https://lukaszpastuszak.dev/tags/smb/Recent content in Smb on Łukasz Pastuszak - security notesHugoen-usSat, 15 Jul 2023 00:00:00 +0000https://lukaszpastuszak.dev/writeups/authority/Sat, 15 Jul 2023 00:00:00 +0000https://lukaszpastuszak.dev/writeups/authority/Anonymous SMB access leaks Ansible automation whose weak Ansible Vault passphrase unlocks a PWM admin panel; abusing its Test LDAP Profile feature captures the svc_ldap bind password for WinRM, then an AD CS ESC1 template plus the default MachineAccountQuota mints an Administrator certificate used over Schannel (Pass-the-Cert) to take over the domain.