https://blog.msnieman.com/tags/wsus-abuse/Recent content in WSUS Abuse on Myles Nieman — BlogHugoen-usThu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/openad/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/openad/A default-credentialed Apache ActiveMQ 5.18.2 console on a Windows domain controller is exploited via CVE-2023-46604 for initial access; a Kerberos ccache file in /tmp enables offline Kerberoasting to recover svc_laps credentials, and a SharpWSUS WSUS poisoning attack leverages the svc_sql account’s WSUS admin rights to execute a SYSTEM-level payload on the domain controller.