https://blog.ropnop.com/ Recent content on ropnop blog Hugo -- gohugo.io rflathers@gmail.com (ropnop) rflathers@gmail.com (ropnop) Sat, 03 Oct 2020 00:00:00 +0000 https://blog.ropnop.com/storing-tokens-in-browser/ Sat, 03 Oct 2020 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/storing-tokens-in-browser/ A common question when building a SPA is: where do I store my session tokens? I’ll talk through the main options and the pros/cons of each https://blog.ropnop.com/learning-go-concurrency-from-factorio/ Sun, 28 Jun 2020 10:36:39 -0500 rflathers@gmail.com (ropnop) https://blog.ropnop.com/learning-go-concurrency-from-factorio/ Go’s concurrency model confused me at first, but it finally clicked when I thought of it like building an assembly line in Factorio https://blog.ropnop.com/hosting-clr-in-golang/ Sun, 15 Mar 2020 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/hosting-clr-in-golang/ Write up of my journey figuring out how to host the CLR and execute .NET assemblies from memory in pure Go. https://blog.ropnop.com/proxying-cli-tools/ Sun, 09 Feb 2020 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/proxying-cli-tools/ Sometimes you need to intercept traffic from CLI tools. In this post I cover using Burp to intercept traffic from Java, Python, Node and Go CLIs https://blog.ropnop.com/talk/2020/dontcrossme-chibrrcon2020/ Tue, 04 Feb 2020 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/talk/2020/dontcrossme-chibrrcon2020/ https://blog.ropnop.com/docker-for-pentesters/ Thu, 18 Jul 2019 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/docker-for-pentesters/ Docker has become such an integral part of my worfklow recently. These examples should demonstrate how Docker can help you be a more efficient pentester https://blog.ropnop.com/talk/2019/funwithldapkerb/ Thu, 21 Mar 2019 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/talk/2019/funwithldapkerb/ Recording Slides https://blog.ropnop.com/attacking-default-installs-of-helm-on-kubernetes/ Mon, 28 Jan 2019 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/attacking-default-installs-of-helm-on-kubernetes/ Default installations of Helm on Kubernetes can make it trivial for attackers to escalate to cluster admin. In this post I’ll demonstrate how. https://blog.ropnop.com/talk/2018/pentestingwithserverless/ Wed, 12 Dec 2018 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/talk/2018/pentestingwithserverless/ Slides Supplemental Serverless Toolkit available here: https://github.com/ropnop/serverless_toolkit https://blog.ropnop.com/serverless-toolkit-for-pentesters/ Sun, 11 Nov 2018 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/serverless-toolkit-for-pentesters/ Serverless functions have so much potential - here’s a few useful examples I use when pentesting or doing bug bounties. Who needs testing infrastructure? https://blog.ropnop.com/extracting-ssh-private-keys-from-windows-10-ssh-agent/ Sun, 20 May 2018 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/extracting-ssh-private-keys-from-windows-10-ssh-agent/ The newest Windows 10 update includes OpenSSH utilities, including ssh-agent. Here’s how to extract unencrypted saved private keys from the registry https://blog.ropnop.com/talk/2018/funwithldapkerb/ Sat, 05 May 2018 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/talk/2018/funwithldapkerb/ Slides Supplemental The original (large) PowerPoint wih all embedded GIFs/Videos: https://1drv.ms/p/s!Aq5mEA03Lijrg9h-hsezBkUC5qwXag https://blog.ropnop.com/configuring-burp-suite-with-android-nougat/ Thu, 18 Jan 2018 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/configuring-burp-suite-with-android-nougat/ Android Nougat changed the default behavior for apps, so installing the Burp CA to user certs no longer works. Here’s two ways to bypass it https://blog.ropnop.com/sans-holiday-hack-2017-writeup/ Thu, 18 Jan 2018 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/sans-holiday-hack-2017-writeup/ The SANS team hit another homerun with the HHC including awesome challenges that mimicked real-world pentest activities. Here’s my solutions! https://blog.ropnop.com/configuring-a-pretty-and-usable-terminal-emulator-for-wsl/ Fri, 29 Sep 2017 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/configuring-a-pretty-and-usable-terminal-emulator-for-wsl/ I’m a big fan of Bash on Windows (WSL), but was unable to find a good terminal emulator to use. In this post I talk about configuring Terminator for WSL https://blog.ropnop.com/remotely-managing-hyper-v-in-a-workgroup-environment/ Tue, 01 Aug 2017 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/remotely-managing-hyper-v-in-a-workgroup-environment/ After lots of mucking around, this is the bare minimum configuration