7MS #641: DIY Pentest Dropbox Tips – Part 10

09/13/24 • 27 min

Today we’re revisiting the fun world of automating pentest dropboxes using Proxmox, Ansible, Cursor and Level. Plus, a tease about how all this talk about automation is getting us excited for a long-term project: creating a free/community edition of Light Pentest LITE training!

Previous Episode

7MS #640: Tales of Pentest Pwnage – Part 63

This was my favorite pentest tale of pwnage to date! There’s a lot to cover in this episode so I’m going to try and bullet out the TLDR version here:

Sprinkled farmer files around the environment
Found high-priv boxes with WebClient enabled
Added “ghost” machine to the Active Directory (we’ll call it GHOSTY)
RBCD attack to be able to impersonate a domain admin using the CIFS/SMB service against the victim system where some higher-priv users were sitting
Use net.py to add myself to local admin on the victim host
Find a vulnerable service to hijack and have run an evil, TGT-gathering Rubeus.exe – found that Credential Guard was cramping my style!
Pulled the TGT from a host not protected with Credential Guard
Figured out the stolen user’s account has some “write” privileges to a domain controller
Use rbcd.py to delegate from GHOSTY and to the domain controller
Request a TGT for GHOSTY
Use getST.py to impersonate CIFS using a domain admin account on the domain controller (important thing here was to specify the DC by its FQDN, not just hostname)
Final move: use the domain admin ccache file to leverage net.py and add myself to the Active Directory Administrators group

Next Episode

7MS #642: Interview with Ron Cole of Immersive Labs

Ron Cole of Immersive Labs joins us to talk pentest war stories, essential skills he learned while serving on a SOC, and the various pentest training and range platforms you can use to sharpen your security skills! Here are the links Ron shared during our discussion: