https://blog.msnieman.com/tags/kerberos/Recent content in Kerberos on Myles Nieman — BlogHugoen-usThu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/ghost/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/ghost/LDAP injection on a Next.js intranet leaks a service-account secret that unlocks Gitea; a custom Ghost CMS file-read exposes an RCE dev key; from there, MSSQL linked-server SA impersonation provides a Windows foothold, and a cross-forest Kerberos golden ticket via Mimikatz completes the domain compromise.https://blog.msnieman.com/writeups/succession/Wed, 14 Jan 2026 00:00:00 +0000https://blog.msnieman.com/writeups/succession/Given SSH credentials for david.smith, BloodHound and netexec confirm the BadSuccessor (dMSA delegation abuse) primitive; SharpSuccessor creates a weaponized dMSA in the HR OU that inherits Administrator privileges, and Rubeus is used to request a service ticket granting domain-wide access.