7MS #670: Adventures in Self-Hosting Security Services
7 Minute Security
Hi friends, today I’m kicking off a series talking about the good/bad/ugly of hosting security services. Today I talk specifically about . By self-hosting your own instance of transfer.zip, you can send and receive HUGE files that are end-to-end encrypted using WebRTC. Sweet! I also supplemented today’s episode with a short live video over at .
info_outline
7MS #669: What I’m Working on This Week – Part 3
7 Minute Security
Hi friends, in this edition of what I’m working on this week: 3 pulse-pounding pentests that had…problems Something I’m calling the unshadow/reshadow credentials attack Heads-up on a new video experiment I’m going to try next week
info_outline
7MS #668: Tales of Pentest Pwnage – Part 69
7 Minute Security
Hola friends! Today’s tale of pentest pwnage talks about abusing Exchange and the Azure ADSync account! Links to the discussed things: – for all your ADSync account dumping needs! Adam Chester to dump MSOL service account (part of Impacket) to give myself full write privileges on the MSOL sync account: dacledit.py -action ‘write’ -rights ‘FullControl’ -principal lowpriv -target MSOL-SYNC-ACCOUNT -dc-ip 1.2.3.4 domain.com/EXCHANGEBOX$ -k -no-pass Looking to tighten up your Exchange permissions – check out this
info_outline
7MS #667: Pentesting GOAD SCCM - Part 2!
7 Minute Security
Hey friends, our good buddy Joe “The Machine” Skeen and I are back this week with part 2 (check out !) tackling again! Spoiler alert: this time we get DA! YAY! Definitely check out these handy SCCM resources to help you – whether it be in the lab or IRL (in real life): – tremendous resource for enumerating/attacking/privesc-ing within SCCM will help you decrypt SCCM creds stored in SQL
info_outline
7MS #666: Tales of Pentest Pwnage – Part 68
7 Minute Security
Today we have a smattering of miscellaneous pentest tips to help you pwn all the stuff! Selective Snaffling with The importance of having plenty of dropbox disk space – for redundant remote connectivity and PXE abuse! TGTs can be fun for SMB riffling, targeted Snaffling, netexec-ing and ing!
info_outline
7MS #665: What I'm Working on This Week - Part 2
7 Minute Security
Hello there friends, I’m doing another “what I’m working on this week” episode which includes: BPATTY v1.6 release – big/cool/new content to share – this looks to be an awesome way (both paid and free) to securely share files and passwords
info_outline
7MS #664: What I’m Working on This Week
7 Minute Security
In today’s episode I talk about what I’m working on this week, including: Playing with and pairing it with Talking about Netexecer, my upcoming tool that helps automate some of the early/boring stuff in an internal pentest A gotcha to watch out for if utilizing netexec’s
info_outline
7MS #663: Pentesting GOAD SCCM
7 Minute Security
Today we live-hack an SCCM server via using some attack guidance from ! Attacks include: Unauthenticated PXE attack PXE (with password) attack Relaying the machine account of the MECM box over to the SQL server to get local admin
info_outline
7MS #662: Pentesting Potatoes - Part 2
7 Minute Security
Hi friends, today we're talking about pentesting potatoes (not really, but this episode is sort of a homage to where I went to Boise to do a controls assessment and ended up doing an impromptu physical pentest and social engineer exercise). I talk about what a blast I'm having hunting APTs in , and two cool tools I'm building with the help of : A wrapper for that quickly finds roastable users, machines without SMB signing, clients running Webclient and more. A sifter of -captured files to zero in even closer on interesting things such as usernames and passwords in clear text.
info_outline
7MS #661: Baby’s First Hetzner and Ludus – Part 2
7 Minute Security
Today we continue our journey from where we spun up a Hetzner cloud server and Ludus.cloud SCCM pentesting range! Topics include: Building a (this was super helpful) Bridging a second WAN IP to the Hetzner/Ludus server Wrestling with the Hetzner (10-rule limit!) software firewall When attacking SCCM – you can get a !
info_outlineThis was my favorite pentest tale of pwnage to date! There’s a lot to cover in this episode so I’m going to try and bullet out the TLDR version here:
- Sprinkled farmer files around the environment
- Found high-priv boxes with WebClient enabled
- Added “ghost” machine to the Active Directory (we’ll call it GHOSTY)
- RBCD attack to be able to impersonate a domain admin using the CIFS/SMB service against the victim system where some higher-priv users were sitting
- Use net.py to add myself to local admin on the victim host
- Find a vulnerable service to hijack and have run an evil, TGT-gathering Rubeus.exe – found that Credential Guard was cramping my style!
- Pulled the TGT from a host not protected with Credential Guard
- Figured out the stolen user’s account has some “write” privileges to a domain controller
- Use rbcd.py to delegate from GHOSTY and to the domain controller
- Request a TGT for GHOSTY
- Use getST.py to impersonate CIFS using a domain admin account on the domain controller (important thing here was to specify the DC by its FQDN, not just hostname)
- Final move: use the domain admin ccache file to leverage net.py and add myself to the Active Directory Administrators group