https://blog.msnieman.com/difficulties/very-easy/Recent content in Very Easy on Myles Nieman — BlogHugoen-usThu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/certifried/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/certifried/Anonymous SMB enumeration on an Active Directory host reveals a readable share; null-session LDAP queries are not open, but unauthenticated SMB access yields a valid username (steven.murray) for further exploitation.https://blog.msnieman.com/writeups/bloodflow/Tue, 17 Feb 2026 00:00:00 +0000https://blog.msnieman.com/writeups/bloodflow/A publicly exposed n8n workflow automation instance is vulnerable to CVE-2026-21858, an unauthenticated arbitrary file read to RCE chain, yielding a shell on the target.https://blog.msnieman.com/writeups/reactoops/Wed, 14 Jan 2026 00:00:00 +0000https://blog.msnieman.com/writeups/reactoops/A vulnerable React application is exploited via CVE-2025-55182 (react2shell), yielding unauthenticated remote code execution and a shell that reads the flag written to /app/flag.txt.https://blog.msnieman.com/writeups/caring/Fri, 29 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/caring/An unauthenticated SMB Config share leaks a config.ini containing credentials for the user claudio; WinPEAS then surfaces Administrator credentials stored in plaintext, allowing a WinRM login and both flags.https://blog.msnieman.com/writeups/adselfservice/Thu, 28 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/adselfservice/An exposed ManageEngine ADSelfService Plus portal running version 6.1 is vulnerable to CVE-2021-40539 (REST API authentication bypass to RCE), yielding a webshell that runs as NT AUTHORITY\SYSTEM and direct access to both flags.https://blog.msnieman.com/writeups/logonshell/Thu, 28 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/logonshell/A Microsoft Exchange Server 2019 RTM (15.2.221.12) on the edelweiss.htb domain is exploited via ProxyShell (CVE-2021-34473) — the auth bypass generates an impersonation token for Administrator, and a Metasploit payload drops a Meterpreter session, then evil-winrm provides a stable shell using the recovered NTLM hash.