{"version":1,"type":"rich","provider_name":"Libsyn","provider_url":"https:\/\/www.libsyn.com","height":90,"width":600,"title":"7MS #741: Tales of Pentest Pwnage - Part 91","description":"Hey friends! Today\u2019s tale of pentest pwnage is brought to you by four hours of sleep, a large mint hot cocoa, and unhealthy levels of giggity. There\u2019s a very good reason for all three, but you\u2019ll have to hang out to the end of the episode to hear it. First, let\u2019s talk about an escalation path I\u2019ve never walked before: A really tight network is a beautiful and terrible thing \u2014 this client went from a C-minus-ish environment in past years to one where I could find basically nothing. No local admin creds laying around, no poisonable protocols, no juicy file shares. Straight into \u201cwell, try harder\u201d mode I went. Two new-to-me tools join the arsenal \u2014 one that gives you a second opinion on a big pile of pilfered files (Titus), and a one-shot PowerShell command (GPOZaurr) that hands you a report card for everything that\u2019s wrong with your GPOs (plus how to fix it). The finding I almost walked right past \u2014 an ADCS issue where only a tiny handful of objects could enroll. I said \u201call right, I\u2019ll move on.\u201d Then I came back to it, and saw I had missed the (kind of) obvious attack path. A certificate I couldn\u2019t authenticate with \u2014 and the 0xdf write-up that rescued me from my own gap in knowledge. Machine account quota was set to zero \u2014 so of course I tried to add a computer object anyway. Spoiler: it worked like a dirty shirt. The scheduled task trick rides again \u2014 my favorite \u201cthis is not going to get fixed\u201d Windows behavior. I had a client push back on this one hard: \u201cYou had to know the password of the DA you abused, right? You stole the TGT, right?\u201d Nope and nope. How to actually defend against all of this \u2014 some ADCS tightening, a checkbox on your high-privilege accounts that a lot of folks don\u2019t have ticked, and my new mantra: RDP with purpose. And then it\u2019s personal time \u2014 my oldest son Cam passed his national paramedic exam, and I am busting my buttons. Stick around for the whole story, including the 4 a.m. potty break that changed everything, the two health care professionals I\u2019d like to hand a party invitation to in person (and why my wife says \u201cI don\u2019t know about that, dude\u201d). ","author_name":"7 Minute Security","author_url":"https:\/\/7MinSec.com","html":"