---
title: "M1H (@m1h) | Hashnode"
description: "Security Researcher | Bug Bounty Hunter | Purple Team | CTF Player. Read the latest articles by M1H on Hashnode."
url: "https://hashnode.com/@m1h"
---

@m1h

# M1H

@m1h · EMEA · Joined March 2026

Security Researcher | Bug Bounty Hunter | Purple Team | CTF Player

### [Kitsune: AD CS ESC13 to Domain Admin via Backup Operators](https://m1h.hashnode.dev/kitsune-ad-cs-esc13-to-domain-admin-via-backup-operators?utm_source=hashnode&utm_medium=feed)

Active Directory ADCS ESC13 abuse, gMSA password extraction, and Backup Operators lead to full Domain Admin compromise.

7 min read · [m1h.hashnode.dev](https://m1h.hashnode.dev/kitsune-ad-cs-esc13-to-domain-admin-via-backup-operators?utm_source=hashnode&utm_medium=feed)

[Oct 23](https://hashnode.com/posts/kitsune-ad-cs-esc13-to-domain-admin-via-backup-operators/6adaac3a51d594b3bca6946a)

### [How I Got My First Official High Severity CVE That Leads to Admin Account Hijacking](https://m1h.hashnode.dev/how-i-got-my-first-official-high-severity-cve-that-leads-to-admin-account-hijacking?utm_source=hashnode&utm_medium=feed)

How I Got My First Official High Severity CVE That Leads to Admin Account Hijacking

12 min read · [m1h.hashnode.dev](https://m1h.hashnode.dev/how-i-got-my-first-official-high-severity-cve-that-leads-to-admin-account-hijacking?utm_source=hashnode&utm_medium=feed)

[Oct 13](https://hashnode.com/posts/how-i-got-my-first-official-high-severity-cve-that-leads-to-admin-account-hijacking/6ace3bbb0cc7e2aecdb9aab2)

### [Active Directory Compromise via ACL Chains & ESC4 Certificate Template Abuse](https://m1h.hashnode.dev/active-directory-compromise-via-acl-chains-esc4-certificate-template-abuse?utm_source=hashnode&utm_medium=feed)

Active Directory compromise via ACL chains and an ESC4 certificate flaw. Full pentest chain from web foothold to Domain Admin.

11 min read · [m1h.hashnode.dev](https://m1h.hashnode.dev/active-directory-compromise-via-acl-chains-esc4-certificate-template-abuse?utm_source=hashnode&utm_medium=feed)

[Oct 5](https://hashnode.com/posts/active-directory-compromise-via-acl-chains-esc4-certificate-template-abuse/6ac391771f8e0129724ffa04)

### [Leveraging RDP Access and PowerShell History to Escalate Privileges on a Windows Host](https://m1h.hashnode.dev/leveraging-rdp-access-and-powershell-history-to-escalate-privileges-on-a-windows-host?utm_source=hashnode&utm_medium=feed)

Windows privilege escalation walkthrough: exploiting exposed PowerShell history to escalate from a standard user to admin and capture the root flag.

4 min read · [m1h.hashnode.dev](https://m1h.hashnode.dev/leveraging-rdp-access-and-powershell-history-to-escalate-privileges-on-a-windows-host?utm_source=hashnode&utm_medium=feed)

[Oct 2](https://hashnode.com/posts/leveraging-rdp-access-and-powershell-history-to-escalate-privileges-on-a-windows-host/6abf8e25526f50e54f7d4c8a)

### [Application Security Review: Implicit-Grant Identity Confusion](https://m1h.hashnode.dev/application-security-review-implicit-grant-identity-confusion?utm_source=hashnode&utm_medium=feed)

Overview: This challenge box covers both sides of web application security: web application black-box testing and white-box auditing. Objective #1: Penetration Test Our engineering team is currently r

6 min read · [m1h.hashnode.dev](https://m1h.hashnode.dev/application-security-review-implicit-grant-identity-confusion?utm_source=hashnode&utm_medium=feed)

[Sep 29](https://hashnode.com/posts/application-security-review-implicit-grant-identity-confusion/6abbebfb3446daa5b79bfe26)