https://blog.msnieman.com/difficulties/hard/Recent content in Hard on Myles Nieman — BlogHugoen-usThu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/freelancer/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/freelancer/An IDOR in a base64-encoded OTP URL allows hijacking an admin account on a freelancer platform, exposing an MSSQL terminal; privilege escalation through MSSQL sysadmin and xp_cmdshell delivers a Defender-evading shell, a plaintext SQL service password leads to the mikasa account, volatility analysis of a memory dump recovers lorra199’s credentials, and BloodHound reveals GenericWrite to a group that permits RBCD — ultimately yielding a domain admin via S4U2Proxy on the DC.https://blog.msnieman.com/writeups/openad/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/openad/A default-credentialed Apache ActiveMQ 5.18.2 console on a Windows domain controller is exploited via CVE-2023-46604 for initial access; a Kerberos ccache file in /tmp enables offline Kerberoasting to recover svc_laps credentials, and a SharpWSUS WSUS poisoning attack leverages the svc_sql account’s WSUS admin rights to execute a SYSTEM-level payload on the domain controller.https://blog.msnieman.com/writeups/playground/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/playground/A Windows domain controller with restricted anonymous access is probed with SMB null sessions, kerbrute, and extensive RPC endpoint mapping; the notes document deep enumeration through backup and web shares but do not reach a foothold — this is a partial writeup covering enumeration only.https://blog.msnieman.com/writeups/resource/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/resource/A zip-upload feature on an SSH key management web app is exploited via a PHP pearcmd LFI-to-RCE trick to land a webshell as www-data; uploaded zip archives contain a HAR file with credentials for msainristil, and a SSH certificate signing API endpoint is abused to sign keys for additional principals, ultimately allowing privilege escalation to root via a sudo-accessible key-signing script.https://blog.msnieman.com/writeups/search/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/search/A password embedded in a webpage image seeds a chain through SMB Kerberoasting, password spraying, and an Excel spreadsheet full of plaintext credentials, culminating in a cracked PFX certificate that unlocks privileged web access.https://blog.msnieman.com/writeups/pirate/Sun, 01 Mar 2026 00:00:00 +0000https://blog.msnieman.com/writeups/pirate/Starting with provided pentest credentials against a Windows domain controller, BloodHound reveals two Kerberoastable accounts; the ADM service ticket hash resists cracking, leaving the box incomplete at the enumeration stage.https://blog.msnieman.com/writeups/object/Sat, 23 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/object/An open Jenkins registration on port 8080 lets an attacker create a job that executes arbitrary commands as oliver; Jenkins credential files are decrypted offline to recover a WinRM password, and a multi-hop AD ACL chain — ForceChangePassword on smith, GenericWrite on maria, WriteOwner on Domain Admins — yields a full domain compromise.https://blog.msnieman.com/writeups/blackfield/Tue, 12 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/blackfield/Anonymous SMB access to a profiles share leaks hundreds of domain usernames; AS-REP roasting cracks the support account’s hash, and BloodHound reveals a ForceChangePassword edge to audit2020, whose access to the forensic share exposes an lsass.dmp containing svc_backup’s NTLM hash; SeBackupPrivilege on svc_backup is then abused with a VSS diskshadow script to extract NTDS.dit and dump the domain.https://blog.msnieman.com/writeups/lantern/Tue, 20 Aug 2024 00:00:00 +0000https://blog.msnieman.com/writeups/lantern/A Skipper proxy CVE-2022-38580 SSRF exposes an internal Blazor WebAssembly app whose DLL contains base64-encoded admin credentials; those credentials log into the app, whose source code reveals a path traversal on /PrivacyAndPolicy and a DLL-loading component endpoint; a crafted Blazor component DLL reads tomas’s SSH private key, and procmon-based inspection of a root-run binary leads to privilege escalation.