Hey friends! Today is a tale of pentest pwnage episode, and this one features a path to escalation I have never seen before – one I could only find few references on the entire Internet. It happened completely by accident, but during the report readout I'm absolutely going to say it was intentional and that I totally meant to do that. Here's what we cover: <ul> <li>A client that's actually doing the things – year two or three of testing this environment, and they had buttoned up so much that I had to dig deep. Great for them, freaking frustrating for me.</li> <li>Why my Kerberoasting success rate has fallen off a cliff – Microsoft pushed an encryption change earlier this year, and cracking those hashes is a whole different ballgame now.</li> <li>Selective poisoning vs. poison-all-the-things – a nod to Pretender, which I covered in a TuesdayTOOLSday video over at 7MinSec.club. It doesn't get nearly enough love in blogs and videos.</li> <li>The relay that fired… and did something completely different than I expected – I saw the ntlmrelayx log scroll by, thought "yes, I've got DA," and then had a "wait, wait, whoa, what?" moment. I was honestly a little panicked.</li> <li>An ancient Exchange vulnerability comes back to bite – <a href= "https://github.com/fortra/impacket/pull/1288" target="_blank" rel= "noopener">CVE-2021-34470 (vulnerable Exchange schema)</a> turned out to be the fallback that got me a foothold I had no business having.</li> <li>My favorite evil privesc trick, revisited – queuing up a scheduled task that runs under an interactively logged-in DA's context without ever knowing their password. The MDR alerts that come out of this are equal parts hilarious and terrifying.</li> <li>A bonus thing to always look for – scheduled tasks running under saved DA creds that point at a script you can edit. Add one little line to fire an evil command of your choice, and you're in like a dirty shirt.</li> </ul> Check us out at <a href="https://7minsec.com/" target= "_blank" rel="noopener">7MinSec.com</a> for pentesting, training, controls assessments and security miscellany, <a href="https://7minsec.club/" target="_blank" rel="noopener">7MinSec.club</a> for our Substack and weekly TuesdayTOOLSday videos, and <a href="https://7minsec.wiki/" target="_blank" rel="noopener">7MinSec.wiki</a> for tips, cheat sheets and scripts (including pages on the scheduled task shenanigans above).

Hey friends! Today is a tale of pentest pwnage episode, and this one features a path to escalation I have never seen before – one I could only find few references on the entire Internet. It happened completely by accident, but during the report readout I'm absolutely going to say it was intentional and that I totally meant to do that. Here's what we cover: A client that's actually doing the things – year two or three of testing this environment, and they had buttoned up so much that I had to dig deep. Great for them, freaking frustrating for me. Why my Kerberoasting success rate has fallen off a cliff – Microsoft pushed an encryption change earlier this year, and cracking those hashes is a whole different ballgame now. Selective poisoning vs. poison-all-the-things – a nod to Pretender, which I covered in a TuesdayTOOLSday video over at 7MinSec.club. It doesn't get nearly enough love in blogs and videos. The relay that fired… and did something completely different than I expected – I saw the ntlmrelayx log scroll by, thought "yes, I've got DA," and then had a "wait, wait, whoa, what?" moment. I was honestly a little panicked. An ancient Exchange vulnerability comes back to bite – CVE-2021-34470 (vulnerable Exchange schema) turned out to be the fallback that got me a foothold I had no business having. My favorite evil privesc trick, revisited – queuing up a scheduled task that runs under an interactively logged-in DA's context without ever knowing their password. The MDR alerts that come out of this are equal parts hilarious and terrifying. A bonus thing to always look for – scheduled tasks running under saved DA creds that point at a script you can edit. Add one little line to fire an evil command of your choice, and you're in like a dirty shirt. Check us out at 7MinSec.com for pentesting, training, controls assessments and security miscellany, 7MinSec.club for our Substack and weekly TuesdayTOOLSday videos, and 7MinSec.wiki for tips, cheat sheets and scripts (including pages on the scheduled task shenanigans above).

