Gmsa on Łukasz Pastuszak - security noteshttps://lukaszpastuszak.dev/tags/gmsa/Recent content in Gmsa on Łukasz Pastuszak - security notesHugoen-usSun, 06 Sep 2026 00:00:00 +0000TombWatcherhttps://lukaszpastuszak.dev/writeups/tombwatcher/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/tombwatcher/A chain of Active Directory ACL abuses (WriteSPN, AddSelf, ReadGMSAPassword, ForceChangePassword, WriteOwner) reaches john, then AD Recycle Bin plus ADCS ESC15 (CVE-2024-49019) escalates to Administrator.