by James Smith

Rapidly Creating Fake Users in your Lab AD using Youzer

Penetration Testing Lab Whether you have a fully virtual organisation consisting of several different machines or the odd virtualised box you’re using to explore or freshen up on certain skills. They’re great fun and an asset to any security tester. Having your own lab is a great way to perform […]

Efficient Time Based Blind SQL Injection using MySQL Bit Functions and Operators

I was performing some penetration tests in 2011 – 2012 against various PHP applications integrated with MySQL databases which were vulnerable to Time Based Blind SQL Injection.  Due to various constraints and limitations, exploitation was a little tricky and I was forced to investigate a method which allowed me to […]

Executing Metasploit & Empire Payloads from MS Office Document Properties (part 2 of 2)

Building on from my previous post, this will primarily focus on delivering an Empire payload via an embedded offensive PowerShell script stored within the ‘comments’ property of an MS Excel document. PowerShell Empire: Begin by creating an Empire listener, see Empire’s documentation on how to get started with this by […]

Executing Metasploit & Empire Payloads from MS Office Document Properties (part 1 of 2)

  As a penetration tester I’m always excited to see new and creative methods on creating weaponized MS Office documents.  This blog post builds on the following findings published by Black Hills InfoSec: There are numerous ways on how MS Office documents can be abused and weaponised to deliver […]

Quick Guide to Installing Bloodhound in Kali-Rolling

Intro I have had a few people over the last couple of months asking me how to get Bloodhound up and running after I had sung its praise since seeing the “Six Degrees to Domain Admin” video from BSIDES Las Vegas. If you still haven’t seen the video I am […]

Exploiting MS17-010 – Using EternalBlue and DoublePulsar to gain a remote Meterpreter shell

[su_heading align=”left”]This walk through assumes you know a thing or two and won’t go into major detail. After all it’s meant for fellow researchers and penetration testers.[/su_heading] Findings so far… Findings from using these tools are the following so far [su_note]The default process that Doublepulsar injects into is ‘lsass’ It […]

Exploiting the OpenNMS/Jenkins RMI Java Deserialization Vulnerability

Even though this vulnerability was detected back in 2015 I am only starting to notice it popping up on engagements more frequently. CVE-2015-8103 – Jenkins CLI – RMI Java Deserialization allows remote attackers to execute arbitrary code via a crafted serialized Java object. Apparently, according to Foxglove security Jenkins and […]