https://blog.msnieman.com/tags/active-directory/Recent content in Active Directory on Myles Nieman — BlogHugoen-usThu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/certifried/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/certifried/Anonymous SMB enumeration on an Active Directory host reveals a readable share; null-session LDAP queries are not open, but unauthenticated SMB access yields a valid username (steven.murray) for further exploitation.https://blog.msnieman.com/writeups/freelancer/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/freelancer/An IDOR in a base64-encoded OTP URL allows hijacking an admin account on a freelancer platform, exposing an MSSQL terminal; privilege escalation through MSSQL sysadmin and xp_cmdshell delivers a Defender-evading shell, a plaintext SQL service password leads to the mikasa account, volatility analysis of a memory dump recovers lorra199’s credentials, and BloodHound reveals GenericWrite to a group that permits RBCD — ultimately yielding a domain admin via S4U2Proxy on the DC.https://blog.msnieman.com/writeups/ghost/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/ghost/LDAP injection on a Next.js intranet leaks a service-account secret that unlocks Gitea; a custom Ghost CMS file-read exposes an RCE dev key; from there, MSSQL linked-server SA impersonation provides a Windows foothold, and a cross-forest Kerberos golden ticket via Mimikatz completes the domain compromise.https://blog.msnieman.com/writeups/openad/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/openad/A default-credentialed Apache ActiveMQ 5.18.2 console on a Windows domain controller is exploited via CVE-2023-46604 for initial access; a Kerberos ccache file in /tmp enables offline Kerberoasting to recover svc_laps credentials, and a SharpWSUS WSUS poisoning attack leverages the svc_sql account’s WSUS admin rights to execute a SYSTEM-level payload on the domain controller.https://blog.msnieman.com/writeups/playground/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/playground/A Windows domain controller with restricted anonymous access is probed with SMB null sessions, kerbrute, and extensive RPC endpoint mapping; the notes document deep enumeration through backup and web shares but do not reach a foothold — this is a partial writeup covering enumeration only.https://blog.msnieman.com/writeups/search/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/search/A password embedded in a webpage image seeds a chain through SMB Kerberoasting, password spraying, and an Excel spreadsheet full of plaintext credentials, culminating in a cracked PFX certificate that unlocks privileged web access.https://blog.msnieman.com/writeups/pingpong/Thu, 07 May 2026 00:00:00 +0000https://blog.msnieman.com/writeups/pingpong/An assumed-breach scenario starting with domain credentials for c.roberts; initial BloodHound enumeration of ping.htb identifies ADCS as a potential privilege escalation path.https://blog.msnieman.com/writeups/logging/Thu, 23 Apr 2026 00:00:00 +0000https://blog.msnieman.com/writeups/logging/Readable SMB log share leaks an svc_recovery password (with a year-increment pattern), Generic Write on MSA_HEALTH$ enables shadow credential abuse for WinRM access, and a DLL-hijacking scheduled task running as jaylee.clifton combined with a rogue WSUS server (ESC17) delivers a SYSTEM shell.https://blog.msnieman.com/writeups/pirate/Sun, 01 Mar 2026 00:00:00 +0000https://blog.msnieman.com/writeups/pirate/Starting with provided pentest credentials against a Windows domain controller, BloodHound reveals two Kerberoastable accounts; the ADM service ticket hash resists cracking, leaving the box incomplete at the enumeration stage.https://blog.msnieman.com/writeups/succession/Wed, 14 Jan 2026 00:00:00 +0000https://blog.msnieman.com/writeups/succession/Given SSH credentials for david.smith, BloodHound and netexec confirm the BadSuccessor (dMSA delegation abuse) primitive; SharpSuccessor creates a weaponized dMSA in the HR OU that inherits Administrator privileges, and Rubeus is used to request a service ticket granting domain-wide access.https://blog.msnieman.com/writeups/vulncicada/Tue, 16 Dec 2025 00:00:00 +0000https://blog.msnieman.com/writeups/vulncicada/An exposed NFS share leaks domain usernames and a credential hidden inside an image file; the password belongs to Rosie.Powell, whose account is used to exploit ESC8 via Kerberos relay and coercion, yielding a DC certificate that produces the Administrator NTLM hash for a full domain takeover.https://blog.msnieman.com/writeups/return/Sat, 06 Sep 2025 00:00:00 +0000https://blog.msnieman.com/writeups/return/A printer admin panel leaks credentials to Responder via a spoofed LDAP server address; the recovered svc-printer account belongs to Server Operators, which allows modifying a service binary path to get a SYSTEM shell via netcat.https://blog.msnieman.com/writeups/sauna/Sat, 06 Sep 2025 00:00:00 +0000https://blog.msnieman.com/writeups/sauna/Staff names harvested from Egotistical Bank’s website yield an AS-REP roastable account; cracking the hash gives fsmith, whose WinRM session reveals autologon credentials for svc_loanmgr — an account with DCSync rights used to dump the Administrator hash.https://blog.msnieman.com/writeups/overcertified/Mon, 01 Sep 2025 00:00:00 +0000https://blog.msnieman.com/writeups/overcertified/An LDAP service account password stored in its own description field enables BloodHound collection and Kerberoasting of the MSSQLSERVER account; MSSQL access via xp_dirtree captures thomas’s NTLMv2 hash, and as thomas, certipy finds the Auth template vulnerable to ESC1, allowing a certificate-based admin impersonation for domain compromise.https://blog.msnieman.com/writeups/printer/Fri, 29 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/printer/A printer management web app leaks LDAP credentials to a Responder listener; Invoke-Pester in a constrained WinRM environment executes an arbitrary PowerShell script via SMB share, and an unattend.xml found by WinPEAS reveals local admin credentials for a DSC account — while an optional constrained delegation path demonstrates full domain compromise via Rubeus S4U2Proxy.https://blog.msnieman.com/writeups/logonshell/Thu, 28 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/logonshell/A Microsoft Exchange Server 2019 RTM (15.2.221.12) on the edelweiss.htb domain is exploited via ProxyShell (CVE-2021-34473) — the auth bypass generates an impersonation token for Administrator, and a Metasploit payload drops a Meterpreter session, then evil-winrm provides a stable shell using the recovered NTLM hash.https://blog.msnieman.com/writeups/object/Sat, 23 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/object/An open Jenkins registration on port 8080 lets an attacker create a job that executes arbitrary commands as oliver; Jenkins credential files are decrypted offline to recover a WinRM password, and a multi-hop AD ACL chain — ForceChangePassword on smith, GenericWrite on maria, WriteOwner on Domain Admins — yields a full domain compromise.https://blog.msnieman.com/writeups/forest/Thu, 21 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/forest/Anonymous RPC enumeration yields a user list for AS-REP Roasting; the svc-alfresco hash cracks to a password that enables a BloodHound-guided DCSync attack via Exchange Windows Permissions WriteDACL, recovering the Administrator NTLM hash for a pass-the-hash shell.https://blog.msnieman.com/writeups/active/Tue, 12 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/active/Anonymous SMB access leaks a Group Policy Preferences cpassword for SVC_TGS; that account is used to Kerberoast the Administrator SPN and crack the ticket for a full domain compromise.https://blog.msnieman.com/writeups/blackfield/Tue, 12 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/blackfield/Anonymous SMB access to a profiles share leaks hundreds of domain usernames; AS-REP roasting cracks the support account’s hash, and BloodHound reveals a ForceChangePassword edge to audit2020, whose access to the forensic share exposes an lsass.dmp containing svc_backup’s NTLM hash; SeBackupPrivilege on svc_backup is then abused with a VSS diskshadow script to extract NTDS.dit and dump the domain.