https://blog.msnieman.com/tags/bloodhound/Recent content in BloodHound on Myles Nieman — BlogHugoen-usThu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/freelancer/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/freelancer/An IDOR in a base64-encoded OTP URL allows hijacking an admin account on a freelancer platform, exposing an MSSQL terminal; privilege escalation through MSSQL sysadmin and xp_cmdshell delivers a Defender-evading shell, a plaintext SQL service password leads to the mikasa account, volatility analysis of a memory dump recovers lorra199’s credentials, and BloodHound reveals GenericWrite to a group that permits RBCD — ultimately yielding a domain admin via S4U2Proxy on the DC.https://blog.msnieman.com/writeups/playground/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/playground/A Windows domain controller with restricted anonymous access is probed with SMB null sessions, kerbrute, and extensive RPC endpoint mapping; the notes document deep enumeration through backup and web shares but do not reach a foothold — this is a partial writeup covering enumeration only.https://blog.msnieman.com/writeups/pingpong/Thu, 07 May 2026 00:00:00 +0000https://blog.msnieman.com/writeups/pingpong/An assumed-breach scenario starting with domain credentials for c.roberts; initial BloodHound enumeration of ping.htb identifies ADCS as a potential privilege escalation path.https://blog.msnieman.com/writeups/pirate/Sun, 01 Mar 2026 00:00:00 +0000https://blog.msnieman.com/writeups/pirate/Starting with provided pentest credentials against a Windows domain controller, BloodHound reveals two Kerberoastable accounts; the ADM service ticket hash resists cracking, leaving the box incomplete at the enumeration stage.https://blog.msnieman.com/writeups/succession/Wed, 14 Jan 2026 00:00:00 +0000https://blog.msnieman.com/writeups/succession/Given SSH credentials for david.smith, BloodHound and netexec confirm the BadSuccessor (dMSA delegation abuse) primitive; SharpSuccessor creates a weaponized dMSA in the HR OU that inherits Administrator privileges, and Rubeus is used to request a service ticket granting domain-wide access.https://blog.msnieman.com/writeups/sauna/Sat, 06 Sep 2025 00:00:00 +0000https://blog.msnieman.com/writeups/sauna/Staff names harvested from Egotistical Bank’s website yield an AS-REP roastable account; cracking the hash gives fsmith, whose WinRM session reveals autologon credentials for svc_loanmgr — an account with DCSync rights used to dump the Administrator hash.https://blog.msnieman.com/writeups/object/Sat, 23 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/object/An open Jenkins registration on port 8080 lets an attacker create a job that executes arbitrary commands as oliver; Jenkins credential files are decrypted offline to recover a WinRM password, and a multi-hop AD ACL chain — ForceChangePassword on smith, GenericWrite on maria, WriteOwner on Domain Admins — yields a full domain compromise.https://blog.msnieman.com/writeups/forest/Thu, 21 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/forest/Anonymous RPC enumeration yields a user list for AS-REP Roasting; the svc-alfresco hash cracks to a password that enables a BloodHound-guided DCSync attack via Exchange Windows Permissions WriteDACL, recovering the Administrator NTLM hash for a pass-the-hash shell.https://blog.msnieman.com/writeups/blackfield/Tue, 12 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/blackfield/Anonymous SMB access to a profiles share leaks hundreds of domain usernames; AS-REP roasting cracks the support account’s hash, and BloodHound reveals a ForceChangePassword edge to audit2020, whose access to the forensic share exposes an lsass.dmp containing svc_backup’s NTLM hash; SeBackupPrivilege on svc_backup is then abused with a VSS diskshadow script to extract NTDS.dit and dump the domain.