7 Minute Security

Hey friends, today my  Paul  and I kept trying to hack the  VulnHub  machine based on the movie  Billy Madison  (see part  1  and  2 ). In our journey we learned some good stuff: Port knocking is awesome using utilities like  knock : /opt/knock/knock 10.0.7.124 1466 67 1469 1514 1981 1986 Sending emails via command line is made (fairly) easy with swaks: swaks --to eric@madisonhotels.com --from vva...

Today we're talking about 7 steps you can take to (hopefully) reclaim a hacked Facebook account. The key steps are: Ask Facebook for help (good luck with that) Put out an SOS on your socials Flag down the FBI Call the cops! Grumble to your attorney general Have patience Lock it down (once you get the account back)! Also, I have to say that  this article  was a  fantastic  resource in helping me cr...

Today we talk about an awesome path to internal network pentest pwnage using  downgraded authentication  from a domain controller, a tool called  ntlmv1-multi , and a boatload of cloud-cracking power on the cheap from  vast.ai . Here's my chicken scratch notes for how to take the downgraded authentication hash capture (using  Responder.py -I eth0 --lm ) and eventually tweeze out the NTLM hash of t...

Today my  Paul  and I continued hacking  Billy Madison  (see part one  here ) and learned some interesting things: You can fuzz a URL with a specific file type using a format like this: wfuzz -c -z file,/root/Desktop/wordlist.txt --hc 404 http://x.x.x.x/FUZZ.cap To rip .cap files apart and make them "pretty" you can use  tpick : tcpick -C -yP -r tcp_dump.pcap Or tcpflow: apt install tcpflow tcpflo...

In today's tale of pentest pwnage we talk about: The importance of local admin and how access to even  one  server might mean instant, full control over their backup or virtualization infrastructure Copying files via WinRM when copying over SMB is blocked: $sess = New-PSSession -Computername SERVER-I-HAVE-LOCAL-ADMIN-ACCESS-ON -Credential * ...then provide your creds...and then: copy-item c:\super...

Today Amanda Berlin from  Blumira  teaches us how to unlock the power of Sysmon so we can gain insight into the good, bad and ugly things happening on our corporate endpoints!  Key takeaways: Sysmon  turns your windows logging up to 11, and pairs well with a config file like  this one  or  this one . Careful if you are are running sysmon on non-SSD drives - the intense number of writes might bring...

Today my pal Paul from  Project7  and I hack the heck out of  Billy Madison  a vulnerable virtual machine that is celebrating its 7th anniversary this month!

Today, sadly, might be the last episode of DIY pentest dropbox tips for a while because I found (well, ChatGPT did actually) the missing link to 100% automate a Kali Linux install! Check  episode #449  for more info on building your Kali preseed file, but essentially the last line in my file runs a  kali.sh  script to download/install all the pentest tools I want. The "missing link" part is I figu...

Hey friends, today I'm super excited to share I found the missing link! Specifically, the missing piece that now allows me to create  fully automated  Windows 10 installs that serve as virtual pentest jumpboxes. Here are the high points: When your deployment script is finishing and you need the system to reboot and run some final commands, temporarily add your account as an auto-login account like...

In today's tale of pwnage, we'll talk about how domain trusts can be dangerous because they have...well...trust issues.

Today we talk about crafting cool cred-capturing phishing campaigns with  Caddy server ! Here's a quick set of install commands for Ubuntu: sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg curl -1sLf 'https://dl.cloudsmith.io/pu...

Today we had a blast playing with  Wazuh  as a SIEM you can use for work and/or home. Inspiration for this episode came from  Network Chuck . This one-liner will literally get Wazuh installed in about 5 minutes: curl -sO https://packages.wazuh.com/4.4/wazuh-install.sh && sudo bash ./wazuh-install.sh -a P.S. if you accidentally close your command window before writing down the admin password (like...

