https://blog.msnieman.com/tags/rubeus/Recent content in Rubeus on Myles Nieman — BlogHugoen-usWed, 14 Jan 2026 00:00:00 +0000https://blog.msnieman.com/writeups/succession/Wed, 14 Jan 2026 00:00:00 +0000https://blog.msnieman.com/writeups/succession/Given SSH credentials for david.smith, BloodHound and netexec confirm the BadSuccessor (dMSA delegation abuse) primitive; SharpSuccessor creates a weaponized dMSA in the HR OU that inherits Administrator privileges, and Rubeus is used to request a service ticket granting domain-wide access.https://blog.msnieman.com/writeups/printer/Fri, 29 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/printer/A printer management web app leaks LDAP credentials to a Responder listener; Invoke-Pester in a constrained WinRM environment executes an arbitrary PowerShell script via SMB share, and an unattend.xml found by WinPEAS reveals local admin credentials for a DSC account — while an optional constrained delegation path demonstrates full domain compromise via Rubeus S4U2Proxy.