SMB Relay with Snarf

Making the Most of Your MitM

SMB Relay is a well-known attack that involves intercepting SMB traffic and relaying the NTLM authentication handshakes to a target host. This post assumes you already understand the basics of SMB Relay (if not I highly suggest you check out Mark Baggett’s SANS post SMB Relay Demystified and NTLMv2 Pwnage with Python). SMB Relay has hands down been the most frequent foothold I’ve found on internal network pentests; however, sometimes the users in my broadcast domain don’t seem to have Local Administrator rights on any of the targeted hosts or AV is making the process take a lot longer. This is where Snarf comes to the rescue. I was on a network once where NBNS/LLMNR traffic was infrequent and administrator rights were limited.... [Read More]

Making a Powershell EXE Payload

I’ve been using TrustedSec’s Unicorn a LOT over the past few months. In fact, it’s become my go-to payload to pop a box. While it’s awesome to be able to paste a command and get a shell, sometimes an EXE is required. For those cases, I’ve made a script to make the whole process automated: tl;dr uses winrar’s commandline options under wine to make a self-extracting archive. Source Setup instructions cd /opt git clone cd ~/Desktop wget wine wrar511.exe Now just go through the default options of winrar to finish the install. Usage: python <payload> <ip... [Read More]

How I Prepared to Red Team at PRCCDC 2015

I had the opportunity to take part in the Pacific Rim CCDC this past weekend and it was a BLAST! It was my first CCDC, so I really didn’t know what to expect. I did know that the last thing I would want to be doing is installing and configuring tools during test time. Kali I err’d on the side of installing tools I may not use rather than not installing something I would need. I’ve got a goto script I use for my setting up a Kali VM and customizing. It installs a ton of tools and scripts that I use. The script can be found here. Then, I made some manual tweaks: Change root password Enable autologin within /etc/gdm3/daemon.conf... [Read More]


Persistence is a great thing to have on a pentest, especially if testing from the outside. Persistence also seems to be a word that makes clients’ hairs on the back of their necks stand up. Backdoors are a scary thing if you’re in charge of keeping a network secure. When it comes to installing persistence, there are quite a few options available such as Metasploit’s persistence module or scheduleme.rb. These modules leave a permanent, like one would think, payload and schedule for phoning home to the tester’s box. But what about when this is out of scope? Here’s a method to keep a payload phoning home but leaves no permanent effects. Using WinRAR, we can pack our payload with a vbscript that sleeps for... [Read More]

Fresh Veil

Automatically Generating Payloads

Veil is awesome - it makes payload generation easy and supports a wide variety of payloads with new ones being dropped pretty often. Getting caught by AV during a test is not awesome. Being caught because the target’s AV had a signature hit on you is even worse. Because YOU (the tester) messed up. You didn’t take the extra few minutes to regenerate a payload. I’ve been there and I’m sure you’ve been there. It sucks and you feel silly. The solution? Use Veil’s command line options and cron to regenerate payloads every 30 minutes. Server Build This is the basic build. Let’s assume that you have a server that you catch social engineering payloads on. Static IP (or domain). For setup, make a directory... [Read More]