7MS #537: Tales of Pentest Pwnage - Part 42

7MS #537: Tales of Pentest Pwnage - Part 42

In today's episode we share some tips we've picked up in the last few weeks of pentesting, with hopes it will save you from at least a few rounds of smashing your face into the keyboard. Tips include:

  • If you find yourself with "owns" rights to a bajillion hosts in BloodHound, this query will give you a nice list of those systems, one system per line:

cat export-from-bloodhound.json | jq '.nodes[].label' | tr -d '"'

Then you can scan with nmap to find the "live" hosts:

nmap -sn -iL targets.txt

  • For resource based constrained delegation attacks, check out this episode of pwnage for some step-by-step instructions.

  • If you have RBCD admin access to victim systems, don't forget that CrackMapExec support Kerberos! So you can do stuff like:

cme smb VICTIM-SYSTEM -k --sam or cme smb VICTIM-SYSTEM -k -M wdigest -M ACTION=enable

  • Take the time to search SMB shares with something like PowerHuntShares. If you have write access in places, drop an SCF file to capture/pass hashes!

  • Looking to privilege escalate while RDP'd into a system? You owe it to yourself to check out KrbRelayUp!

  • Ever find yourself with cracked hashcat passwords that look something like '$HEX[xxxx]'? Check this tweet from mpgn for a great cracking tip!

Tämä jakso on lisätty Podme-palveluun avoimen RSS-syötteen kautta eikä se ole Podmen omaa tuotantoa. Siksi jakso saattaa sisältää mainontaa.

Jaksot(744)

7MS #744: Using n8n to Automate the Security Dog Food

7MS #744: Using n8n to Automate the Security Dog Food

Hey friends! Today I'm mashing two of our mini-series — eating the security dog food and my new obsession with n8n — into one big automation sandwich. I'll walk you through how Claude and a bunch of J...

17 Loka 26min

7MS #743: Eating the Security Dog Food - Part 9

7MS #743: Eating the Security Dog Food - Part 9

Hey friends, it has been a long time since we talked about eating our own security dog food.  However, I couldn't be more excited about some big ways we've moved the 7MinSec security program forward, ...

9 Loka 25min

7MS #742: Baby's First n8n

7MS #742: Baby's First n8n

Hey friends! I've got some personal and work travel this week, so I'm skipping the tangents (mostly) and jumping straight into something I'm nerdily excited about: Baby's First n8n. If you're not fami...

2 Loka 26min

7MS #741: Tales of Pentest Pwnage - Part 91

7MS #741: Tales of Pentest Pwnage - Part 91

Hey friends! Today's tale of pentest pwnage is brought to you by four hours of sleep, a large mint hot cocoa, and unhealthy levels of giggity. There's a very good reason for all three, but you'll have...

25 Syys 36min

7MS #740: Tales of Pentest Pwnage - Part 90

7MS #740: Tales of Pentest Pwnage - Part 90

Hey friends! We've been on a bit of a Tales of Pentest Pwnage bender lately, so let's keep it rolling with Part 90. (And Mom, relax — this is not one pentest story chopped into 90 parts.) Today is les...

18 Syys 33min

7MS #739: Tales of Pentest Pwnage – Part 89

7MS #739: Tales of Pentest Pwnage – Part 89

Hey friends! Today is a tale of pentest pwnage episode, and this one features a path to escalation I have never seen before – one I could only find few references on the entire Internet. It happened c...

11 Syys 17min

7MS #738: Baby's First ProjectDiscovery Neo

7MS #738: Baby's First ProjectDiscovery Neo

Hey friends! Today I'm talking about Baby's First Neo — and to be crystal clear, I don't mean Keanu, and I don't mean the R&B guy with the hat. I mean the AI-powered pentest assistant from our pals at...

4 Syys 29min

7MS #737: Tales of Pentest Pwnage – Part 88

7MS #737: Tales of Pentest Pwnage – Part 88

Hello friends! Today's tale of pentest pwnage isn't a start-to-finish march to DA – it's me finally emptying out the backlog of "gosh, I've got to share this next time" internal network tips that have...

28 Elo 33min

Suosittua kategoriassa Politiikka ja uutiset

uutiscast
vallattomat
aikalisa
politiikan-puskaradio
rss-viihde-media
ootsa-kuullut-tasta-2
rss-ootsa-kuullut-tasta
rss-vaalirankkurit-podcast
otetaan-yhdet
tervo-halme
rss-voi-venaja
rss-raha-talous-ja-politiikka
rss-podme-livebox
the-ulkopolitist
rss-asiastudio
rss-ulkopoditiikkaa
rss-polikulaari-pitka-kiekko-ja-muut-ts-podcastit
rss-girls-finish-f1rst
rss-suoraan-asiaan
75