Introduction The Red Team Ops (RTO) certification has been around for a while and is often recommended as one of the best entry points into red teaming. After completing both the course and, in particular, the exam, I can see why. I had RTO bookmarked for more than a year, but I continuously postponed pulling the trigger. I am a pentester rather than a red teamer, and I don’t plan on switching just yet, so I gave priority to certifications that felt more relevant to my day-to-day work, such as OSCP and CAPE. ...

Introduction After the article about Email Security, I thought I would continue the trend of writing about “boring” and “unpopular” security assessments. While looking at various infrastructure-related components that are never discussed in popular “pentesting” courses, one topic immediately stood out: firewall configuration reviews. These are often treated like a checkbox exercise: more like “let’s get it over with” than “let’s dive into it”. After spending some time fiddling with Cisco configurations and documentation, I have to admit that I now find them a bit less boring than I did before. That’s progress, isn’t? ...

Introduction One security-related topic that is almost never discussed in courses, such as CPTS or OSCP, is email security. There is almost always a phishing exercise, but it never goes more than that. You never get to learn why the spoofed email was accepted in the first place and what could be done to prevent it. This is somewhat strange given that phishing remains one of the most common methods for obtaining an initial foothold in an environment! ...

Introduction We have covered LLMNR/NBT-NS Poisoning (how to obtain credentials from an Adversary-in-the-Middle (AitM) position) and how SMB signing prevents those credentials from being relayed over SMB. We will now explore a similar concept, but this time focusing on the Lightweight Directory Access Protocol (LDAP). We will start by explaining what LDAP is and then have a look at the mechanisms that prevent relaying over it. We will keep our scope intentionally tight and won’t cover any unrelated aspects such as LDAP syntax. ...

Introduction In the first article, we talked about LLMNR/NBT-NS Poisoning and saw how it can be used to capture an NTLMv2 hash. This naturally leads to the next question: what can we do with that hash? Things are straightforward when the captured hash is weak and can be recovered, but what happens when it is not? What options do we have then? Instead of diving straight into NTLM relay, this article focuses on laying the necessary foundations first. We will focus on identifying where an NTLM relay attack is actually possible and, more importantly, why that is the case. For now, we will exclusively talk about relaying over SMB, which requires understanding SMB signing. LDAP signing will be the topic of the next article. ...

Introduction LLMNR/NBT-NS Poisoning is one of the most consistent vulnerabilities I come across during internal tests. Even if the name does not ring a bell, chances are you have, at some point in a lab, launched Responder hoping to capture a hash: If that’s the case, you are already familiar with the attack, but have never really taken the time to explore what is actually happening behind the scenes. Under the right conditions, this attack vector can result in getting an NTLMv2 hash which can be recovered or relayed (e.g. combined with something such as the lack of SMB signing). It can be our way from: ...

Introduction If you feel like experimenting yourself, the NT hash dataset can be generated using this creatively-named script. In Part 1 we retrieved NTDS and in Part 2 we organised it using hash-organiser. We are now ready to move to the next part of the process: recovering hashes. Extract NTDS → Clean/Organise NTDS → Crack hashes → Analyse results “Cracking hashes” sounds a bit abstract, so let’s try narrowing it down. At this stage, the goal is not to crack as many hashes as possible just because, but to identify weak passwords and patterns that represent real risk to the domain. ...

Introduction In Part 1, we talked about how we can extract credentials from NTDS using DCSync and VSS. Now, it is time to think about how to best handle the NTDS file. Extracting NTDS is typically the last step in a CTF, but it is just the first one here: Extract NTDS → Clean/Organise NTDS → Crack hashes → Analyse results The good news is that this part is technically much simpler; no need to talk about weird acronyms, protocols, and methods. We just need to decide what we actually need from NTDS and extract it. ...

Introduction Although there are a few CAPE-related articles and videos out there, some can make the exam look scarier and more complicated than it actually is; they certainly had that effect for me! For instance, my biggest concern after reading them was evasion, as this is one of my weakest areas. In addition to that, I am working from a laptop with fairly limited resources, and let’s just say that installing Visual Studio and compiling stuff on it is not ideal. ...