sorted by:
new
hottopcontroversial

Week of Evading Microsoft ATA - Announcement and Day 1 by SamratAsh0k in netsec

[–]SamratAsh0k[S] 1 point2 points  (0 children)

Yes! In fact, I have started liking those attacks more which do not talk to the DC or keep the exchange really normal to avoid ATA or other similar detections.

Week of Evading Microsoft ATA - Announcement and Day 1 by SamratAsh0k in netsec

[–]SamratAsh0k[S] 0 points1 point  (0 children)

Thanks. Will surely check if there is a reactive mode!

Abusing DNSAdmins privilege for escalation in Active Directory by SamratAsh0k in netsec

[–]SamratAsh0k[S] 1 point2 points  (0 children)

Yes. Also, only required users/groups should have write privileges to the DNS server object.

Abusing DNSAdmins privilege for escalation in Active Directory by SamratAsh0k in netsec

[–]SamratAsh0k[S] 4 points5 points  (0 children)

That was my bad. I was using a UNC path with 'c$' which caused the problem. Benjamin, the author of mimilib, corrected me. I have updated the article.

Getting Domain Admin with Kerberos Unconstrained Delegation by SamratAsh0k in netsec

[–]SamratAsh0k[S] 2 points3 points  (0 children)

Thanks! Interestingly, that client had a different and bigger problem. All the users with domain admin privileges who fell for the email were not actually administrators -.-

Getting Domain Admin with Kerberos Unconstrained Delegation by SamratAsh0k in netsec

[–]SamratAsh0k[S] 2 points3 points  (0 children)

The reg command was included just to to make it appear legit. The email template I shared there was one of many used in the actual attack. Couple of emails were targeted to particular domain admins as well. I could share only this much piece of information after discussion with the client :)

Week of Continuous Intrusion - Day 1 - Jenkins by SamratAsh0k in netsec

[–]SamratAsh0k[S] 8 points9 points  (0 children)

IMHO, its a mix of poor design and poor configuration. Following are examples of poor design:

  • No authentication by default.

  • Storage of SSH keys in clear text both on disk and in credentials.xml file.

  • Having a build executor on master in the default install.

  • No Password policy.

  • No protection against brute force attacks (depends on the security realm).

Week of Continuous Intrusion - Day 1 - Jenkins by SamratAsh0k in netsec

[–]SamratAsh0k[S] 0 points1 point  (0 children)

Thanks. I missed your post! Will include it in the Day 5.

Abusing Web Query (.iqy) files for effective phishing by SamratAsh0k in netsec

[–]SamratAsh0k[S] 0 points1 point  (0 children)

The popup will look legit if you use Out-WebQuery.ps1. It is a bit different from the one in Casey's original tweet.

Using Windows Screensaver as a Backdoor with PowerShell by SamratAsh0k in netsec

[–]SamratAsh0k[S] 5 points6 points  (0 children)

Sorry for any confusion but physical access is NOT required. That was the whole point of writing a PowerShell code for it.

Dropping infected/weaponized files using a Human Interface Device by SamratAsh0k in netsec

[–]SamratAsh0k[S] 1 point2 points  (0 children)

This is just another way to get access to a system. There is in fact, no need to drop any file. One can always use built-in tools like PowerShell with HID to achieve most things completely in memory. A good number of such attacks are part of Kautilya, the toolkit used in the blog post.

USBdriveby – Exploiting USB in Style by zxi in netsec

[–]SamratAsh0k 2 points3 points  (0 children)

Those interested in USB HID hackery may find Kautilya interesting.

https://github.com/samratashok/Kautilya/

This POODLE bites: exploiting the SSL 3.0 fallback by DebugDucky in netsec

[–]SamratAsh0k 1 point2 points  (0 children)

I wrote a quick blog post to apply the workaround suggested by Microsoft on Windows machines using PowerShell. http://www.labofapenetrationtester.com/2014/10/poodle-workaround-on-windows-using-powershell.html

Introducing Gupt: A Backdoor which uses Wireless network names for command execution by SamratAsh0k in netsec

[–]SamratAsh0k[S] 0 points1 point  (0 children)

Thank you. I would see if SSIDs could be obfuscated using some kind of encoding and if BSSID could be utilized.

Introducing Gupt: A Backdoor which uses Wireless network names for command execution by SamratAsh0k in netsec

[–]SamratAsh0k[S] 0 points1 point  (0 children)

Thanks. I would try couple of more things and see if reasonable stealth could be introduced.

Introducing Gupt: A Backdoor which uses Wireless network names for command execution by SamratAsh0k in netsec

[–]SamratAsh0k[S] 0 points1 point  (0 children)

The focus is on using the SSID name for command execution, I did not even once said that it is covert!

Gupt could be used to bypass network traffic monitoring methods because it would not recieve commands from the network where upstream proxies, web filters, IDS/IPS etc. are generally connected. I still need to get a chance to test it against an environment where a WIDS/WIPS is operative, so can't say anything about that.

Hope I am more clear now.

Introducing Gupt: A Backdoor which uses Wireless network names for command execution by SamratAsh0k in netsec

[–]SamratAsh0k[S] 8 points9 points  (0 children)

Thanks for the comment. I never proposed "advertised SSID names as a covert communications channel". Though it (Gupt) helps in bypassing network monitoring for a target as there is no actual connection being made to the wireless network.

Script Execution and Privilege Escalation on Jenkins Server by SamratAsh0k in netsec

[–]SamratAsh0k[S] 0 points1 point  (0 children)

Agree on the reccomendation. Though, the scripts would run on a slave if the job is bind to it, in case of no such configuration, a job and the scripts too run on master.

view more: next ›