7MS #382: Tales of Internal Network Pentest Pwnage - Part 9

7MS #382: Tales of Internal Network Pentest Pwnage - Part 9

Today's episode is brought to you by ITProTV. It's never too late to start a new career in IT or move up the ladder, and ITProTV has you covered - from CompTIA and Cisco to EC-Council and VMWare. Get over 65 hours of IT training for free by visiting https://itpro.tv/7minute.

Today's episode is about a pentest that was pretty unique for me. I got to ride shotgun and kind of be in the shadows while helping another team pwn a network.

This was an especially interesting one because the client had a lot of great security defenses in place, including:

  • Strong user passwords
  • A SIEM solution that appeared to be doing a great job

We did some looking for pwnage opportunities such as:

  • Systems missing EternalBlue patch
  • Systems missing BlueKeep patch

What got us a foot in the door was the lack of SMB signing. Check this gist to see how you can use RunFinger.py to find hosts without SMB signing, then use Impacket and Responder to listen for - and pass - high-priv hashes.

Side note: I'm working on getting a practical pentesting gist together in the vein of Penetration Testing: A Hands-On Introduction to Hacking and Hacker Playbook.

Episoder(720)

7MS #584: Tales of Pentest Pwnage - Part 50

7MS #584: Tales of Pentest Pwnage - Part 50

In today's tale of pwnage, we'll talk about how domain trusts can be dangerous because they have...well...trust issues.

11 Aug 202317min

7MS #583: Cred-Capturing Phishing with Caddy Server

7MS #583: Cred-Capturing Phishing with Caddy Server

Today we talk about crafting cool cred-capturing phishing campaigns with Caddy server! Here's a quick set of install commands for Ubuntu: sudo apt install -y debian-keyring debian-archive-keyring apt-...

4 Aug 202329min

7MS #582: Using Wazuh as a SIEM for Work and Home

7MS #582: Using Wazuh as a SIEM for Work and Home

Today we had a blast playing with Wazuh as a SIEM you can use for work and/or home. Inspiration for this episode came from Network Chuck. This one-liner will literally get Wazuh installed in about 5 m...

31 Jul 202350min

7MS #581: Tales of Pentest Pwnage - Part 49

7MS #581: Tales of Pentest Pwnage - Part 49

Oooo, giggidy! Today's tale of pentest pwnage is about pwning vCenter with CVE-2021-44228 - a vulnerability that lets us bypass authentication entirely and do/take what we want from vCenter! Key links...

21 Jul 202322min

7MS #580: Hacking Tommy Callahan - Part 3

7MS #580: Hacking Tommy Callahan - Part 3

Today me and my pal Paul from Project7 did a live hacking session and finally got the Callahan Auto brake pad Web app back online! Hopefully you enjoyed this hacking series. The feedback has been grea...

17 Jul 202331min

7MS #579: Hacking Tommy Callahan - Part 2

7MS #579: Hacking Tommy Callahan - Part 2

Hey friends, today we're continuing our series on pwning the Tommy Boy VM on VulnHub VM! P.S. did you miss part one? Check it out on YouTube. Joe "The Machine" Skeen and I had a blast poking and prodd...

7 Jul 202337min

7MS #578: Interview with Mike Toole of Blumira

7MS #578: Interview with Mike Toole of Blumira

Today I'm excited to share a featured interview with our new friend Mike Toole of Blumira. We talk about all things EDR, including: How does it differ from something like Windows Defender? What th...

30 Jun 20231h

7MS #577: Tales of Pentest Pwnage - Part 48

7MS #577: Tales of Pentest Pwnage - Part 48

Holy schnikes - this episode is actually 7 minutes long! What a concept! Anyway, today I give you a couple tips that have helped me pwn some internal networks the last few weeks, including: Getting ...

16 Jun 20237min

Populært innen Politikk og nyheter

giver-og-gjengen-vg
aftenpodden
aftenpodden-usa
forklart
popradet
stopp-verden
lydartikler-fra-aftenposten
fotballpodden-2
det-store-bildet
nokon-ma-ga
rss-gukild-johaug
hanna-de-heldige
dine-penger-pengeradet
rss-ness
rss-espen-lee-usensurert
aftenbla-bla
rss-dannet-uten-piano
e24-podden
grasoner-den-nye-kalde-krigen
frokostshowet-pa-p5