https://blog.msnieman.com/tags/adcs/Recent content in ADCS on Myles Nieman — BlogHugoen-usThu, 07 May 2026 00:00:00 +0000https://blog.msnieman.com/writeups/pingpong/Thu, 07 May 2026 00:00:00 +0000https://blog.msnieman.com/writeups/pingpong/An assumed-breach scenario starting with domain credentials for c.roberts; initial BloodHound enumeration of ping.htb identifies ADCS as a potential privilege escalation path.https://blog.msnieman.com/writeups/logging/Thu, 23 Apr 2026 00:00:00 +0000https://blog.msnieman.com/writeups/logging/Readable SMB log share leaks an svc_recovery password (with a year-increment pattern), Generic Write on MSA_HEALTH$ enables shadow credential abuse for WinRM access, and a DLL-hijacking scheduled task running as jaylee.clifton combined with a rogue WSUS server (ESC17) delivers a SYSTEM shell.https://blog.msnieman.com/writeups/vulncicada/Tue, 16 Dec 2025 00:00:00 +0000https://blog.msnieman.com/writeups/vulncicada/An exposed NFS share leaks domain usernames and a credential hidden inside an image file; the password belongs to Rosie.Powell, whose account is used to exploit ESC8 via Kerberos relay and coercion, yielding a DC certificate that produces the Administrator NTLM hash for a full domain takeover.https://blog.msnieman.com/writeups/overcertified/Mon, 01 Sep 2025 00:00:00 +0000https://blog.msnieman.com/writeups/overcertified/An LDAP service account password stored in its own description field enables BloodHound collection and Kerberoasting of the MSSQLSERVER account; MSSQL access via xp_dirtree captures thomas’s NTLMv2 hash, and as thomas, certipy finds the Auth template vulnerable to ESC1, allowing a certificate-based admin impersonation for domain compromise.