https://blog.msnieman.com/tags/windows/Recent content in Windows on Myles Nieman — BlogHugoen-usThu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/certifried/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/certifried/Anonymous SMB enumeration on an Active Directory host reveals a readable share; null-session LDAP queries are not open, but unauthenticated SMB access yields a valid username (steven.murray) for further exploitation.https://blog.msnieman.com/writeups/freelancer/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/freelancer/An IDOR in a base64-encoded OTP URL allows hijacking an admin account on a freelancer platform, exposing an MSSQL terminal; privilege escalation through MSSQL sysadmin and xp_cmdshell delivers a Defender-evading shell, a plaintext SQL service password leads to the mikasa account, volatility analysis of a memory dump recovers lorra199’s credentials, and BloodHound reveals GenericWrite to a group that permits RBCD — ultimately yielding a domain admin via S4U2Proxy on the DC.https://blog.msnieman.com/writeups/ghost/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/ghost/LDAP injection on a Next.js intranet leaks a service-account secret that unlocks Gitea; a custom Ghost CMS file-read exposes an RCE dev key; from there, MSSQL linked-server SA impersonation provides a Windows foothold, and a cross-forest Kerberos golden ticket via Mimikatz completes the domain compromise.https://blog.msnieman.com/writeups/infosek/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/infosek/Exposed WordPress credentials in a public location grant admin panel access; a webshell upload reveals database credentials for the ryder account, and a Meterpreter port-forward through MySQL leads to privilege escalation.https://blog.msnieman.com/writeups/openad/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/openad/A default-credentialed Apache ActiveMQ 5.18.2 console on a Windows domain controller is exploited via CVE-2023-46604 for initial access; a Kerberos ccache file in /tmp enables offline Kerberoasting to recover svc_laps credentials, and a SharpWSUS WSUS poisoning attack leverages the svc_sql account’s WSUS admin rights to execute a SYSTEM-level payload on the domain controller.https://blog.msnieman.com/writeups/playground/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/playground/A Windows domain controller with restricted anonymous access is probed with SMB null sessions, kerbrute, and extensive RPC endpoint mapping; the notes document deep enumeration through backup and web shares but do not reach a foothold — this is a partial writeup covering enumeration only.https://blog.msnieman.com/writeups/search/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/search/A password embedded in a webpage image seeds a chain through SMB Kerberoasting, password spraying, and an Excel spreadsheet full of plaintext credentials, culminating in a cracked PFX certificate that unlocks privileged web access.https://blog.msnieman.com/writeups/pingpong/Thu, 07 May 2026 00:00:00 +0000https://blog.msnieman.com/writeups/pingpong/An assumed-breach scenario starting with domain credentials for c.roberts; initial BloodHound enumeration of ping.htb identifies ADCS as a potential privilege escalation path.https://blog.msnieman.com/writeups/vulnescape/Fri, 24 Apr 2026 00:00:00 +0000https://blog.msnieman.com/writeups/vulnescape/An RDP kiosk running Microsoft Edge is escaped by adding a local HTML page and renaming PowerShell to msedge.exe; Remote Desktop Plus stores a masked credential recoverable with BulletsPassView, and a UAC-bypassed elevated PowerShell completes the privilege escalation.https://blog.msnieman.com/writeups/logging/Thu, 23 Apr 2026 00:00:00 +0000https://blog.msnieman.com/writeups/logging/Readable SMB log share leaks an svc_recovery password (with a year-increment pattern), Generic Write on MSA_HEALTH$ enables shadow credential abuse for WinRM access, and a DLL-hijacking scheduled task running as jaylee.clifton combined with a rogue WSUS server (ESC17) delivers a SYSTEM shell.https://blog.msnieman.com/writeups/pirate/Sun, 01 Mar 2026 00:00:00 +0000https://blog.msnieman.com/writeups/pirate/Starting with provided pentest credentials against a Windows domain controller, BloodHound reveals two Kerberoastable accounts; the ADM service ticket hash resists cracking, leaving the box incomplete at the enumeration stage.https://blog.msnieman.com/writeups/succession/Wed, 14 Jan 2026 00:00:00 +0000https://blog.msnieman.com/writeups/succession/Given SSH credentials for david.smith, BloodHound and netexec confirm the BadSuccessor (dMSA delegation abuse) primitive; SharpSuccessor creates a weaponized dMSA in the HR OU that inherits Administrator privileges, and Rubeus is used to request a service ticket granting domain-wide access.https://blog.msnieman.com/writeups/rainbow/Thu, 25 Dec 2025 00:00:00 +0000https://blog.msnieman.com/writeups/rainbow/Anonymous FTP access combined with a custom web service on port 8080 leads to a stack-based buffer overflow that overwrites ECX; exploiting the crash yields remote code execution on this Windows medium box.https://blog.msnieman.com/writeups/vulncicada/Tue, 16 Dec 2025 00:00:00 +0000https://blog.msnieman.com/writeups/vulncicada/An exposed NFS share leaks domain usernames and a credential hidden inside an image file; the password belongs to Rosie.Powell, whose account is used to exploit ESC8 via Kerberos relay and coercion, yielding a DC certificate that produces the Administrator NTLM hash for a full domain takeover.https://blog.msnieman.com/writeups/return/Sat, 06 Sep 2025 00:00:00 +0000https://blog.msnieman.com/writeups/return/A printer admin panel leaks credentials to Responder via a spoofed LDAP server address; the recovered svc-printer account belongs to Server Operators, which allows modifying a service binary path to get a SYSTEM shell via netcat.https://blog.msnieman.com/writeups/sauna/Sat, 06 Sep 2025 00:00:00 +0000https://blog.msnieman.com/writeups/sauna/Staff names harvested from Egotistical Bank’s website yield an AS-REP roastable account; cracking the hash gives fsmith, whose WinRM session reveals autologon credentials for svc_loanmgr — an account with DCSync rights used to dump the Administrator hash.https://blog.msnieman.com/writeups/toolbox/Tue, 02 Sep 2025 00:00:00 +0000https://blog.msnieman.com/writeups/toolbox/SQL injection in a PostgreSQL-backed login form yields an os-shell inside a Docker container; the Docker Toolbox VM is reachable via SSH with default credentials, and its sudo-all docker user reads the Windows host’s C drive mounted at /c to retrieve the root flag.https://blog.msnieman.com/writeups/overcertified/Mon, 01 Sep 2025 00:00:00 +0000https://blog.msnieman.com/writeups/overcertified/An LDAP service account password stored in its own description field enables BloodHound collection and Kerberoasting of the MSSQLSERVER account; MSSQL access via xp_dirtree captures thomas’s NTLMv2 hash, and as thomas, certipy finds the Auth template vulnerable to ESC1, allowing a certificate-based admin impersonation for domain compromise.https://blog.msnieman.com/writeups/caring/Fri, 29 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/caring/An unauthenticated SMB Config share leaks a config.ini containing credentials for the user claudio; WinPEAS then surfaces Administrator credentials stored in plaintext, allowing a WinRM login and both flags.https://blog.msnieman.com/writeups/printer/Fri, 29 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/printer/A printer management web app leaks LDAP credentials to a Responder listener; Invoke-Pester in a constrained WinRM environment executes an arbitrary PowerShell script via SMB share, and an unattend.xml found by WinPEAS reveals local admin credentials for a DSC account — while an optional constrained delegation path demonstrates full domain compromise via Rubeus S4U2Proxy.