7MS #32: OSCP – part 3 (audio)

SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount! Peter Kim of The Hacker Playbook series joins me today to talk about all things hacking! Peter runs a popular west coast hacker meetup, and I was fortunate enough to attend his Real World Red Team training, which I wrote a review about here. Peter sat down with me over Skype to talk about: The origin story of The Hacker Playbook series (btw please buy it, don't steal it! :-) How do you balance work and family life when trying to pwn all the things and have a personal life and significant other? How do you break into security when your background is in something totally different, like a mechanic, artist or musician? What are some good strategies when approaching a red team engagement - do you always start "fresh" from the perimeter? Do you assume compromise and throw a dropbox on the network? Some combination of both? What are some other low-hanging fruit organizations can use to better defend their networks? Do you run across some of these good defenses - like honeypots - in your engagements? If you could put on a wizard hat and solve one security problem (be it technical, personnel or something else) what would it be? ...and more!

26 Joulu 20191h 24min

Today's episode is brought to you by ITProTV. It’s never too late to start a new career in IT or move up the ladder, and ITProTV has you covered - from CompTIA and Cisco to EC-Council and VMWare. Get over 65 hours of IT training for free by visiting https://itpro.tv/7minute. Today's episode is all about LAPS - Microsoft's Local Administrator Password solution. In a nutshell, LAPS strengthens and randomizes the local administrator password on the systems across your enterprise. We talked about it way back in episode 252 but figured it was worth a revisit because: It's awesome It's free People still haven't heard of it when I share info about it during conference talks! I've got a full write-up of how to install LAPS here At a recent conference people asked me two awesome edge case questions: What if I aggressively delete inactive machines from my AD - does the LAPS attribute go with it? What do I do if I use Deep Freeze and the LAPS password attribute in AD keeps getting out of sync with the actual password on systems because of Deep Freeze's freeze/thaw times?

19 Joulu 201924min

Today's episode is brought to you by ITProTV. It’s never too late to start a new career in IT or move up the ladder, and ITProTV has you covered - from CompTIA and Cisco to EC-Council and VMWare. Get over 65 hours of IT training for free by visiting https://itpro.tv/7minute. This is part three of this series - part 1 talked about a fire that destroyed my family's home and vehicles, and part 2 was about how to get "back on the grid" and start working with the insurance machine to find a new "normal." Today, I want to answer some burning questions many of you have been asking: Have you hit rock bottom yet? (Spolier alert: no, but I tell you about a moment I almost lost my mind after dropping a shoe in a storm drain) How long to you get to keep rental cars before you have to replace your permanent vehicles? Do you have to stay in a hotel the whole time your house is rebuilt? What about if you get placed in temporary housing - do you have to rebuy your beds/furniture/clothes/etc. and keep them at your temp place, then move them again once your house is rebuilt? What adjustments might you want to make to your insurance policies to make sure you have the right amount of coverage in case of emergency?

12 Joulu 201949min

Today's episode is brought to you by ITProTV. It’s never too late to start a new career in IT or move up the ladder, and ITProTV has you covered - from CompTIA and Cisco to EC-Council and VMWare. Get over 65 hours of IT training for free by visiting https://itpro.tv/7minute. Today's episode is a twofer. That's right, two tales of internal network pentest pwnage. Whoop whoop! We cover: What the SDAD (Single Domain Admin Dance) and DDAD (Double Domain Admin Dance) are (spoiler: imagine your dad trying to dance cool...it's like that, but more awkward) A good way to quickly find domain controllers in your environment: nslookup -type=SRV _ldap._tcp.dc._msdcs.YOURDOMAIN.SUFFIX This handy script runs nmap against subnets, then Eyewitness, then emails the results to you Early in the engagement I'd highly recommend checking for Kerberoastable accounts I really like Multirelay to help me pass hashes, like: MultiRelay.py -t 1.2.3.4 -u bob.admin Administrator yourmoms.admin Once you get a shell, run dump to dump hashes! Then, use CME to pass that hash around the network! crackmapexec smb 192.168.0.0/24 -u Administrator -H YOUR-HASH-GOES-HERE --local auth Then, check out this article to use NPS and get a full-featured shell on your targets

6 Joulu 20191h 2min

SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount! In part 1 of this series we talked about a tragic event my family experienced a few weeks ago: we lost our house and vehicles in a fire. Today I'll talk about: How to get "back on the grid" when starting with nothing but the clothes on your back. Checklist includes: New licenses New ATM/credit cards Rental vehicles Temporary housing How the most wonderful people in the world come out of your past to lift you up and help you out - and how it may not the people you expect What's it like working with the insurance machine? What do they help with and not help with? How much does it suck to lose all your stuff? (Spoiler alert: a lot) The relief (as weird as that sounds) that comes with losing all your material things Thanks again for your support via GoFundMe

21 Marras 201936min

In today's episode I talk about how my family's house and two vehicles were recently destroyed in a fire. The Johnson family is all ok - no injuries, thank God. However, this has turned our world upside down, and over the past week of sleepless nights I've thought a lot about how this tragedy could help others ensure their families are safe and secure both during and after a disaster. I imagine this series will go something like this: Today: Talk about "day zero" - everything that happened on the day of the fire Part 2: Talk about what it's like working with insurance, 3rd party vendors, getting rental cars, finding temporary housing, and basically getting "back on the grid" starting with NO identification or credit cards Part 3: Talk about the people part of all this. What are the effects on the family? On the community? On our health? On our faith? Some folks in the security community were kind enough to setup a GoFundMe if you'd like to support my family during this time.

15 Marras 20191h 14min

Today's episode features a few important changes to the tools and services I use to run 7MS: Docusign is out and (sort of) replaced with Proposify Voltage SecureMail is out and replaced by ShareFile Ninite is rad for keeping mobile pentest dropboxes automatically updated! Nessys_SortyMcSortleton has been updated to...you know...work Additionally, we talk about a few biz-specific challenges: How do you (comfortably) talk about money with a client before the SOW hits their inbox? If you're a small security consultancy of 2-5 people, do you lie about your company size to impress the big client, or tell the truth and brag about the advantages a nimble team can bring?

11 Marras 201956min

SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount! I'm sorry it took me forever and a day to get this episode up, but I'm thrilled to share part 4 (the final chapter - for now anyways) of my interview with the red team guys, Ryan and Dave! In today's episode we talk about: Running into angry system admins (that are either too fired up or not fired up enough) Being wrong without being ashamed When is it necessary to make too much noice to get caught during an engagement? What are the top 5 tools you run on every engagement? How do you deal with monthly test reports indefinitely being a copy/paste of the previous month's report? How do you deal with clients who scope things in such as way that the test is almost impossible to conduct? How do you deal with colleagues who take findings as their own when they talk with management? How do you work with clients who don't know why they want a test - except to check some sort of compliance checkmark? What is a typical average time to complete a pentest on a vendor (as part of a third-party vendor assessment)? How could a fresh grad get into a red team job? What do recruiters look for candidates seeking red team positions? If a red team is able to dump a whole database of hashes or bundle of local machine hashes, should they crack them? What do you do when you're contracted for a pentest, but on day one your realize the org is not at all ready for one? What's your favorite red team horror story?

1 Marras 20191h 24min