https://blog.msnieman.com/difficulties/medium/Recent content in Medium on Myles Nieman — BlogHugoen-usThu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/bucket/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/bucket/A web application backed by a locally exposed S3-compatible bucket allows unauthenticated file uploads; uploading a PHP web shell through the bucket endpoint gives remote code execution on the server.https://blog.msnieman.com/writeups/infosek/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/infosek/Exposed WordPress credentials in a public location grant admin panel access; a webshell upload reveals database credentials for the ryder account, and a Meterpreter port-forward through MySQL leads to privilege escalation.https://blog.msnieman.com/writeups/logging/Thu, 23 Apr 2026 00:00:00 +0000https://blog.msnieman.com/writeups/logging/Readable SMB log share leaks an svc_recovery password (with a year-increment pattern), Generic Write on MSA_HEALTH$ enables shadow credential abuse for WinRM access, and a DLL-hijacking scheduled task running as jaylee.clifton combined with a rogue WSUS server (ESC17) delivers a SYSTEM shell.https://blog.msnieman.com/writeups/deputy/Sun, 12 Apr 2026 00:00:00 +0000https://blog.msnieman.com/writeups/deputy/A exposed .git directory leaks Terraform IAM ARNs; a case-sensitivity bug in the event-role API lets those ARNs cross account boundaries, eventually reading a DynamoDB record that contains credentials — which chain through the app to a root password.https://blog.msnieman.com/writeups/interpreter/Sun, 22 Feb 2026 00:00:00 +0000https://blog.msnieman.com/writeups/interpreter/Mirth Connect 4.4.0 is vulnerable to CVE-2023-43208 (unauthenticated RCE); database credentials in mirth.properties lead to a PBKDF2-hashed password for the sedric user, and a root-owned Flask service using eval() on attacker-controlled f-strings enables arbitrary command execution as root.https://blog.msnieman.com/writeups/rainbow/Thu, 25 Dec 2025 00:00:00 +0000https://blog.msnieman.com/writeups/rainbow/Anonymous FTP access combined with a custom web service on port 8080 leads to a stack-based buffer overflow that overwrites ECX; exploiting the crash yields remote code execution on this Windows medium box.https://blog.msnieman.com/writeups/vulncicada/Tue, 16 Dec 2025 00:00:00 +0000https://blog.msnieman.com/writeups/vulncicada/An exposed NFS share leaks domain usernames and a credential hidden inside an image file; the password belongs to Rosie.Powell, whose account is used to exploit ESC8 via Kerberos relay and coercion, yielding a DC certificate that produces the Administrator NTLM hash for a full domain takeover.https://blog.msnieman.com/writeups/printer/Fri, 29 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/printer/A printer management web app leaks LDAP credentials to a Responder listener; Invoke-Pester in a constrained WinRM environment executes an arbitrary PowerShell script via SMB share, and an unattend.xml found by WinPEAS reveals local admin credentials for a DSC account — while an optional constrained delegation path demonstrates full domain compromise via Rubeus S4U2Proxy.