https://blog.msnieman.com/tags/winrm/Recent content in WinRM on Myles Nieman — BlogHugoen-usFri, 29 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/caring/Fri, 29 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/caring/An unauthenticated SMB Config share leaks a config.ini containing credentials for the user claudio; WinPEAS then surfaces Administrator credentials stored in plaintext, allowing a WinRM login and both flags.https://blog.msnieman.com/writeups/printer/Fri, 29 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/printer/A printer management web app leaks LDAP credentials to a Responder listener; Invoke-Pester in a constrained WinRM environment executes an arbitrary PowerShell script via SMB share, and an unattend.xml found by WinPEAS reveals local admin credentials for a DSC account — while an optional constrained delegation path demonstrates full domain compromise via Rubeus S4U2Proxy.