Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Andere mochten auch
Andere mochten auch (20)
Ähnlich wie Offensive Security with Metasploit
Ähnlich wie Offensive Security with Metasploit (20)
Mehr von egypt
Mehr von egypt (10)
Offensive Security with Metasploit
- 1. Offensive Security with Metasploit 15 October 2015 TX DIR Telecommunications Forum 1
- 2. James Lee @egyp7 Metasploit Developer Community Manager # whoami 2
- 3. I Think Like an Attacker
- 4. What is Metasploit? A tool for ● Reconnaissance ● Exploitation ● Post-exploitation A Data Clearinghouse A framework for improving and automating all of the above
- 5. A Brief History of Exploitation
- 6. Golden Era (up to mid-late 1990s) Silver Era (mid-late 1990s to mid 2000s) Modern Era (late 2000s to now)
- 7. Golden Era Centralized Computing Universities, Research Orgs
- 10. Silver Era (mid 1990s) Practical portable systems Rise of WiFi Much greater use of technical mitigation
- 11. Silver Era Exploitation Credentials The rise of client-sides The rise of web exploitation
- 12. The Age of Worms
- 14. Server-side Worms ms00-078 IIS, solaris sadmin ms01-033 IIS (big list of vectors) ms02-039 SQLServer ms03-026 dcom ms04-011 lsass ms05-039 ms08-067 Sadmind Code Red Nimda Slammer Blaster Sasser Zotob Conficker
- 15. The web is the Internet Ubiquitous mobile computing Secure Development Lifecycle (SDLC) Modern Era
- 16. An exploit converts illegitimate access into legitimate access
- 17. If exploits are getting harder, where do we go?
- 21. What do they all have in common?
- 22. Hint:
- 23. Authenticated Code Execution by Design
- 24. Back to Golden Era Exploitation Credentials Configuration errors
- 26. Credentials
- 27. Windows authentication NTLM hashes stored in SAM Logons handled by LSASS.exe ● Cached for Single Sign On
- 28. Mimikatz In-memory Windows password stealer ● Plaintext password extraction ● Meterpreter extension
- 30. Core Private Public Realm Blank Username SNMP Community NTLM Hash SMB Domain Postgres DB Username Password SSH Key Non-replayable Hash Oracle SID
- 34. SMB Authentication Auth request; host:BOB
- 35. SMB Authentication Auth request; host:BOB Challenge
- 36. user:bob, bob’s hash encrypted with Challenge SMB Authentication Auth request; host:BOB Challenge
- 37. SMB Authentication Auth request; host:BOB Challenge Login successful user:bob, bob’s hash encrypted with Challenge
- 39. SMB Relay Auth request; host:BOB
- 40. SMB Relay Auth request; host:BO B Auth request; host:BOB
- 41. SMB Relay Auth request; host:BOB Challenge Auth request; host:BO B
- 42. SMB Relay Auth request; host:BOB Challenge Auth request; host:BO B Challenge
- 43. SMB Relay Auth request; host:BOB Challenge user:bob, bob’s hash encrypted with Challenge Auth request; host:BO B Challenge
- 44. SMB Relay Auth request; host:BOB Challenge user:bob, bob’s hash encrypted with Challenge Auth request; host:BO B Challenge user:bob, bob’s hash encrypted with Challenge
- 45. SMB Relay Auth request; host:BOB Challenge user:bob, bob’s hash encrypted with Challenge Login successful Auth request; host:BO B Challenge user:bob, bob’s hash encrypted with Challenge
- 46. SMB Relay Auth request; host:BOB Challenge user:bob, bob’s hash encrypted with Challenge Login successful Auth request; host:BO B Challenge user:bob, bob’s hash encrypted with Challenge Login Failed go away
- 48. An exploit converts illegitimate access into legitimate access
- 51. Presence
- 53. Persistence
- 54. Pivoting
- 55. Pivoting Two* methods in Metasploit ● Route ● Portfwd * Mostly
- 57. Exploit
- 60. Exploit
- 63. Exploit
- 64. Payload
- 65. How do I deal with this?
- 66. SMB Relay Disable WPAD Block outbound SMB Enforce SMB 2.x only Require signing
- 67. Windows Authentication Don’t give users Local Admin LAPS - Local Administrator Password Solution
- 68. Password Theft KB2871997 ● Disables digest auth ● LSASS still has NTLM hashes Don’t log into everything as DA