Web, Active Directory and Maldev stuff
In a recent engagement my teammates and I compromised a Windows server where some high privileged users were connected. We did not want to risk to extract credentials from lsass.exe as the EDR would have detected us so we decided to abuse Windows tokens to move laterally in the network. We quickly identified a Windows token of an interesting user, however the token was not usable. The next day...
Note: This blog post is the second one of the series Increase your stealth capabilities, make sure to have read the first part. Recap During an engagement my teammates and I compromised a Windows server by uploading a webshell then elevated our privilege to SYSTEM and extracted credentials stored in LSASS. In Part 1, I replayed the scenario in a lab where an Elastic EDR agent is running and w...
In a recent assessment, my teammates and I were tasked to perform a web security review of several applications with the possibility to perform internal pentest if the opportunity came up. On one of the application, we successfully uploaded a aspx webshell which executes Windows cmd. The engagement didn’t require us to be stealthy and the goal of this blog post is to reproduce our what we did ...
Context This blog post aims to solve a problem I faced when using open source tooling with Cobalt Strike. During my security assessments I often rely on tooling developped in Python, C#, Go or C/C++. Opensource tools are very often built to produce a PE file that doesn’t fit well on red team engagement as we prefer to avoid uploading and executing file on disk. For Python tools, we need a SOC...
Context Back to 2019, my first HackTheBox box Intense was released with several steps involved: exploit a SQL injection for SQLite DBMS on the web application use a hash length extension attack to login as admin on the web application leak the SNMP config through a file disclure to get a shell on the underlying server exploit an ELF binary to gain root access to the box The goal of...