Pass-the-Hash on Myles Nieman — Bloghttps://blog.msnieman.com/tags/pass-the-hash/Recent content in Pass-the-Hash on Myles Nieman — BlogHugoen-usThu, 21 Aug 2025 00:00:00 +0000Foresthttps://blog.msnieman.com/writeups/forest/Thu, 21 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/forest/Anonymous RPC enumeration yields a user list for AS-REP Roasting; the svc-alfresco hash cracks to a password that enables a BloodHound-guided DCSync attack via Exchange Windows Permissions WriteDACL, recovering the Administrator NTLM hash for a pass-the-hash shell.