https://lukaszpastuszak.dev/tags/windows/Recent content in Windows on Łukasz Pastuszak - security notesHugoen-usSun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/media/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/media/A WMP playlist file leaks Net-NTLMv2 for a crack and SSH login, an NTFS junction redirects an Apache write into the web root for a webshell, and FullPowers plus GodPotato reach SYSTEM.https://lukaszpastuszak.dev/writeups/sniper/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/sniper/LFI in a language parameter plus PHP session poisoning gives RCE as IUSR, a leaked database password reused via PSCredential reaches chris, and a malicious CHM captures the administrator's Net-NTLMv2 for SYSTEM.https://lukaszpastuszak.dev/writeups/tombwatcher/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/tombwatcher/A chain of Active Directory ACL abuses (WriteSPN, AddSelf, ReadGMSAPassword, ForceChangePassword, WriteOwner) reaches john, then AD Recycle Bin plus ADCS ESC15 (CVE-2024-49019) escalates to Administrator.https://lukaszpastuszak.dev/writeups/vulncicada/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/vulncicada/A password on a sticky note in an image from an open NFS share, Kerberos-only authentication, ADCS ESC8 exploited via a Kerberos relay (a serialized empty CREDENTIAL_TARGET_INFORMATION DNS record) plus PetitPotam coercion, a DC machine-account certificate, DCSync, and the Administrator hash.