Sessiondump Meterpreter Extension

Mimikatz is awesome right, so is WCE. But both have one fatal flaw, even though you can execute them in memory {link} - you still have to have the binaries, remember the command to execute it in memory, and ultimately transfer the entire binary over so that metasploit can do its thing.

Then along came SessionDump. I only noticed this because someone was tweeting congratulations to someone on writing it:

Dumping Hashes on Win2k8 R2 x64 with Metasploit

When trying to dump password hashes on a Windows 2008 R2 64 bit box I constantly run into the "The parameter is incorrect" error in meterpreter. So I've had to fall back on dropping binaries which I really don't like doing because of the added clean up and chance of getting 'caught'. Well, with a bit of migration you'll be back to passing the hash. Here is how, with a bit of the thought process first:

MS08_068 + MS10_046 = FUN UNTIL 2018

TL;DR: SMB Relay + LNK UNC icons = internal pentest pwnage

I need to touch on the highlights of two vulnerabilities before we talk about the fun stuff, but I highly encourage you to read the references at the bottom of this post and understand the vulnerabilities after you are done with my little trick, as you might find one of your own.

PSExec Demystified

Multiple modules inside the Metasploit Framework bear the title PSExec, which may be confusing to some users.
When someone simply refers to “the PSExec module”, they typically mean exploit/windows/smb/psexec, the original PSExec module. Other modules are more recent additions, and make use of the PSExec technique in other ways. Here’s a quick overview of what these modules are for:

Reverse shells one-liners

Inspired by the great blog post by pentestmonkey.net, I put together the following extra methods and alternatives for some methods explained in the cheat sheet. There is nothing cutting edge, however you may find this handy during your penetration tests.

Reverse connection: ICMP shell

Data retrieval over DNS in SQL injection attacks

We have recently implemented data retrieval over DNS in sqlmap. This data exfiltration technique adds up to the six existing techniques already implemented: boolean-based blind, time-based blind, full UNION, partial UNION, error-based and stacked (nested) queries. It is supported on Oracle (running either on UNIX/Linux or Windows) and Microsoft SQL Server/MySQL/PostgreSQL (running on Windows).

The technique can be tested for and used by providing sqlmap with the --dns-domain switch following a hostname that resolves over the Internet to the machine where you are running sqlmap from – you do not need to run your name server daemon so you can use a freely available DynDNS or

[FCKEDITOR] Bypass "Safedog Security" to upload backdoor

We knew that, with FCKEditor file upload vulnerability and IIS 6 ,we can upload backdoor such as shell.asp;.gif .Unfortunately,we can't exploit if that server using Web Security software like this case is Safedog software 

ProxyChains + Tor Backtrack 5 R3 Tutorial

To remain anonymous is one of the important aspect of Information Security, if you want to conduct penetration testing on a remote computer then active connection is required which surely reveal your identity, sometimes you need to hide your identity while doing vulnerability assessment because of your anonymity and security. Proxy Chaning is a concept which is very helpful to hide an identity on the Internet.

Fun With PSEXEC Scanner Metasploit Module

So you have a meterpreter session on some Windows machine remotely or internally. One of the first things a lot of folks will do is escalate to SYSTEM (getsystem or post/windows/escalate/getsystem in meterpreter) and dump the server's password hashes (hashdump or post/windows/gather/hashdump). The logical thing to do next is to begin cracking the hashes for later use. There are many caveats to cracking Windows hashes and it does take some time so you might as well begin this process ASAP right? However, there is often no reason to spend time/cycles cracking hashes when you can "pass the hash." This is a long-known technique that exploits some inherent weaknesses in the Windows SMB stack to simply authenticate to SMB using a username and password hash rather than a username and its password.