Hey friends! Today is a tale of pentest pwnage episode, and this one features a path to escalation I have never seen before – one I could only find few references on the entire Internet. It happened completely by accident, but during the report readout I'm absolutely going to say it was intentional and that I totally meant to do that. Here's what we cover: <ul> <li>A client that's actually doing the things – year two or three of testing this environment, and they had buttoned up so much that I had to dig deep. Great for them, freaking frustrating for me.</li> <li>Why my Kerberoasting success rate has fallen off a cliff – Microsoft pushed an encryption change earlier this year, and cracking those hashes is a whole different ballgame now.</li> <li>Selective poisoning vs. poison-all-the-things – a nod to Pretender, which I covered in a TuesdayTOOLSday video over at 7MinSec.club. It doesn't get nearly enough love in blogs and videos.</li> <li>The relay that fired… and did something completely different than I expected – I saw the ntlmrelayx log scroll by, thought "yes, I've got DA," and then had a "wait, wait, whoa, what?" moment. I was honestly a little panicked.</li> <li>An ancient Exchange vulnerability comes back to bite – <a href="https://github.com/fortra/impacket/pull/1288" rel="noopener noreferrer">CVE-2021-34470 (vulnerable Exchange schema)</a> turned out to be the fallback that got me a foothold I had no business having.</li> <li>My favorite evil privesc trick, revisited – queuing up a scheduled task that runs under an interactively logged-in DA's context without ever knowing their password. The MDR alerts that come out of this are equal parts hilarious and terrifying.</li> <li>A bonus thing to always look for – scheduled tasks running under saved DA creds that point at a script you can edit. Add one little line to fire an evil command of your choice, and you're in like a dirty shirt.</li> </ul> Check us out at <a href="https://7minsec.com/" rel="noopener noreferrer">7MinSec.com</a> for pentesting, training, controls assessments and security miscellany, <a href="https://7minsec.club/" rel="noopener noreferrer">7MinSec.club</a> for our Substack and weekly TuesdayTOOLSday videos, and <a href="https://7minsec.wiki/" rel="noopener noreferrer">7MinSec.wiki</a> for tips, cheat sheets and scripts (including pages on the scheduled task shenanigans above).

7MS #739: Tales of Pentest Pwnage – Part 89

Show notes: <a href= "https://7ms.us/7ms-239-bye-bye-dream-job-part-1" rel= "nofollow noreferrer noopener" target= "_blank">https://7ms.us/7ms-239-bye-bye-dream-job-part-1</a>

Show notes: https://7ms.us/7ms-239-bye-bye-dream-job-part-1

Show notes: <a href="https://7ms.us/7ms-239-bye-bye-dream-job-part-1" rel="noopener noreferrer">https://7ms.us/7ms-239-bye-bye-dream-job-part-1</a>

7MS #239: Bye Bye Dream Job - Part 1

Show notes: <a href= "https://7ms.us/7ms-238-network-monitoring-101-part-2-nmap-papertrailapp-and-opencanary" rel="nofollow noreferrer noopener" target= "_blank">https://7ms.us/7ms-238-network-monitoring-101-part-2-nmap-papertrailapp-and-opencanary</a>

Show notes: https://7ms.us/7ms-238-network-monitoring-101-part-2-nmap-papertrailapp-and-opencanary

Show notes: <a href="https://7ms.us/7ms-238-network-monitoring-101-part-2-nmap-papertrailapp-and-opencanary" rel="noopener noreferrer">https://7ms.us/7ms-238-network-monitoring-101-part-2-nmap-papertrailapp-and-opencanary</a>

7MS #238: Network Monitoring 101 - Part 2: NMAP, Papertrailapp and OpenCanary

Show notes: <a href= "https://7ms.us/7ms-237-network-monitoring-101-part-1-nessus" rel= "nofollow noreferrer noopener" target= "_blank">https://7ms.us/7ms-237-network-monitoring-101-part-1-nessus</a>

Show notes: https://7ms.us/7ms-237-network-monitoring-101-part-1-nessus

Show notes: <a href="https://7ms.us/7ms-237-network-monitoring-101-part-1-nessus" rel="noopener noreferrer">https://7ms.us/7ms-237-network-monitoring-101-part-1-nessus</a>

7MS #237: Network Monitoring 101 - Part 1: Nessus

Show notes: <a href= "https://7ms.us/7ms-236-from-derp-to-domain-admin-with-moveit-central" rel="nofollow noreferrer noopener" target= "_blank">https://7ms.us/7ms-236-from-derp-to-domain-admin-with-moveit-central</a>

Show notes: https://7ms.us/7ms-236-from-derp-to-domain-admin-with-moveit-central

Show notes: <a href="https://7ms.us/7ms-236-from-derp-to-domain-admin-with-moveit-central" rel="noopener noreferrer">https://7ms.us/7ms-236-from-derp-to-domain-admin-with-moveit-central</a>

7MS #236: From "Derp!" to Domain Admin with MOVEit Central

Show notes: <a href= "7ms-235-pwning-billy-madison">https://7ms.us/7ms-235-pwning-billy-madison</a>

