Category Archives: Uncategorized

Top 5 ways to protect your Active Directory from Hackers

hacker

Here are five ways to protect Active Directory from hackers:

  1. Use strong and unique passwords: It is important to use strong, unique passwords for all accounts in Active Directory, including administrator accounts. You should also enable password complexity and password expiration policies to help ensure that strong passwords are being used.
  2. Enable two-factor authentication: Two-factor authentication (2FA) requires users to provide an additional form of authentication, such as a security token or one-time code, in addition to their password. This helps to protect against password-based attacks and can significantly increase the security of your Active Directory environment.
  3. Use Group Policy Objects (GPOs) to implement security policies: GPOs can be used to enforce security policies across your Active Directory environment, such as setting password complexity requirements, disabling insecure protocols, and restricting access to certain resources.
  4. Regularly update and patch your systems: It is important to keep all systems, including your Active Directory infrastructure, up to date with the latest patches and security updates. This helps to protect against known vulnerabilities that could be exploited by hackers.
  5. Monitor and audit your Active Directory environment: Regularly monitoring and auditing your Active Directory environment can help you identify potential security issues and take appropriate action to address them. You should also consider implementing a security incident and event management (SIEM) solution to help you monitor and analyze security events in real-time.

More CTF fun with Overpass 2 – Hacked

I did a new and interesing kind of room over at Tryhackme called Overpass 2. This is a remake of an original Overpass room. Lots More CTF fun with Overpass 2 – Hacked!

Quick Review

This room involed being on a Blue team, and working from a Packet Capture to figure out what clues might have been left as to why/who/what/where this may have happened. Then you are to take that information, and use it to break back into the system and take back control of your long lost (and very sad) flags. 😉

I use Wireshark a lot at work, being in networking. I haven’t seen such blatently left breadcrumbs in all my years but it was a lot of fun doing this room.

It didn’t take long to gather all of the intial answers for the first few Tasks in this room.

I found it interesting to download the backdoor that they used, and analyse it to figure out how it worked. The backdoor was used to maintain persistence by setting up another ssh server on a separate port.

Where I did have some trouble was with technical issues with hashcat. It kept refusing to run on my vm due to how I am setup with no PCI passthrough for my graphics card. It seems like it wants to only use GPU, even though there are flags there for using CPU.

At any rate, I found a work around and was able to start the crack. I had forgotten that it was salted however, and had to do it again after figuring out the correct syntax.

The last Task of getting back in was quite easy. I just SSH’d back into the attackers’ backdoor using the their own credentials I had cracked, then I immediately found a SUID copy of bash sitting (.hidden) in their home as .suid_bash.

I just ran ./.suid_bash -p to get root and the last flag.

james@overpass-production:/home/james$ ./.suid_bash -p
.suid_bash-4.4# whoami
root

Spoilers/Walkthrough

If you want the spoilers and need help with the room you can read my complete walkthrough here: https://github.com/c0ri/PentestingDocs/blob/main/CTFs/THM/Overpass%202%20-%20Hacked.md

Like what I do? https://www.buymeacoffee.com/c0ri

Capture The Flag – Daily Bugle

capture the flag - daily bugle

Pretty tough room today playing Capture the Flag – Daily Bugle over on Tryhackme. The room had a fun Spiderman Theme.

This room was rated HARD, but TBH I didn’t think it was that bad. I would consider it an Intermediate room. There were a few things that made it harder than usual however, so I’ll try to go over that a bit.

There were almost no notes to work from, it was more or less ‘Here is the server, hack it’. This made it quite a bit more challenging.

Another issue was scanning with SQLMap didn’t reveal anything with a normal scan, but there was a cryptic note about SQLi vulnerabilities so what else can you do but press on.

Finding the version of Joomla, the sites’ CMS, was extremely helpful because we could find a great Python scripted exploit to get in.

The rest was pretty much downhill until the very end. The exploit for yum required an RPM, but there’s no fpm for Kali.. that’s more for Redhat RPMs. But, I did find a way to do it using a ruby gem called fpm.

Bookmark this and install it, because you will need it one day I promise: https://fpm.readthedocs.io/en/v1.10.2/source/gem.html

For that matter, I suggest you install Golang, and Ruby if you haven’t already. Those are both extremely good and useful languages. If Ghandi was a programming language he would have been Ruby 😛

Anyway that was a little caveat that I’m sure has caught a few people out. You can check out my full notes for this room over on my github here:

https://github.com/c0ri/PentestingDocs/blob/main/CTFs/THM/Daily%20Bugle.md

Have some thoughts on this room? I’d love to hear your story!

Like what I do? https://www.buymeacoffee.com/c0ri

Capture the Flag – Skynet

skynet

A little more #CTF fun today on #Tryhackme as Capture the Flag – Skynet revealed some surprise.

I spent a little time today with a CTF on Tryhackme. Today’s room was titled “Skynet”. I kinda like the way the title and story these rooms. Hackers are so creative 😉

I think this room was pretty easy, but I did see some interesting development near the end where I found what appeared to be remnants of other people’s code runs trying to get root using the same technique for ‘tar’ that I was using. I wonder if anyone else has seen this or was this just extra trouble thrown in to see how we cope. I think if I had little or no experience with Linux it would have prooved a very difficult challenge.

