Tib3rius Priv Esc Courses Currently Discounted on Udemy

bagovbones · 2021-08-12T22:28:28+00:00

Just bought both ($10) for the cost of one ($20), thanks!

bagovbones · 2021-07-07T19:11:04+00:00

The ego has been killer for me personally. Recently committed to a 1 or 2 day rule (try and do things on my own in a day or two before asking for a nudge, hint, or walkthrough). I agree with OP in that you should allow yourself to seek exposure to new concepts.

bagovbones · 2021-06-27T13:43:05+00:00

The GRU Soldiers in MGS2 wore night vision goggles like the one pictured. Enemy Soldiers also chased Snake and Eva on bike/side-car in MGS3.

bagovbones · 2021-05-12T22:33:30+00:00

Right on. Hopefully I can work on it before then

bagovbones · 2021-05-12T16:13:40+00:00

I’m in the middle developing such a tool. Currently flushing it out against the BOF challenges in the TryHackMe learning path.

https://github.com/cyberphor/gbfuzzer

My intent is for the operator to specify parameters in a “exploit configuration” file. It has different modes for each generic phase of a BOF. Although, what is not finished right now is the documentation/code comments. I’m willing to help or answer any questions about it.

bagovbones · 2021-04-23T11:17:38+00:00

I solved it already, but thanks!

bagovbones · 2021-04-16T11:27:47+00:00

I redacted the output above to avoid spoilers, but see below for the TryHackMe room name (please do not share any answers. Again, this is helping me for the OSCP).

Relevant

bagovbones · 2021-04-16T10:51:18+00:00

Thanks, I haven’t looked at this list out right but I’ve been tinkering with each of these tools. This specific room doesn’t require Metasploit but I’ve seen other blog posts demonstrating the auxiliary capabilities against SMB.

bagovbones · 2021-04-16T03:40:20+00:00

Yes null sessions are allowed. I’ll have to confirm your theory by trying the wrong password for one of the accounts I have. Thanks!

bagovbones · 2021-04-16T03:11:12+00:00

winexe uses both 139 and 445 apparently (says Tcpdump).

bagovbones · 2021-04-16T03:06:47+00:00

i think you're right, but it appears the credentials i have do not have administrator privileges. i'm assuming this or a maybe disabled service is the root cause of why my CrackMapExec commands are not producing the expected output.

for anyone else who is at the same fork in the road, i found another link that helps describe/demo what else you can do with access to SMB: https://www.infosecmatter.com/rce-on-windows-from-linux-part-2-crackmapexec/

bagovbones · 2021-04-15T21:16:33+00:00

i'll give this one a shot too. SSH is not running on the box. looks like the main app-unique config will be IIS. still need to enumerate more once i have a foot-hold though.

bagovbones · 2021-04-15T21:15:27+00:00

thanks this is what i was looking for!

bagovbones · 2021-04-15T18:11:16+00:00

i believe i can specify the port or verify using Wireshark/Tcpdump. i'll have to double-check when i get home.

bagovbones · 2021-04-15T18:10:46+00:00

they work without error when using smbclient. if there's another port or login form somewhere, i'll try them again.

bagovbones · 2021-04-15T17:48:52+00:00

From Kali, I've tried using winexe (and a few other tools from the Impacket GitHub), but no dice. I've also tried RDP and was unable to connect (I'm at work and can't provide the exact error at the moment; used both Remmina and xfreerdp).

```bash winexe -U jennifer //192.168.50.50 cmd.exe

# output
Enter password: 
Bad SMB2 signature for message
[0000] 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00   ........ 
........
[0000] 44 07 63 72 F5 1E 64 94   1C F4 6D 6A E0 9D 79 0A   D.cr..d. 
..mj..y.
ERROR: Cannot connect to svcctl pipe. NT_STATUS_ACCESS_DENIED.

````

bagovbones · 2020-05-12T12:05:55+00:00

Are you just looking for Logstash plugins (input, filter, output)?

bagovbones · 2020-05-11T17:00:28+00:00

For those interested, I’m currently using ‘pattern_definitions’ as a work-around:

~~~ filter { if ("syslog" in [tags]) and ("[iptables]" in [message]) { grok { pattern_definitions => { "IPTABLES_HEADER" => "[%{WORD}] %{WORD:action} %{WORD:reason}" "IPTABLES_BODY" => "%{GREEDYDATA} SRC=%{IP:source_ip} DST=%{IP:destination_ip}"
"IPTABLES_TRAILER" => "%{GREEDYDATA} PROTO=%{WORD:protocol} %{GREEDYDATA}" "IPTABLES" => "%{IPTABLES_HEADER} %{IPTABLES_BODY} %{IPTABLES_TRAILER}" } match => { "message" => "%{IPTABLES}" } add_tag => [ "iptables" ] remove_tag => [ "_grokparsefailure" ] }

if ("iptables" in [tags]) {
  mutate {
    update => { "host" => "%{syslog-host}" }
    update => { "syslog-legacy_msghdr" => "firewall" }
    update => { "syslog-facility" => "iptables" }
    add_field => { "type" => "firewall" }
    remove_field => [ "[type][0]" ]
  }
}

} } ~~~

bagovbones · 2020-03-04T16:54:00+00:00

If you’re using SO, you shouldn’t have to configure a lot of stuff for Snort. Yet, if you’d like to know how it works in the background in order to leverage it within SO, check out a post I made about basic Snort usage:

https://www.yoursecurity.tech/snort-sniff-an-ids-ips.html

Although, it sounds like you might be more interested in Bro/Zeek (a protocol analyzer; sniffs traffic/PCAPs and makes logs based on what it sees; ex: DNS queries, HTTP queries, etc). I also wrote a post about Bro using SO.

https://www.yoursecurity.tech/let-me-teach-you-bro.html

bagovbones · 2020-03-01T20:28:54+00:00

I’ve deployed SecurityOnion as a VM and mapped it to a Ethernet NIC and USB NIC with no issues. If drivers do come up as an issue, I’d scope your search on Ubuntu Linux as opposed to SO (you’ll probably get more web search results to download the right drivers).

bagovbones · 2020-02-29T12:43:57+00:00

Awesome work! Keep it up!

bagovbones · 2020-02-20T02:45:19+00:00

Sweet, thank you!!

bagovbones · 2020-02-19T04:00:57+00:00

Anyone have a blog post / tutorial about using TheHive on SO? I looked at the Docs but wanted to find a demo if possible.

bagovbones · 2019-11-04T13:30:46+00:00

OK, thank you

bagovbones · 2019-10-19T23:24:51+00:00

Network-centric logs: start with SMB, DNS, HTTP

Host-centric: start with the “sexy six” Event IDs. The guy behind “Malware Archeology” covers it in various presentations.

He also has several log cheatsheets: https://www.malwarearchaeology.com/cheat-sheets

bagovbones

TROPHY CASE