https://blog.msnieman.com/tags/dcsync/Recent content in DCSync on Myles Nieman — BlogHugoen-usSat, 06 Sep 2025 00:00:00 +0000https://blog.msnieman.com/writeups/sauna/Sat, 06 Sep 2025 00:00:00 +0000https://blog.msnieman.com/writeups/sauna/Staff names harvested from Egotistical Bank’s website yield an AS-REP roastable account; cracking the hash gives fsmith, whose WinRM session reveals autologon credentials for svc_loanmgr — an account with DCSync rights used to dump the Administrator hash.https://blog.msnieman.com/writeups/forest/Thu, 21 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/forest/Anonymous RPC enumeration yields a user list for AS-REP Roasting; the svc-alfresco hash cracks to a password that enables a BloodHound-guided DCSync attack via Exchange Windows Permissions WriteDACL, recovering the Administrator NTLM hash for a pass-the-hash shell.