https://blog.msnieman.com/tags/smb/Recent content in SMB on Myles Nieman — BlogHugoen-usThu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/certifried/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/certifried/Anonymous SMB enumeration on an Active Directory host reveals a readable share; null-session LDAP queries are not open, but unauthenticated SMB access yields a valid username (steven.murray) for further exploitation.https://blog.msnieman.com/writeups/playground/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/playground/A Windows domain controller with restricted anonymous access is probed with SMB null sessions, kerbrute, and extensive RPC endpoint mapping; the notes document deep enumeration through backup and web shares but do not reach a foothold — this is a partial writeup covering enumeration only.https://blog.msnieman.com/writeups/search/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/search/A password embedded in a webpage image seeds a chain through SMB Kerberoasting, password spraying, and an Excel spreadsheet full of plaintext credentials, culminating in a cracked PFX certificate that unlocks privileged web access.https://blog.msnieman.com/writeups/caring/Fri, 29 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/caring/An unauthenticated SMB Config share leaks a config.ini containing credentials for the user claudio; WinPEAS then surfaces Administrator credentials stored in plaintext, allowing a WinRM login and both flags.