Show notes: https://7ms.us/7ms-235-pwning-billy-madison

Show notes: <a href="7ms-235-pwning-billy-madison" rel="noopener noreferrer">https://7ms.us/7ms-235-pwning-billy-madison</a>

7MS #235: Pwning Billy Madison

Show notes: <a href= "https://7ms.us/7ms-234-pentesting-owasp-juice-shop-part5" rel= "nofollow noreferrer noopener" target= "_blank">https://7ms.us/7ms-234-pentesting-owasp-juice-shop-part5</a>

Show notes: https://7ms.us/7ms-234-pentesting-owasp-juice-shop-part5

Show notes: <a href="https://7ms.us/7ms-234-pentesting-owasp-juice-shop-part5" rel="noopener noreferrer">https://7ms.us/7ms-234-pentesting-owasp-juice-shop-part5</a>

7MS #234: Pentesting OWASP Juice Shop - Part 5

Show notes: <a href= "https://7ms.us/7ms-233-pentesting-owasp-juice-shop-part-4/" rel= "nofollow noreferrer noopener" target= "_blank">https://7ms.us/7ms-233-pentesting-owasp-juice-shop-part-4/</a>

Show notes: https://7ms.us/7ms-233-pentesting-owasp-juice-shop-part-4/

Show notes: <a href="https://7ms.us/7ms-233-pentesting-owasp-juice-shop-part-4/" rel="noopener noreferrer">https://7ms.us/7ms-233-pentesting-owasp-juice-shop-part-4/</a>

7MS #233: Pentesting OWASP Juice Shop - Part 4

Show notes: <a href= "https://7ms.us/7ms-232-pentesting-owasp-juice-shop-part-3" rel= "nofollow noreferrer noopener" target= "_blank">https://7ms.us/7ms-232-pentesting-owasp-juice-shop-part-3</a>

Show notes: https://7ms.us/7ms-232-pentesting-owasp-juice-shop-part-3

Show notes: <a href="https://7ms.us/7ms-232-pentesting-owasp-juice-shop-part-3" rel="noopener noreferrer">https://7ms.us/7ms-232-pentesting-owasp-juice-shop-part-3</a>

7MS #232: Pentesting OWASP Juice Shop - Part 3

Show notes: <a href= "https://7ms.us/7ms-231-pentesting-owasp-juice-shop-part-2/" rel= "nofollow noreferrer noopener" target= "_blank">https://7ms.us/7ms-231-pentesting-owasp-juice-shop-part-2/</a>

Show notes: https://7ms.us/7ms-231-pentesting-owasp-juice-shop-part-2/

Show notes: <a href="https://7ms.us/7ms-231-pentesting-owasp-juice-shop-part-2/" rel="noopener noreferrer">https://7ms.us/7ms-231-pentesting-owasp-juice-shop-part-2/</a>

7MS #231: Pentesting OWASP Juice Shop - Part 2

Show notes: <a href= "https://7ms-230-pentesting-owasp-juice-shop-part-1" rel= "nofollow noreferrer noopener" target= "_blank">https://7ms-230-pentesting-owasp-juice-shop-part-1</a>

Show notes: https://7ms-230-pentesting-owasp-juice-shop-part-1

Show notes: <a href="https://7ms-230-pentesting-owasp-juice-shop-part-1" rel="noopener noreferrer">https://7ms-230-pentesting-owasp-juice-shop-part-1</a>

7MS #230: Pentesting OWASP Juice Shop - Part 1

7 Minute Security is a weekly information security podcast focusing on penetration testing, blue teaming and building a career in security.  The podcast also features in-depth interviews with industry leaders who share their insights, tools, tips and tricks for being a successful security engineer.

News

Technology

Tech News

7 Minute Security is a weekly information security podcast focusing on penetration testing, blue teaming and building a career in security. The podcast also features in-depth interviews with industry leaders who share their insights, tools, tips and tricks for being a successful security engineer.

Share 7 Minute Security

Sign up to save your podcasts

7 Minute Security

FAQs about 7 Minute Security:

How many episodes does 7 Minute Security have?

7 Minute Security episodes:

FAQs about 7 Minute Security:

How many episodes does 7 Minute Security have?

More shows like 7 Minute Security

Hacked

Security Now (Audio)

Defensive Security Podcast - Malware, Hacking, Cyber Security & Infosec

Risky Business

SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

CyberWire Daily

Smashing Security

Click Here

Darknet Diaries

Cybersecurity Today

Hacking Humans

CISO Series Podcast

Defense in Depth

Cybersecurity Headlines

Risky Bulletin