Hosting the CLR and executing .NET assemblies from Go
Write up of my journey figuring out how to host the CLR and execute .NET assemblies from memory in pure Go.
[Read More]
Docker for Pentesters
Docker has become such an integral part of my worfklow recently. These examples should demonstrate how Docker can help you be a more efficient pentester
[Read More]
Extracting SSH Private Keys From Windows 10 ssh-agent
The newest Windows 10 update includes OpenSSH utilities, including ssh-agent. Here's how to extract unencrypted saved private keys from the registry
[Read More]
Remotely Managing Hyper-V in a Workgroup Environment
After lots of mucking around, this is the bare minimum configuration I found to successfully connect to and mange Hyper-V in a non-domain network
[Read More]
Extracting Hashes and Domain Info From ntds.dit
If you end up with a copy of NTDS.dit and the SYSTEM registry hive, you can extract domain computer info offline and user NTLM hashes for cracking.
[Read More]
Transferring Files from Linux to Windows (post-exploitation)
I often need to copy a tool or a payload from my Kali linux attack box to a compromised Windows machine. These are some of my favorite techniques.
[Read More]
Practical Usage of NTLM Hashes
I've shown all the different ways to own a Windows environment when you have a password - but having a hash is just as good! Don't bother cracking - PTH!
[Read More]
Using Credentials to Own Windows Boxes - Part 3 (WMI and WinRM)
WMI and WinRM are two Windows administrative "features" that are ripe for abuse if you have credentials. In this post, I'll show how to (mis)use them...
[Read More]
Using Credentials to Own Windows Boxes - Part 2 (PSExec and Services)
Pentesters use PsExec style commands all the time, and in this post I'm going to explore and manually recreate the technique using native Windows tools.
[Read More]
Using Credentials to Own Windows Boxes - Part 1 (from Kali)
Du'h...if you have admin creds you can own a box. But how many different ways can you do it? Here's a blog-ified version of my notes and my favorite methods
[Read More]