I found to successfully connect to and mange Hyper-V in a non-domain network https://blog.ropnop.com/upgrading-simple-shells-to-fully-interactive-ttys/ Mon, 10 Jul 2017 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/upgrading-simple-shells-to-fully-interactive-ttys/ Catching a reverse shell over netcat is great…until you accidentally Ctrl-C and lose it. These techniques let you upgrade your shell to a proper TTY https://blog.ropnop.com/extracting-hashes-and-domain-info-from-ntds-dit/ Thu, 06 Jul 2017 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/extracting-hashes-and-domain-info-from-ntds-dit/ If you end up with a copy of NTDS.dit and the SYSTEM registry hive, you can extract domain computer info offline and user NTLM hashes for cracking. https://blog.ropnop.com/cracking-opennms-password-hashes/ Wed, 21 Jun 2017 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/cracking-opennms-password-hashes/ After compromising an OpenNMS server, I recovered salted password hashes. I couldn’t find any info online, so I reversed them and wrote a tool to crack them https://blog.ropnop.com/sans-holiday-hack-2016-writeup/ Thu, 05 Jan 2017 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/sans-holiday-hack-2016-writeup/ After my last report for work went out the door and my company entered its end-of-year shutdown period, I found myself at my parents house for several days for the holidays, relaxed and with nothing to do. I saw some people on Twitter talking about the SANS Holiday Hack Challenge, and decided I would finally give it a try. I started on Christmas Eve and after several days of borderline dangerous obsessive completion-compulsion, I had solved all the challenges. https://blog.ropnop.com/talk/2016/abusinglinuxtrustderby/ Sun, 25 Sep 2016 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/talk/2016/abusinglinuxtrustderby/ Recording Slides Supplemental Demo Video: https://blog.ropnop.com/transferring-files-from-kali-to-windows/ Fri, 01 Jul 2016 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/transferring-files-from-kali-to-windows/ I often need to copy a tool or a payload from my Kali linux attack box to a compromised Windows machine. These are some of my favorite techniques. https://blog.ropnop.com/practical-usage-of-ntlm-hashes/ Sun, 05 Jun 2016 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/practical-usage-of-ntlm-hashes/ I’ve shown all the different ways to own a Windows environment when you have a password - but having a hash is just as good! Don’t bother cracking - PTH! https://blog.ropnop.com/abusing-linux-trust-relationships-thotcon-slides/ Sat, 07 May 2016 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/abusing-linux-trust-relationships-thotcon-slides/ Had an awesome time presenting at Thotcon this year. I plan to expand on this topic quite a bit and eventually turn it into a blog posts/series, but in the meantime, here’s the slides and the demo video https://blog.ropnop.com/talk/2016/abusinglinuxtrust/ Fri, 06 May 2016 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/talk/2016/abusinglinuxtrust/ Slides Supplemental Demo Video: https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-3-wmi-and-winrm/ Wed, 27 Apr 2016 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-3-wmi-and-winrm/ WMI and WinRM are two Windows administrative “features” that are ripe for abuse if you have credentials. In this post, I’ll show how to (mis)use them… https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-2-psexec-and-services/ Wed, 20 Apr 2016 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-2-psexec-and-services/ Pentesters use PsExec style commands all the time, and in this post I’m going to explore and manually recreate the technique using native Windows tools. https://blog.ropnop.com/using-credentials-to-own-windows-boxes/ Sat, 16 Apr 2016 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/using-credentials-to-own-windows-boxes/ Du’h…if you have admin creds you can own a box. But how many different ways can you do it? Here’s a blog-ified version of my notes and my favorite methods https://blog.ropnop.com/plundering-docker-images/ Fri, 15 Apr 2016 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/plundering-docker-images/ On a recent pentest, we recovered credentials to a private Docker registry. Looting the contained images yielded us source code and admin ssh keys. https://blog.ropnop.com/installing-drozer-on-os-x-el-capitan/ Thu, 14 Apr 2016 00:00:00 +0000 rflathers@gmail.com (ropnop) https://blog.ropnop.com/installing-drozer-on-os-x-el-capitan/ Turns out installing Drozer on OS X is a pain. The latest versions of OS X doesn’t include OpenSSL headers, which breaks dependencies. Here’s my workaround.