https://blog.msnieman.com/tags/kerberoasting/Recent content in Kerberoasting on Myles Nieman — BlogHugoen-usThu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/openad/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/openad/A default-credentialed Apache ActiveMQ 5.18.2 console on a Windows domain controller is exploited via CVE-2023-46604 for initial access; a Kerberos ccache file in /tmp enables offline Kerberoasting to recover svc_laps credentials, and a SharpWSUS WSUS poisoning attack leverages the svc_sql account’s WSUS admin rights to execute a SYSTEM-level payload on the domain controller.https://blog.msnieman.com/writeups/search/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/search/A password embedded in a webpage image seeds a chain through SMB Kerberoasting, password spraying, and an Excel spreadsheet full of plaintext credentials, culminating in a cracked PFX certificate that unlocks privileged web access.https://blog.msnieman.com/writeups/pirate/Sun, 01 Mar 2026 00:00:00 +0000https://blog.msnieman.com/writeups/pirate/Starting with provided pentest credentials against a Windows domain controller, BloodHound reveals two Kerberoastable accounts; the ADM service ticket hash resists cracking, leaving the box incomplete at the enumeration stage.https://blog.msnieman.com/writeups/overcertified/Mon, 01 Sep 2025 00:00:00 +0000https://blog.msnieman.com/writeups/overcertified/An LDAP service account password stored in its own description field enables BloodHound collection and Kerberoasting of the MSSQLSERVER account; MSSQL access via xp_dirtree captures thomas’s NTLMv2 hash, and as thomas, certipy finds the Auth template vulnerable to ESC1, allowing a certificate-based admin impersonation for domain compromise.https://blog.msnieman.com/writeups/active/Tue, 12 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/active/Anonymous SMB access leaks a Group Policy Preferences cpassword for SVC_TGS; that account is used to Kerberoast the Administrator SPN and crack the ticket for a full domain compromise.