https://blog.msnieman.com/tags/vss/Recent content in VSS on Myles Nieman — BlogHugoen-usTue, 12 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/blackfield/Tue, 12 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/blackfield/Anonymous SMB access to a profiles share leaks hundreds of domain usernames; AS-REP roasting cracks the support account’s hash, and BloodHound reveals a ForceChangePassword edge to audit2020, whose access to the forensic share exposes an lsass.dmp containing svc_backup’s NTLM hash; SeBackupPrivilege on svc_backup is then abused with a VSS diskshadow script to extract NTDS.dit and dump the domain.