#
NFS
2 posts
VulnCicada — ADCS ESC8 relay via PetitPotam coercion to Domain Admin
NFS share leaks a user password hidden in an image post-it note; NTLM is disabled forcing Kerberos-only auth; ESC8 web enrollment relay via PetitPotam coercion yields a DC certificate and full domain compromise.
Enigma — NFS credential leak, OpenSTAManager RCE, and OliveTin command injection to root
Unauthenticated NFS share leaks employee credentials → webmail credential reuse → OpenSTAManager RCE via unrestricted file upload → bcrypt hash cracking → OliveTin argument injection as root → SUID bash.