7MS #640: Tales of Pentest Pwnage – Part 63

7MS #640: Tales of Pentest Pwnage – Part 63

This was my favorite pentest tale of pwnage to date! There’s a lot to cover in this episode so I’m going to try and bullet out the TLDR version here:

  • Sprinkled farmer files around the environment
  • Found high-priv boxes with WebClient enabled
  • Added “ghost” machine to the Active Directory (we’ll call it GHOSTY)
  • RBCD attack to be able to impersonate a domain admin using the CIFS/SMB service against the victim system where some higher-priv users were sitting
  • Use net.py to add myself to local admin on the victim host
  • Find a vulnerable service to hijack and have run an evil, TGT-gathering Rubeus.exe – found that Credential Guard was cramping my style!
  • Pulled the TGT from a host not protected with Credential Guard
  • Figured out the stolen user’s account has some “write” privileges to a domain controller
  • Use rbcd.py to delegate from GHOSTY and to the domain controller
  • Request a TGT for GHOSTY
  • Use getST.py to impersonate CIFS using a domain admin account on the domain controller (important thing here was to specify the DC by its FQDN, not just hostname)
  • Final move: use the domain admin ccache file to leverage net.py and add myself to the Active Directory Administrators group

Avsnitt(682)

7MS #97: OFFTOPIC-Limbo

7MS #97: OFFTOPIC-Limbo

We're going off topic today and talking about video games! LIMBO for the Xbox!

25 Sep 20157min

7MS #96: How to Make Enemies During a Security Assessment

7MS #96: How to Make Enemies During a Security Assessment

Yep, we're talking about how to make ENEMIES during a security assessment today (and maybe turn them into friends).

23 Sep 20159min

7MS #95: How to Make Friends During a Security Assessment

7MS #95: How to Make Friends During a Security Assessment

When you start a security assessment with a company, not everybody's gonna be glad to see you. The IT dept and other employees may have tense shoulders, thinking that this is an Office Space situation where they're interviewing for their jobs. This episode talks about some ways you might be able to get your assessment off to a right start.

17 Sep 20157min

7MS #94: Learn How to Burp - Part 1

7MS #94: Learn How to Burp - Part 1

I've been looking for better ways to learn Burp Suite and I struck gold! Check out my recommendations in today's episode!

15 Sep 20158min

7MS #93: Securing Your Life

7MS #93: Securing Your Life

So yeah, this is kind of off-topic, but have you thought about security in the sense of "What kinds of security things should I be doing before I'm dead?" Today's episode explores that.

11 Sep 20158min

7MS #92: You're Not Ready for Big Boy Security Pants

7MS #92: You're Not Ready for Big Boy Security Pants

Sometimes I get in situations where clients want their WHOLE security program reviewed, but in reality, they are still in the baby steps phase. What's the right thing to do when, for lack of a better term, the client isn't ready to put on their security big boy points?

9 Sep 20157min

7MS #91: Umbrella

7MS #91: Umbrella

Today's episode is about Umbrella, a product from OpenDNS that provides a layer of protection against malware, wifi-jacking and other threats.

3 Sep 20157min

7MS #90: OFFTOPIC-Citizenfour

7MS #90: OFFTOPIC-Citizenfour

We're going offtopic today and talking about the Citizen Four documentary, which centers around the Edward Snowden story.

1 Sep 20158min

Populärt inom Politik & nyheter

p3-krim
flashback-forever
rss-vad-fan-hande
rss-viva-fotboll
olyckan-inifran
svenska-fall
svd-dokumentara-berattelser-2
aftonbladet-daily
rss-sanning-konsekvens
fordomspodden
motiv
krimmagasinet
blenda-2
rss-krimstad
rss-frandfors-horna
dagens-eko
spar
rss-expressen-dok
spotlight
svd-nyhetsartiklar