Anyway I try to include my thought process in the notes so you can see how I try to work around caveats.

Feel free to check out my walkthrough and let me know your experience with it.

https://github.com/c0ri/PentestingDocs/blob/main/CTFs/THM/Skynet.md

While you are at it, check out my latest project for Isis. An AI powered Hacking helper.

Isis – AI chatbot to help you with Penetration Testing

I have been super busy lately. Doing graduate studies, and also working hard every day training for my OSCP exam. I have been very productive tho!

I made some new code for penetration testers that will help be a helper to find code inserts, shells, SQL injection and the like for you. AFAIK it’s the first of it’s kind and it uses some pretty decent AI from openAI.

I like to think of ‘her’ as an angel on my shoulder. Imagine you are under a tight deadline. A company gave you only 5 days to test their websites and report your findings. Then imagine talking to Isis while you work and having her pop up suggestions for reverse-shell code, SQL injection etc. WOOOOOoo!

My Initial work is promising, but stlll some kinks to work out. If you wanna contribute to the code that’d be cool too.

If you are interested in the code you can check it out here: https://github.com/c0ri/isis

Love what I do? https://www.buymeacoffee.com/c0ri

Haniwa Shutdown

After successfully setting up my new idea, Haniwa, and testing it for 6 months, I’ve decided to shut the project down. I got only minor interest in the concept, and the server costs were eating me alive while I was looking for investors.

I may bring it back in some simpler form in the future and make it free by generating ad’s on the site for it, but for now I’m on to bigger and better things.

Haniwa

I have been very busy lately working on a new project called Haniwa. The idea is to have a bot which will act as a servant for us after we are dead and gone. Something to carry out our last wishes. It could be like an executor of a will, but with an Artificial Intelligence about it.

Haniwa’s primary function is to let loved ones and friends know that you have passed on, but it also includes the ability to send bank accounts, secret messages, crypto account logins and more. Things you might not be ready to share now, but you surely want someone to have after you are gone. The use cases are as endless as the ideas we have for future releases!

The name Haniwa is actually a Japanese term coined from using figures to place as caretakers for Emperors after they died. Previous to that when an Emperor died, it was commanded that all his servants and family be put to death and sent with him to the afterlife. Many people decided this was barbaric, and came up with the idea to use Haniwa instead. Now I will borrow this term and give it a new meaning, a sort of Flower Robot to tend our Grave after we are dead and gone.

I’ve chosen to run this one on a platform called Bubble.is or Bubble.io now. It is a fantastic no-code application, and I am finding all kinds of niche use cases for it after using it. The best part is it allows me to quickly setup an app and prove it out and get it to a state where it can be tested quickly and as a PoC for Venture Capitalists to jump aboard without wasting too much time coding a site from the ground up.

The first revision on Haniwa is nearly complete with all of the basic features ready such as scheduling mail and secured messages using AES-256 encryption. It is also responsive in that it handles PC, Tablet and Mobile well.

My main goal now is to get it functional and bring it to market. You know the old saying “If you aren’t embarrassed of your first release, you released too late!” I know there is a lot of work to do, and features I really want to add, but it’s important to get it out there.

For me this is something new. As far as I know, there is nothing like this. The idea for it came to me in a dream. I think for myself I am excited to use it.

Does this sound like an interesting idea? Drop me a line and share your stories or suggestions for it!

Hyper Convergence – A new Era for Infrastructure

I’ve been working recently with Cisco’s HyperFlex System. If I could boil it all down to 1 word; AMAZING.

Why do I need HyperFlex you ask?

Key Benefits to HyperFlex

  • Ease of Setup – Cisco UCS is in my humble opinion one of the best Blade Servers ever made. It’s so easy to setup and use, but it is time consuming to configure. HyperFlex eliminates all this extra work by allowing you to Script the whole setup in just a few minutes. It’s truly unbelievable, and I was awestruck the 1st time I saw it run.
  • Complete Hyperconvergance – Fabric Network and Compute are unified in a Next Gen Platform. Spin ALL of that up in MINUTES!
  • Flash Optimized System – Flash Storage Built into each device. No need for External Storage unless you just wanna. The built in storage is designed for Hyperconvergance from the ground up!
  • Scaling – With HyperFlex you can simply plug in additional devices to scale the system.
  • Continuous Data Optimization – Data is continually optimized, de-duplicated and Compressed on the fly.

That’s why!

Setup Experience

The setup is so simple, although we had some initial confusion out of the gates on how the communications would be routed through ACI, That’s Cisco’s Application Centric Infrastructure. This is because HyperFlex uses scripts to configure everything for you. Management, vMotion, Storage VLANs, etc. It also spins up it’s own Virtual Distributed Switch and places it on a vCenter of your choice. Pretty cool.

