ropnop blog

How to Store Session Tokens in a Browser (and the impacts of each)

A common question when building a SPA is: where do I store my session tokens? I’ll talk through the main options and the pros/cons of each

Learning Go Concurrency From Factorio

Go’s concurrency model confused me at first, but it finally clicked when I thought of it like building an assembly line in Factorio

Hosting the CLR and executing .NET assemblies from Go

Write up of my journey figuring out how to host the CLR and execute .NET assemblies from memory in pure Go.

Proxying and Intercepting CLI Tools

Sometimes you need to intercept traffic from CLI tools. In this post I cover using Burp to intercept traffic from Java, Python, Node and Go CLIs

ChiBrrCon 2020: Don't Cross Me! Same Origin Policy and all the "cross" vulns

Docker for Pentesters

Docker has become such an integral part of my worfklow recently. These examples should demonstrate how Docker can help you be a more efficient pentester

Troopers 2019: Fun With LDAP and Kerberos

Recording Slides

Attacking Default Installs of Helm on Kubernetes

Default installations of Helm on Kubernetes can make it trivial for attackers to escalate to cluster admin. In this post I’ll demonstrate how.

OWASP Chicago 2018 - Pentesting with Serverless Infrastructure

Slides Supplemental Serverless Toolkit available here: https://github.com/ropnop/serverless_toolkit

Serverless Toolkit for Pentesters

Serverless functions have so much potential - here’s a few useful examples I use when pentesting or doing bug bounties. Who needs testing infrastructure?

Extracting SSH Private Keys From Windows 10 ssh-agent

The newest Windows 10 update includes OpenSSH utilities, including ssh-agent. Here’s how to extract unencrypted saved private keys from the registry

Thotcon 2018 - Fun With LDAP, Kerberos (and MSRPC) in AD Environments

Slides Supplemental The original (large) PowerPoint wih all embedded GIFs/Videos: https://1drv.ms/p/s!Aq5mEA03Lijrg9h-hsezBkUC5qwXag

Configuring Burp Suite With Android Nougat

Android Nougat changed the default behavior for apps, so installing the Burp CA to user certs no longer works. Here’s two ways to bypass it

SANS Holiday Hack 2017 Writeup

The SANS team hit another homerun with the HHC including awesome challenges that mimicked real-world pentest activities. Here’s my solutions!

Configuring a Pretty and Usable Terminal Emulator for WSL

I’m a big fan of Bash on Windows (WSL), but was unable to find a good terminal emulator to use. In this post I talk about configuring Terminator for WSL

Remotely Managing Hyper-V in a Workgroup Environment

After lots of mucking around, this is the bare minimum configuration I found to successfully connect to and mange Hyper-V in a non-domain network

Upgrading Simple Shells to Fully Interactive TTYs

Catching a reverse shell over netcat is great…until you accidentally Ctrl-C and lose it. These techniques let you upgrade your shell to a proper TTY

Extracting Hashes and Domain Info From ntds.dit

If you end up with a copy of NTDS.dit and the SYSTEM registry hive, you can extract domain computer info offline and user NTLM hashes for cracking.

Cracking OpenNMS Password Hashes

After compromising an OpenNMS server, I recovered salted password hashes. I couldn’t find any info online, so I reversed them and wrote a tool to crack them

Sans Holiday Hack 2016 - Writeup

After my last report for work went out the door and my company entered its end-of-year shutdown period, I found myself at my parents house for several days for the holidays, relaxed and with nothing to do. I saw some people on Twitter talking about the SANS Holiday Hack Challenge, and decided I would finally give it a try. I started on Christmas Eve and after several days of borderline dangerous…

DerbyCon 2016 - Abusing Linux Trust Relationships

Recording Slides Supplemental Demo Video:

Transferring Files from Linux to Windows (post-exploitation)

I often need to copy a tool or a payload from my Kali linux attack box to a compromised Windows machine. These are some of my favorite techniques.

Practical Usage of NTLM Hashes

I’ve shown all the different ways to own a Windows environment when you have a password - but having a hash is just as good! Don’t bother cracking - PTH!

Abusing Linux Trust Relationships - Thotcon Talk

Had an awesome time presenting at Thotcon this year. I plan to expand on this topic quite a bit and eventually turn it into a blog posts/series, but in the meantime, here’s the slides and the demo video

Thotcon 2016 - Abusing Linux Trust Relationships

Slides Supplemental Demo Video:

Using Credentials to Own Windows Boxes - Part 3 (WMI and WinRM)

WMI and WinRM are two Windows administrative “features” that are ripe for abuse if you have credentials. In this post, I’ll show how to (mis)use them…

Using Credentials to Own Windows Boxes - Part 2 (PSExec and Services)

Pentesters use PsExec style commands all the time, and in this post I’m going to explore and manually recreate the technique using native Windows tools.

Using Credentials to Own Windows Boxes - Part 1 (from Kali)

Du’h…if you have admin creds you can own a box. But how many different ways can you do it? Here’s a blog-ified version of my notes and my favorite methods

Plundering Docker Images

On a recent pentest, we recovered credentials to a private Docker registry. Looting the contained images yielded us source code and admin ssh keys.

Installing Drozer on OS X El Capitan

Turns out installing Drozer on OS X is a pain. The latest versions of OS X doesn’t include OpenSSL headers, which breaks dependencies. Here’s my workaround.