7MS #352: Recap of Rad Red Team Training

I recently had the awesome opportunity to take the awesome Real World Red Team course put on by Peter Kim, author of The Hacker Playbook series.

TLDR and TLDL (too long don't listen): go take this training. Please. Now. The end. :-)

If you want to hear more, check out today's podcast episode where I talk about all the wonderful tidbits I learned from Peter during the training, including:

• Doppelganger attacks - does your target have a frequently used site like mail.company.com? Try buying up mailcompany.com with a copy of their email portal (using Social Engineer Toolkit), and the creds might come pouring in!

• Get potential usable creds from old breaches (Adobe, Ashley Madison, LinkedIn, Spotify)

• Password spraying is often really effective to get you your first set of creds - check out Spray or DomainPasswordSpray

• When creating phishing payloads, Veil will help you craft something to bypass AV

• When you're in a network and have grabbed your first set of creds, run BloodHound or SharpHound to map the Active Directory and find your high-value targets

• Check systems for MS17-010 for some potential easy wins

• Look for potential accounts that you can Kerberoast

• There may be opportunities to hide your payloads in code caves inside of applications that users run

• If you're popping shells, it's probably a good idea to script some of the actions so you can automate some recon and further exploitation

• In the Linux world, it's important to know some good privesc techniques

• It's also helpful to be able to use Tor and proxychains to evade detection

• Exfiltrate data using dnscat2. I've got a down n' dirty write up on its use here

I'm looking to setup an interview with Peter for a future episode of 7MS :-)