7MS #401: Tales of Internal Pentest Pwnage - Part 15
7 Minute Security21 Helmi 2020

7MS #401: Tales of Internal Pentest Pwnage - Part 15

It's episode 401 and we're having fun, right? Some things we cover today:

  • The Webinar version of the DIY Pwnagotchi evening will be offered in Webinar format on Tuesday, March 10 at 10 a.m.

  • A quick house fire update - we're closer to demolition now!

  • I finally got a new guitar!

Besides that, I've got a wonderful tale of pentest pwnage for you. Warning: this is a TBC (to be continued) episode in that I don't even know how it will shake out. I'm honestly not sure if we'll get DA! Here are the highlights:

  • I think in the past I might've said unauthenticated Nessus scans weren't worth much, but this test changed my mind.

  • If you can't dump local hashes with CrackMapExec, try SecretsDump!

./secretsdump.py -target-ip {IP of target machine} localhost/{username}@{target IP}
  • If you're relaying net user commands (or just typing them from a relayed shell), this one-liner is a good way to quickly add your user to local admins and the Remote Desktop Users group:
net user /add ladmin1 s00p3rn4ughtyguy! /Y & net localgroup Administrators ladmin1 /add & net localgroup "Remote Desktop Users" ladmin1 /add
  • Trying to RDP into a box protected with Duo MFA? If you can edit the c:\windows\system32\drivers\etc\hosts file, you might be able change the Duo authentication server from api-xxxxxxx.duosecurity.com to 127.0.0.1 and force authenetication to fail open! Source: Pentest Partners

  • In general, keep an eye on CrackMapExec's output whenever you use the '-x' flag to run commands. If the system is "hanging" on a command for a while and then gives you NO output and just drops you back at your Kali prompt, the command might not be running at all due to something else on the system blocking your efforts.

More on today's show notes at 7ms.us!

Jaksot(710)

7MS #702: Should You Hire AI to Run Your Next Pentest?

7MS #702: Should You Hire AI to Run Your Next Pentest?

Hello friends, in today's episode I give an audio summary of a talk I gave this week at the MN GOVIT Symposium called "Should You Hire AI to Run Your Next Pentest?"  It's not a pro-AI celebration, nor...

21 Marras 202521min

7MS #701: What I'm Working on This Week – Part 5

7MS #701: What I'm Working on This Week – Part 5

Hello friends!  This week I'm talking about what I'm working on this week, including: Preparing a talk called Should You Hire AI to Run Your Next Pentest for the Minnesota GOVIT Symposium. Playing wi...

14 Marras 202518min

7MS #700: Pretender

7MS #700: Pretender

Today is episode 700 of the 7MinSec podcast! Oh my gosh. My mom didn't think we could do it, but we did. Instead of a big blowout with huge news, giveaways and special guests, today is a pretty standa...

7 Marras 20258min

7MS #699: Pre-Travel Security Tips

7MS #699: Pre-Travel Security Tips

Today we discuss some pre-travel tips you can use before hopping on a plane to start a work/personal adventure. Tips include: Updating the family DR/BCP plan Lightening your purse/wallet Validating/t...

31 Loka 202530min

7MS #698: Baby's First ProjectDiscovery

7MS #698: Baby's First ProjectDiscovery

Today I give a quick review of the cloud version of ProjectDiscovery (not a sponsor!).

24 Loka 202524min

7MS #697: Pwning Ninja Hacker Academy – Part 4

7MS #697: Pwning Ninja Hacker Academy – Part 4

Today your pal and mine Joe "The Machine" Skeen pwn one of the two Ninja Hacker Academy domains! This pwnage included: Swiping service tickets in the name of high-priv users Dumping secrets from wmo...

18 Loka 202513min

7MS #696: Baby's First Security Ticketing System

7MS #696: Baby's First Security Ticketing System

In today's episode: I got a new podcast doodad I really like JitBit as a security ticketing system (not a sponsor) The Threat Hunting with Velociraptor 2-day training was great. Highly recommend. I...

10 Loka 202527min

7MS #695: Tales of Pentest Pwnage - Part 78

7MS #695: Tales of Pentest Pwnage - Part 78

Today's tale of pentest pwnage involves: Using mssqlkaren to dump sensitive goodies out of SCCM Using a specific fork of bloodhound to find machines I could force password resets on (warning: don't d...

3 Loka 202515min

Suosittua kategoriassa Politiikka ja uutiset

aikalisa
tervo-halme
rss-ootsa-kuullut-tasta
ootsa-kuullut-tasta-2
politiikan-puskaradio
rss-vaalirankkurit-podcast
rss-podme-livebox
viisupodi
otetaan-yhdet
et-sa-noin-voi-sanoo-esittaa
rss-tasta-on-kyse-ivan-puopolo-verkkouutiset
io-techin-tekniikkapodcast
linda-maria
rikosmyytit
rss-polikulaari-humanisti-vastaa-ja-muut-ts-podcastit
rss-merja-mahkan-rahat
mtv-uutiset-polloraati
rss-aika-ankkuri
rss-kaikki-uusiksi
rss-raha-talous-ja-politiikka