Raining shells on Linux environments with Hwacha

If you’ve read previous posts on here you know that I am a big fan of CrackMapExec. One of the things that makes it particularly useful is I can run a payload against multiple targets at once.  A variety of payloads exist, though my favorites are “mimikatz” and “met_inject”, which executes Meterpreter shellcode on a…


Exploiting blind Java deserialization with Burp and Ysoserial

While performing a web application penetration test, I stumbled upon a parameter with some base64 encoded data within a POST parameter. Curious as to what it was, I send it over to Burp decoder.  After two rounds of URL decoding and one round of Base64 decoding, I had what appeared to be a serialized Java…


Detecting CrackMapExec (CME) with Bro, Sysmon, and Powershell logs

CrackMapExec is a popular tool that is used by attackers to move laterally throughout an environment. I use it personally on my penetration tests, as I’ve found that it does a really good job at moving from system to system without detection.  My goal with this blog post is to give defenders some techniques on…


VulnHub Walkthrough: RickdiculouslyEasy 1

A new Boot2Root came online on VulnHub and it looked like fun.  This one is themed around a cartoon show called “Rick and Morty”. First order of business for me is to run an Nmap scan. I like to do a full TCP port scan with service enumeration. root@kali:~# nmap 10.0.1.9 -Pn -p- -sV Starting…


How to Burp Good

Burp Suite is one of my favorite tools for web application testing. The feature set is rich, and anything that it does not do by default can usually be added with an extension.  There are a few things however, that while they exist in Burp Suite, they are not completely intuitive.  Here are a few…


SSL Phishing with GoPhish and LetsEncrypt

  To achieve a more successful phishing campaign and to protect client credentials in transit, adding an SSL certificate to your phishing pages can a great addition. This guide assumes that you already have GoPhish set up and a phishing domain registered. For detailed instructions on how to set up GoPhish, review their documentation. To…


VulnHub Walkthrough: Donkey Docker

I’m always on the lookout for VulnHub VMs that teach real pentesting skills, and are not just puzzles.  I like them to be practical, and force you to learn techniques that you would use in the real world.  I feel Donkey Docker is one of these challenges.  As always we can begin with an nmap…


Exploiting Server Side Include Injection

Recently I was performing a penetration test and came across a Server Side Include injection bug (SSI).  If you are familiar with cross-site scripting (XSS) this type of vulnerability will sound familiar.  This is caused by an application taking input form the user, and supplying it in the response from the server.  The mitigations are…


Exploiting an unsecured Dell Foglight server

  Dell Foglight for Virtualization is an infrastructure performance monitoring tool that can also be used to manage systems as well.  It comes configured with a default username and password of “foglight”. It is possible to execute code on the host itself through an integrated scripting console. By browsing to Homes -> Administration And then…


Securing a default installation of MacOS

  This was originally written as the basis for a GIAC Gold paper.  Ultimately, it was not unique enough to warrant a research paper, but will provide an overview of the security features of MacOS.   As of mid 2016, MacOS captures nearly 10% of the global market for desktop PC software.  While Apple computers…


Phishing with Maldocs

  There are many ways to run a phishing campaign.  The most common of them all is a typical credential harvesting attack, where the attacker sends an email to the target enticing them to click a link to a spoofed website.  Running these campaigns are fairly straight forward, and a couple of tools make this…


Squeezing the juice out of a compromised WordPress server

During the course of a penetration test, you may stumble upon a web server running WordPress.  WordPress is a highly popular CMS.  It runs on PHP, and is typically ran on top of a LAMP stack.  While most WordPress servers on the web are configured with strong passwords and security plugins, rarely is this the…


VulnHub Walkthrough: hackfest2016: Sedna

Sedna is the second vulnerable VM released by hackfest.ca this month.  Much of the first steps of enumeration will be similar to that of my write up for the first VM in the series. The first thing I start with is an Nmap scan.  The output is below, shortened for brevity. root@kali:~# nmap 10.0.1.22 -p-…


VulnHub Walkthrough: hackfest2016: Quaoar

A relatively new set of VulnHub CTFs came online in March 2017.  This post is about the first and easiest one, named “Quaoar“. This post will be a walk-through of my exploitation of this system. The first thing I like to start off with on any box is a full TCP port scan.  When you…


Compromising Synergy clients with a rogue Synergy server

  Synergy is a type of mouse an keyboard sharing software. When configured, moving your mouse off the screen will allow you to control another system that is also set up with Synergy. Below is a YouTube video from Synergy on how it works: The way this works is one host acts as the Synergy…


From OSINT to Internal – Gaining Access from outside the perimeter

                  During an external penetration test, you may be tasked with gaining access from the internet with no knowledge of the a target environment.  After hitting all known servers and web applications with various scanning tools, you have nothing. Searching open source information such as database breaches…


Removing Backdoors – Powershell Empire Edition

                  I’m a big fan of Powershell Empire for penetration testing.   If you haven’t heard of it, it is a post-exploitation framework which uses powershell agents to run post-exploitation scripts on a target system.  This blog post is meant to address a small subset of the…


Compromising Jenkins and extracting credentials

      Jenkins is an open-source continuous integration software tool written in the Java programming language.  While useful to developers, it can also be useful to attackers.  Often times developers will leave Jenkins consoles in an insecure state, especially within development environments.  Jenkins has a scripting console available which can be used to run…


Control your Mac with an iPhone app – An analysis of HippoRemote

              Applications that are in use on Macs often times are under less scrutiny for security compared to their Windows alternatives.  When researching popular apps in use on OS X I found an app on the iPhone called HippoRemote.  It appears to be quite popular, with a combined 7,558…


Using email for persistence on OS X

In this post we will cover how we can use Mail.app on OS X to persist.  I was inspired by similar tools which are designed to work with Microsoft Outlook.  I first stumbled upon this article from MWR InfoSecurity, and then this blog post from Silent Break Security.  While rules in Mail.app will not replicate…