A Citrix Story

13 May 2017 in blog

I recently had the pleasure of partaking in a Citrix Virtual Desktop infrastructure assessment.

Rasta Mouse

Taylor Swift fan, wannabe Red Teamer & 1337 hax0r (in that order).

Penetration Tester

no post found

Automated Red Team Infrastructure Deployment with Terraform - Part 2

Sep 9, 2017

Introduction

In Part 1, we looked at using Terraform to deploy cloud infrastructure (VMs, firewalls, DNS records etc). In this post, we’ll look at some examples for automating the installation of tools/software on the VM resources.

Jumping Network Segregation with RDP

Aug 8, 2017

Introduction

This short post demonstrates how it may be possible to pivot into a segregated/protected network, via an RDP Jump Box.

Automated Red Team Infrastructure Deployment with Terraform - Part 1

Aug 8, 2017

Introduction

Deploying resiliant Red Team infrastructure can be quite a time consuming process. This wiki maintained by Steve Borosh and Jeff Dimmock is probably the best public resource I’ve seen in regards to design considerations and hardening tips.

For someone like myself, who destroys and stands fresh infrastructure up for each engagement, building everything by hand is a long, laborious process. Anything that can be automated is a good thing.

De-ICE S1.100

Jul 7, 2017

Scenario

The CEO of a small company has been pressured by the Board of Directors to have a penetration test done within the company. The CEO, believing his company is secure, feels this is a huge waste of money, especially since he already has a company scan their network for vulnerabilities (using Nessus). To make the BoD happy, he decides to hire you for a 5-day job; and because he really doesn’t believe the company is insecure, he has contracted you to look at only one server - an old system that only has a web-based list of the company’s contact information.

The CEO expects you to prove that the admins of the box follow all proper accepted security practices, and that you will not be able to obtain access to the box. Prove to him that a full penetration test of their entire corporation would be the best way to ensure his company is actually following best security practices.

How to Accidently Win Against AV

Jul 7, 2017

Computer viruses have been around since as early as the 1970’s - the eternal battle between virus creators and antivirus solutions continues to wage over 40 years later.

Cobalt Strike - Spawn As

Jun 6, 2017

beacon> getuid
[*] You are CYBER-LANCE\sgomez

beacon> spawnas cyber-lance\tswift Passw0rd! smb

A Citrix Story

Rasta Mouse

Automated Red Team Infrastructure Deployment with Terraform - Part 2

Introduction

Jumping Network Segregation with RDP

Introduction

Automated Red Team Infrastructure Deployment with Terraform - Part 1

Introduction

De-ICE S1.100

Scenario

How to Accidently Win Against AV

Cobalt Strike - Spawn As

PsExec Much?

Playing with Cuckoo

A Citrix Story

Posts