https://blog.msnieman.com/difficulties/easy/Recent content in Easy on Myles Nieman — BlogHugoen-usThu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/redpanda/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/redpanda/A Spring Boot search page reflects user input into a Server-Side Template Injection sink, giving RCE as woodenk; a root-owned log-parser cron is then exploited via JPEG Artist metadata and XML External Entity injection to read root’s SSH key.https://blog.msnieman.com/writeups/sea/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/sea/A WonderCMS site’s contact form SSRF is weaponized to deliver CVE-2023-41425, landing a shell as www-data; a password hash found in the CMS database cracks to pivot to a user account, and an internal monitoring service running as root is exploited to escalate.https://blog.msnieman.com/writeups/vulnescape/Fri, 24 Apr 2026 00:00:00 +0000https://blog.msnieman.com/writeups/vulnescape/An RDP kiosk running Microsoft Edge is escaped by adding a local HTML page and renaming PowerShell to msedge.exe; Remote Desktop Plus stores a masked credential recoverable with BulletsPassView, and a UAC-bypassed elevated PowerShell completes the privilege escalation.https://blog.msnieman.com/writeups/templtrap/Thu, 02 Apr 2026 00:00:00 +0000https://blog.msnieman.com/writeups/templtrap/A Langflow AI server exposed on port 80 is exploited via CVE-2026-0770 (SSTI RCE) for an initial shell as karen; screen 5.0.0 setuid-root logging (CVE-2025-23395) is then abused to symlink /etc/sudoers and grant passwordless sudo.https://blog.msnieman.com/writeups/data/Tue, 17 Feb 2026 00:00:00 +0000https://blog.msnieman.com/writeups/data/An unauthenticated Grafana path-traversal (CVE-2021-43798) exposes the SQLite database, leaking PBKDF2 password hashes that crack to yield SSH access; a privileged Docker container is then used to mount the host disk and read the root flag.https://blog.msnieman.com/writeups/wingdata/Tue, 17 Feb 2026 00:00:00 +0000https://blog.msnieman.com/writeups/wingdata/Wing FTP Server 7.4.3 exposes an unauthenticated RCE endpoint; cracking the salted password hashes from its XML config yields SSH access as a system user, and a root-owned backup script extracting untrusted zip archives is exploited via CVE-2025-4138 (Python zipslip) for privilege escalation.https://blog.msnieman.com/writeups/facts/Thu, 12 Feb 2026 00:00:00 +0000https://blog.msnieman.com/writeups/facts/A Ruby on Rails app running Camaleon CMS 2.9.0 is compromised via mass-assignment privilege escalation to admin, then an LFI in the admin file-download endpoint retrieves an SSH private key from an internal MinIO S3 bucket; the key cracks with JtR and SSH access leads to a sudo facter binary abused for root RCE.https://blog.msnieman.com/writeups/succession/Wed, 14 Jan 2026 00:00:00 +0000https://blog.msnieman.com/writeups/succession/Given SSH credentials for david.smith, BloodHound and netexec confirm the BadSuccessor (dMSA delegation abuse) primitive; SharpSuccessor creates a weaponized dMSA in the HR OU that inherits Administrator privileges, and Rubeus is used to request a service ticket granting domain-wide access.https://blog.msnieman.com/writeups/broker/Sat, 06 Sep 2025 00:00:00 +0000https://blog.msnieman.com/writeups/broker/A default-credentialed Apache ActiveMQ 5.15.15 console reveals a version vulnerable to CVE-2023-46604 (OpenWire deserialization RCE); a sudo-allowed nginx binary is then abused with a malicious config to write an SSH key into root’s home.https://blog.msnieman.com/writeups/return/Sat, 06 Sep 2025 00:00:00 +0000https://blog.msnieman.com/writeups/return/A printer admin panel leaks credentials to Responder via a spoofed LDAP server address; the recovered svc-printer account belongs to Server Operators, which allows modifying a service binary path to get a SYSTEM shell via netcat.https://blog.msnieman.com/writeups/sauna/Sat, 06 Sep 2025 00:00:00 +0000https://blog.msnieman.com/writeups/sauna/Staff names harvested from Egotistical Bank’s website yield an AS-REP roastable account; cracking the hash gives fsmith, whose WinRM session reveals autologon credentials for svc_loanmgr — an account with DCSync rights used to dump the Administrator hash.https://blog.msnieman.com/writeups/toolbox/Tue, 02 Sep 2025 00:00:00 +0000https://blog.msnieman.com/writeups/toolbox/SQL injection in a PostgreSQL-backed login form yields an os-shell inside a Docker container; the Docker Toolbox VM is reachable via SSH with default credentials, and its sudo-all docker user reads the Windows host’s C drive mounted at /c to retrieve the root flag.https://blog.msnieman.com/writeups/overcertified/Mon, 01 Sep 2025 00:00:00 +0000https://blog.msnieman.com/writeups/overcertified/An LDAP service account password stored in its own description field enables BloodHound collection and Kerberoasting of the MSSQLSERVER account; MSSQL access via xp_dirtree captures thomas’s NTLMv2 hash, and as thomas, certipy finds the Auth template vulnerable to ESC1, allowing a certificate-based admin impersonation for domain compromise.https://blog.msnieman.com/writeups/forest/Thu, 21 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/forest/Anonymous RPC enumeration yields a user list for AS-REP Roasting; the svc-alfresco hash cracks to a password that enables a BloodHound-guided DCSync attack via Exchange Windows Permissions WriteDACL, recovering the Administrator NTLM hash for a pass-the-hash shell.https://blog.msnieman.com/writeups/active/Tue, 12 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/active/Anonymous SMB access leaks a Group Policy Preferences cpassword for SVC_TGS; that account is used to Kerberoast the Administrator SPN and crack the ticket for a full domain compromise.