7MS #646: Baby’s First Incident Response with Velociraptor
Release Date: 10/18/2024
7MS #670: Adventures in Self-Hosting Security Services
7 Minute Security
Hi friends, today I’m kicking off a series talking about the good/bad/ugly of hosting security services. Today I talk specifically about . By self-hosting your own instance of transfer.zip, you can send and receive HUGE files that are end-to-end encrypted using WebRTC. Sweet! I also supplemented today’s episode with a short live video over at .
info_outline
7MS #669: What I’m Working on This Week – Part 3
7 Minute Security
Hi friends, in this edition of what I’m working on this week: 3 pulse-pounding pentests that had…problems Something I’m calling the unshadow/reshadow credentials attack Heads-up on a new video experiment I’m going to try next week
info_outline
7MS #668: Tales of Pentest Pwnage – Part 69
7 Minute Security
Hola friends! Today’s tale of pentest pwnage talks about abusing Exchange and the Azure ADSync account! Links to the discussed things: – for all your ADSync account dumping needs! Adam Chester to dump MSOL service account (part of Impacket) to give myself full write privileges on the MSOL sync account: dacledit.py -action ‘write’ -rights ‘FullControl’ -principal lowpriv -target MSOL-SYNC-ACCOUNT -dc-ip 1.2.3.4 domain.com/EXCHANGEBOX$ -k -no-pass Looking to tighten up your Exchange permissions – check out this
info_outline
7MS #667: Pentesting GOAD SCCM - Part 2!
7 Minute Security
Hey friends, our good buddy Joe “The Machine” Skeen and I are back this week with part 2 (check out !) tackling again! Spoiler alert: this time we get DA! YAY! Definitely check out these handy SCCM resources to help you – whether it be in the lab or IRL (in real life): – tremendous resource for enumerating/attacking/privesc-ing within SCCM will help you decrypt SCCM creds stored in SQL
info_outline
7MS #666: Tales of Pentest Pwnage – Part 68
7 Minute Security
Today we have a smattering of miscellaneous pentest tips to help you pwn all the stuff! Selective Snaffling with The importance of having plenty of dropbox disk space – for redundant remote connectivity and PXE abuse! TGTs can be fun for SMB riffling, targeted Snaffling, netexec-ing and ing!
info_outline
7MS #665: What I'm Working on This Week - Part 2
7 Minute Security
Hello there friends, I’m doing another “what I’m working on this week” episode which includes: BPATTY v1.6 release – big/cool/new content to share – this looks to be an awesome way (both paid and free) to securely share files and passwords
info_outline
7MS #664: What I’m Working on This Week
7 Minute Security
In today’s episode I talk about what I’m working on this week, including: Playing with and pairing it with Talking about Netexecer, my upcoming tool that helps automate some of the early/boring stuff in an internal pentest A gotcha to watch out for if utilizing netexec’s
info_outline
7MS #663: Pentesting GOAD SCCM
7 Minute Security
Today we live-hack an SCCM server via using some attack guidance from ! Attacks include: Unauthenticated PXE attack PXE (with password) attack Relaying the machine account of the MECM box over to the SQL server to get local admin
info_outline
7MS #662: Pentesting Potatoes - Part 2
7 Minute Security
Hi friends, today we're talking about pentesting potatoes (not really, but this episode is sort of a homage to where I went to Boise to do a controls assessment and ended up doing an impromptu physical pentest and social engineer exercise). I talk about what a blast I'm having hunting APTs in , and two cool tools I'm building with the help of : A wrapper for that quickly finds roastable users, machines without SMB signing, clients running Webclient and more. A sifter of -captured files to zero in even closer on interesting things such as usernames and passwords in clear text.
info_outline
7MS #661: Baby’s First Hetzner and Ludus – Part 2
7 Minute Security
Today we continue our journey from where we spun up a Hetzner cloud server and Ludus.cloud SCCM pentesting range! Topics include: Building a (this was super helpful) Bridging a second WAN IP to the Hetzner/Ludus server Wrestling with the Hetzner (10-rule limit!) software firewall When attacking SCCM – you can get a !
info_outlineHey friends, today I’m putting my blue hat on and dipping my toes in incident response by way of playing with Velociraptor, a very cool (and free!) tool to find evil in your environment. Perhaps even better than the price tag, Velociraptor runs as a single binary you can deploy to spin up a server and then request endpoints to “phone home” to you by way of GPO scheduled task. The things I talk about in this episode and show in the YouTube stream are all based off of this awesome presentation from Eric Capuano, who also was kind enough to publish a handout to accompany the presentation. And on a personal note, I wanted to share that Velociraptor has got me interested in jumping face first into some tough APT labs provided by XINTRA. More to come on XINTRA’s offering, but so far I’m very impressed!