diff --git a/Vulnlab/Heron.md b/Vulnlab/Heron.md
new file mode 100644
index 0000000..de79508
--- /dev/null
+++ b/Vulnlab/Heron.md
@@ -0,0 +1,99 @@
+# Vulnlab - Heron
+
+## Jump server
+
+```bash
+PORT STATE SERVICE VERSION
+22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.7 (Ubuntu Linux; protocol 2.0)
+| ssh-hostkey:
+| 256 10:a0:bd:2a:81:3d:37:5d:23:75:c8:d2:83:bf:2a:23 (ECDSA)
+|_ 256 bd:32:29:26:4d:41:d7:56:01:37:bc:10:0c:de:45:24 (ED25519)
+Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
+```
+
+The server had only port 22 with the credentials provided on vulnlab wiki as this chained machine is an assumed breach scenario `pentest:Heron123!`
+
+
+
+Checking for privileges, we can't use sudo as this user isn't in sudoers group
+
+
+
+From the user's directory, two users `svc-web-accounting` and `svc-web-accounting-d` belong to `heron.vl` , having only usernames there's only as-rep roasting we could try if these domain users have pre-authentication not required, this could give us the as-rep hash so we can try cracking to get the plain text password.
+
+
+
+Checking the internal ports, there's only ssh here
+
+
+
+To proceed with as-rep roasting we need to perform pivoting as we directly cannot reach domain controller, this can be done with either chisel or ligolo-ng, I'll be using chisel since we only need to access one host, if it were a network then ligolog would have been a better option for that
+
+```bash
+chisel server --reverse -p 3000
+chisel client 10.8.0.136:3000 R:socks
+```
+
+
+
+With Get-NPUsers to check the pre-authentication not required, both of the users had that required
+
+
+
+Bruteforcing the SIDs with guest account was not possible too as that account was disabled
+
+
+
+Visiting the web page, we have a pager about heron corp with three more usernames at the bottom
+
+
+
+
+
+Trying to check pre-auth again with these users, we'll get samuel.davies's hash and cracking it with hashcat
+
+
+
+
+
+Enumerating the shares, samuel had read access on `sysvol` , `home` and write on `transfer$` which seem to be only two interesting shares right now
+
+
+
+Then transfer share was empty, home had bunch of user directories including samuel which was also didn't had anything
+
+
+
+
+
+
+
+However, from SYSVOL share in one of the policy directory, we can find encrypted password for svc-web-accounting
+
+
+
+
+
+Decrypting this with GPP-decrypt python script
+
+
+
+GPP password can also be recovered through nxc/cme with `gpp_password` module
+
+```bash
+proxychains nxc smb 10.10.196.37 -u 'samuel.davies' -p 'pass' -M gpp_password
+```
+
+
+
+Checking the access on smb shares with svc-web-account-d, there's write access on accounting share
+
+
+The accounting share has the application files including the web.config
+
+
+
+# References
+
+- https://www.hackingarticles.in/credential-dumping-group-policy-preferences-gpp/
+- https://github.com/t0thkr1s/gpp-decrypt