https://blog.msnieman.com/writeups/Recent content in HTB Writeups on Myles Nieman — BlogHugoen-usThu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/bucket/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/bucket/A web application backed by a locally exposed S3-compatible bucket allows unauthenticated file uploads; uploading a PHP web shell through the bucket endpoint gives remote code execution on the server.https://blog.msnieman.com/writeups/certifried/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/certifried/Anonymous SMB enumeration on an Active Directory host reveals a readable share; null-session LDAP queries are not open, but unauthenticated SMB access yields a valid username (steven.murray) for further exploitation.https://blog.msnieman.com/writeups/freelancer/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/freelancer/An IDOR in a base64-encoded OTP URL allows hijacking an admin account on a freelancer platform, exposing an MSSQL terminal; privilege escalation through MSSQL sysadmin and xp_cmdshell delivers a Defender-evading shell, a plaintext SQL service password leads to the mikasa account, volatility analysis of a memory dump recovers lorra199’s credentials, and BloodHound reveals GenericWrite to a group that permits RBCD — ultimately yielding a domain admin via S4U2Proxy on the DC.https://blog.msnieman.com/writeups/ghost/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/ghost/LDAP injection on a Next.js intranet leaks a service-account secret that unlocks Gitea; a custom Ghost CMS file-read exposes an RCE dev key; from there, MSSQL linked-server SA impersonation provides a Windows foothold, and a cross-forest Kerberos golden ticket via Mimikatz completes the domain compromise.https://blog.msnieman.com/writeups/infosek/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/infosek/Exposed WordPress credentials in a public location grant admin panel access; a webshell upload reveals database credentials for the ryder account, and a Meterpreter port-forward through MySQL leads to privilege escalation.https://blog.msnieman.com/writeups/openad/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/openad/A default-credentialed Apache ActiveMQ 5.18.2 console on a Windows domain controller is exploited via CVE-2023-46604 for initial access; a Kerberos ccache file in /tmp enables offline Kerberoasting to recover svc_laps credentials, and a SharpWSUS WSUS poisoning attack leverages the svc_sql account’s WSUS admin rights to execute a SYSTEM-level payload on the domain controller.https://blog.msnieman.com/writeups/playground/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/playground/A Windows domain controller with restricted anonymous access is probed with SMB null sessions, kerbrute, and extensive RPC endpoint mapping; the notes document deep enumeration through backup and web shares but do not reach a foothold — this is a partial writeup covering enumeration only.https://blog.msnieman.com/writeups/redpanda/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/redpanda/A Spring Boot search page reflects user input into a Server-Side Template Injection sink, giving RCE as woodenk; a root-owned log-parser cron is then exploited via JPEG Artist metadata and XML External Entity injection to read root’s SSH key.https://blog.msnieman.com/writeups/resource/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/resource/A zip-upload feature on an SSH key management web app is exploited via a PHP pearcmd LFI-to-RCE trick to land a webshell as www-data; uploaded zip archives contain a HAR file with credentials for msainristil, and a SSH certificate signing API endpoint is abused to sign keys for additional principals, ultimately allowing privilege escalation to root via a sudo-accessible key-signing script.https://blog.msnieman.com/writeups/sea/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/sea/A WonderCMS site’s contact form SSRF is weaponized to deliver CVE-2023-41425, landing a shell as www-data; a password hash found in the CMS database cracks to pivot to a user account, and an internal monitoring service running as root is exploited to escalate.https://blog.msnieman.com/writeups/search/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/search/A password embedded in a webpage image seeds a chain through SMB Kerberoasting, password spraying, and an Excel spreadsheet full of plaintext credentials, culminating in a cracked PFX certificate that unlocks privileged web access.https://blog.msnieman.com/writeups/pingpong/Thu, 07 May 2026 00:00:00 +0000https://blog.msnieman.com/writeups/pingpong/An assumed-breach scenario starting with domain credentials for c.roberts; initial BloodHound enumeration of ping.htb identifies ADCS as a potential privilege escalation path.https://blog.msnieman.com/writeups/vulnescape/Fri, 24 Apr 2026 00:00:00 +0000https://blog.msnieman.com/writeups/vulnescape/An RDP kiosk running Microsoft Edge is escaped by adding a local HTML page and renaming PowerShell to msedge.exe; Remote Desktop Plus stores a masked credential recoverable with BulletsPassView, and a UAC-bypassed elevated PowerShell completes the privilege escalation.https://blog.msnieman.com/writeups/logging/Thu, 23 Apr 2026 00:00:00 +0000https://blog.msnieman.com/writeups/logging/Readable SMB log share leaks an svc_recovery password (with a year-increment pattern), Generic Write on MSA_HEALTH$ enables shadow credential abuse for WinRM access, and a DLL-hijacking scheduled task running as jaylee.clifton combined with a rogue WSUS server (ESC17) delivers a SYSTEM shell.https://blog.msnieman.com/writeups/deputy/Sun, 12 Apr 2026 00:00:00 +0000https://blog.msnieman.com/writeups/deputy/A exposed .git directory leaks Terraform IAM ARNs; a case-sensitivity bug in the event-role API lets those ARNs cross account boundaries, eventually reading a DynamoDB record that contains credentials — which chain through the app to a root password.https://blog.msnieman.com/writeups/templtrap/Thu, 02 Apr 2026 00:00:00 +0000https://blog.msnieman.com/writeups/templtrap/A Langflow AI server exposed on port 80 is exploited via CVE-2026-0770 (SSTI RCE) for an initial shell as karen; screen 5.0.0 setuid-root logging (CVE-2025-23395) is then abused to symlink /etc/sudoers and grant passwordless sudo.https://blog.msnieman.com/writeups/pirate/Sun, 01 Mar 2026 00:00:00 +0000https://blog.msnieman.com/writeups/pirate/Starting with provided pentest credentials against a Windows domain controller, BloodHound reveals two Kerberoastable accounts; the ADM service ticket hash resists cracking, leaving the box incomplete at the enumeration stage.https://blog.msnieman.com/writeups/interpreter/Sun, 22 Feb 2026 00:00:00 +0000https://blog.msnieman.com/writeups/interpreter/Mirth Connect 4.4.0 is vulnerable to CVE-2023-43208 (unauthenticated RCE); database credentials in mirth.properties lead to a PBKDF2-hashed password for the sedric user, and a root-owned Flask service using eval() on attacker-controlled f-strings enables arbitrary command execution as root.https://blog.msnieman.com/writeups/bloodflow/Tue, 17 Feb 2026 00:00:00 +0000https://blog.msnieman.com/writeups/bloodflow/A publicly exposed n8n workflow automation instance is vulnerable to CVE-2026-21858, an unauthenticated arbitrary file read to RCE chain, yielding a shell on the target.https://blog.msnieman.com/writeups/data/Tue, 17 Feb 2026 00:00:00 +0000https://blog.msnieman.com/writeups/data/An unauthenticated Grafana path-traversal (CVE-2021-43798) exposes the SQLite database, leaking PBKDF2 password hashes that crack to yield SSH access; a privileged Docker container is then used to mount the host disk and read the root flag.