In traditional networking you would need to uplink the HyperFlex to a couple of Nexus 7000’s and setup VLANs, then take those VLANs and Subnet settings and plug them into HyperFlex’s script. You can drag/drop that script into the UCS Manager and it will then populate all the required fields and then you can start the script running.

In ACI it’s a bit similar, however since ACI doesn’t so much care about VLANs, but rather End Point Groups (EPGs) you can pre-determine the VLAN names, and then feed it the appropriate Subnets. Just make sure those Subnets are attached to your EPG Bridge Domains and you are good to go! We also uplinked the HyperFlex into the ACI Leaf nodes in a Virtual Port Channel (vPC) configuration. So before we uploaded our script to the UCS Manager, we simply logged into the Fabric Interconnects and turned on vPC and Trunking, and then ensured all the VLANs were allowed on those interfaces and away we went. The script is good and makes everything soooo FAST and simple but there is a little prep work to do if you choose the vPC route.

Once the HyperFlex is up, you can go into vCenter and create your Storage, and link the vmknics to the proper EPGs in the case of ACI. As a note, ACI has several choices for a Virtual Distributed Switch that you can use. I typically go with the Application Virtual Switch (AVS) because it’s a VMWare product and we are using vSphere here. Recently however, VMWare announced that they won’t be supporting Cisco Products as before, so we might be using the Cisco vDS in the near future. Especially if we want to start using versions of VMWare greater than 6.2. That’s really ok though because now the vDS supports everything the AVS does, and actually for the Cisco Side it’s better.

As an aside I sometimes hear people talking about getting a 169.xx address on the OpFlex side for the VTEP. If this happens to use, be sure you:

  • Enabled Trunking on all FI’s
  • Enable CDP and disable LLDP throughout the Fabric. I mean EVERYWHERE, VMWare, UCS HFX, ACI or whatever you use.
  • Enable all VLANs required, especially your Infra VLAN for the Nics.
  • Ensure your Infra VLAN is setup in UCS/HFX as well.
  • For ACI Infra VLAN is automatically configured if using Routed Interfaces for BGP, otherwise, if you used say SVI interfaces, you will need to specifically allow that VLAN in your common VRF and allow THAT VLAN on UCS as well.

I don’t want to cover too much about the setup in this article, but rather convey my experience and hope that it may excite you to want to give it a shot. I can tell you that once I’ve used ACI and HyperFlex I never want to go back. I’ll cover ACI in another Article, but the benefits there are also amazing and with today’s Security Issues it is an absolute requirement if you want to quickly resolve patching hundreds or thousands of machines.

So you are probably wondering, what you need to get to use HyperFlex at this point.

Platform

This is the following hardware used in our setup. ACI is using a minimal configuration, and you can uplink to any other device as a simple access port upink providing it supports BPG, OSPF or some other typical protocol. ACI supports most of them so we used BPG as routed interfaces for the setup. For the HyperFlex we chose a minimum of 4. I want to be clear that you don’t need ACI to make this work. You can use your current network infra just fine.

  • 4 x Cisco UCS HX240c-M4SX (HyperFlex Requirement)
  • 2 x Cisco 6248UP 48p Fabric Interconnects (HyperFlex and/or UCS Requirement)
  • 3 x Cisco APIC M2’s (ACI)
  • 2 x Cisco 93180YC-EX Series Leaf Nodes (Tetration Supported) (ACI)
  • 2 x Cisco 9336PQ Spine Nodes (ACI)
  • 2 x Cisco Nexus 7000 (Uplink for BPG peering) (ACI)

Like I said, if you don’t have ACI yet, that’s ok. Just get the HyperFlex nodes and the FI’s if you don’t have them, then setup your network accordingly.

If this sounds interesting, drop me a line and I’ll point you in the right direction to get started!

Migrating WordPress

Spent the better part of the weekend migrating WordPress sites by hand from Godaddy.

I’m not happy about the way things are going there recently. The whole experience has been pretty aweful.

To complicate matters the website kept crashing on Firefox. I had a better experience with Chrome but still, with a major browser it should have worked. Also simple backend things like LOGGING wasn’t working. Worst was their phpmyadmin couldn’t export my DB, and trying to do a mysqldump from CLI wasn’t even working 🙁 I finally had to make a PHP script to grab the Database.

I can’t imagine what other customers who have no technical skills are going through right now with them.

I was amazed when the engineer told me he had been at Go Daddy for 15 years and never heard the term “Traceroute”. Oh brother.

I had to get a new host when they flat refused to escalate my case even tho all of Japan couldn’t access Go Daddy’s WordPress Sites and a few other sections of their site. The main site seemed to be ok though.

I was going to leave them a long review but after spending 30 mins making it, and hitting submit, the thing crashed. I guess that’s par for their course. 🙁

Oh well, back to work…

Server

Been real busy at work lately so not much chance to update on Disa.

[blogcard url=”http://skyblue-soft.com/disa” title=”disa” content=”Updates on Project Disa”]

I’ve gotten another server up now and will work next on the MongoDB for the backend support. Once that’s online, I will transfer my working code over to my container and test to make sure it’s all working. Then we can do some beta testing.

Thanks!