeaways
- Deleted user had default password.
- Write access allowed extension placement.
- Sync job enabled further action.
What happened
The report comes from 0xdf. Checkpoint is an assume breach Active Directory box. The starting account had unusual rights over the AD Recycle Bin. An actor restored a deleted user who still had the default password. The restored user had write access to a share. The actor used that access to plant a malicious VS Code extension. A sync job used that extension on the box.
Why it matters
Restore rights over the AD Recycle Bin can expose deleted accounts. Share write access can allow placement of a malicious file. A sync job can execute a placed extension without direct login access.
What to do
- Restrict rights to the AD Recycle Bin to specific accounts.
- Limit write access to shares used by sync jobs.
- Audit restore actions for deleted Active Directory accounts.
SOURCE: INTEL128 WORLD WATCH (UPDATED OCT 24, 2026). This brief summarizes reporting by 0xdf. Intel128 writes the summary and credits the outlet. Read the summary as a starting point, not as a substitute for the original reporting.