Oooo, giggidy! Today's tale of pentest pwnage is about pwning vCenter with CVE-2021-44228 - a vulnerability that lets us bypass authentication entirely and do/take what we want from vCenter! Key links to make the magic happen: How to exploit log4j manually in vCenter How to automate the attack! Tool to steal the SAML database you extract from vCenter

Today me and my pal Paul from  Project7  did a live hacking session and finally got the  Callahan Auto brake pad Web app  back online! Hopefully you enjoyed this hacking series. The feedback has been great, so we may have to take a crack at  Billy  in the near future as well.

Hey friends, today we're continuing our series on pwning the  Tommy Boy VM on VulnHub  VM! P.S. did you miss part one? Check it out on  YouTube . Joe "The Machine" Skeen and I had a blast poking and prodding at the VM in hopes to fix the broken Callahan Auto brake-ordering Web app. Some tips/tricks we cover: It's always a good idea to look at a site's  robots.txt  file crunch  is awesome for makin...

Today I'm excited to share a featured interview with our new friend Mike Toole of  Blumira . We talk about all things EDR, including: How does it differ from something like Windows Defender? What things do I need to keep in mind if I'm in the market for an EDR purchase? Is Mac EDR any good? How do attackers bypass EDR? Will AI create industructible malware, take over the human race and then use ou...

Holy schnikes - this episode is actually 7 minutes long! What a concept! Anyway, today I give you a couple tips that have helped me pwn some internal networks the last few weeks, including: Getting a second (and third?) opinion on Active Directory Certificate Services vulnerabilities! Analyzing the  root  domain object in BloodHound to find some misconfigs that might equal instant domain admin acc...

Hey friends! Today we're taking a second look at  ADHD - Active Defense Harbinger Distribution  - a cool VM full of tools designed to annoy/attribute/attack pesky attackers! The tools covered today include: PHP-HTTP-TARPIT A tool to confuse and waste bot/scanner/hacker time. Grab it  here  and check out our setup instructions: sudo git clone https://github.com/msigley/PHP-HTTP-Tarpit.git /opt/tarp...

Hey friends! Today we're looking at  ADHD - Active Defense Harbinger Distribution  - a cool VM full of tools designed to annoy/attribute/attack pesky attackers! ADHD gets you up and running with these tools quickly, but the distro hasn't been updated in a while, so I switched to a vanilla  Kali  system and setup a  cowrie SSH honeypot as follows (see 7ms.us for full list of commands).

Today we're talking about reducing anxiety by hacking your mental health with these tips: Using  personal automation  to text people important reminders Using  Remind  to create a personal communication "class" with your family members Using  Smartsheet  (not a sponsor) to create daily email "blasts" to yourself about all the various project todos you need to tackle

Today we look at  LDAP Firewall  - a cool (and free!) way to defend your domain controllers against  SharpHound  enumeration,  LAPS  password enumeration, and the  noPac attack .

Hey friends! This week I spoke at the Secure360 conference in Minnesota on  Simple Ways to Test Your SIEM . This is something I covered  a while back  on the podcast, but punched up the content a bit and built a refreshed a two-part  GitHub gist  that covers: Questions you can ask a prospective SIEM/SOC solution to figure out which one is the right fit for you All the tools/tips/scripts/etc. you n...

SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit  safepass.me  for more details, and tell them 7 Minute Security sent you to get a 10% discount! In today's episode we staged an NTLM relay attack using a  vulnerable SQL server . First we used CrackMapExec (see our two part series on Cracking and Mapping and Execing...

Today we're excited to share a featured interview with our new friend Jim Simpson, CEO of  Blumira . Jim was in security before it was hip/cool/lucrative, working with a number of startups as well as some big names like Duo. Blumira and 7 Minute Security have a shared love for helping SMBs be more secure, so it was great to chat with Jim about the IT/security challenges faced by SMBs, and what we...

Hey friends, today we're playing with the new (April 2023) version of  Local Administrator Password Solution (LAPS) . Now it's baked right into PowerShell and the AD Users and Tools console. It's awesome, it's a necessary blue team control for any size company, and you should basically stop reading this and install LAPS now.