Meeting Notes – Hack the Box

hacktheboxlogo

We ran into a few issues with flight delays and technology – unfortunately our streaming and recording failed to save audio for this event so we do not have a video available. But RISE attendees pulled together to make this a great interactive meeting covering Hack the Box. If you weren’t able to make the event, keep reading for notes from the demonstrations. Special thanks to R&K Solutions for hosting this event.

Continue reading

Dec 2016 – SANS Holiday Hack Challenge Party

santa1

 

 

 

 

 

 

 

The SANS Holiday Hack Challenge is going to be released on Dec 9th, we’re going to party on Dec 15th:

santa2

 

 

 

 

 

 

 

 

If you’re not familiar with the challenge it is an annual event put on by Ed Skoudis and his team. It is essentially a game that involves a series of cyber security challenges designed to get you to learn a wide variety of skills. The team does a phenomenal job. It has elements for all skill levels and hints as you go along the way. Last year’s challenge was EPIC and I think my wife was ready to kill me if I didn’t stop playing. I’ll warn you, it can get addictive.

166-addiction

The challenges are kept online each year so you can continue to play, even if you didn’t complete it by the deadline. Here is last year’s challenge if you want take a look: https://holidayhackchallenge.com/ This link will likely update to the 2016 challenge on 12/9. If so, here is a list of past challenges: https://pen-testing.sans.org/holiday-challenge/

I can honestly say, after playing last year, I have looked forward to this year’s challenge all year long. My wife, maybe not so much, since I had my head buried in my laptop for 2 weeks last time 🙂 Here are just a few of the things I either learned about, or added skills to while playing last years challenge: sed, awk, scapy, python, JSON, SQL injection techniques,  numerous web application pentesting techniques, Burp Suite, mondoDB, firmware extraction, DNS CnC and data exfil. And when I wasn’t pulling out my hair, I had an absolute blast doing it!

Join us on 12/15 to work on the Holiday Hack Challenge. It is for all skill levels and you will be surprised how much you will learn. We will have wifi access available so everyone can work on the challenge. If you are a student and want to participate but don’t have a laptop, let us know and I will make arrangements so you will have somethig to work on.

To make the best use of the time at the party, go ahead and sign up for an account once the challenge is posted on 12/9.  You can start playing anytime after you get an account. I  also recommend having some sort of virtualization software on your laptop such as VirtualBox or VMWare Player, both are free. And having a VM running Kali set up. Or if Kali is your main OS you may want to have a Windows VM setup. All of that will aid you in the challenge.

gladiator

As usual we’ll have beer/soda and snacks. Just bring your brains because you’re going to need them.

dan-akroid-santa

The meeting will be at 5:30pm on 12/15 at R&K Solutions, 2797 Frontage Rd NW, STE 1000, Roanoke, VA 24017. Google Maps.

March 2016 – Common Network Penetration Testing Techniques

hack all the things

Our discussion subject for the month of March was Network Pen Tests.

  • What are they?
  • Do they provide value?
  • How are they done?
  • What do you do with the results?

Our guest speaker was Russel C. Van Tuyl (@Ne0nd0g). Russel is an experienced Network Pen Tester with Sword & Shield in Knoxville, TN and has agreed to walk us through his Network Pen Testing procedures.

Here is a quick write up about his presentation:

Attackers can take complete control of a Windows domain by establishing full administrative rights to networks resources. This access can then be used to steal your organizations crown jewels, the thing that makes your organization money. This talk will introduce common attack paths used to compromise a domain. Additionally, a brief introduction to the tools used to perform some of these common attacks will be covered. This presentation will conclude by providing information on mitigating or detecting these common attacks. The audience will be provided with an opportunity to ask any questions, even if they’re not related to the presentation.

Update: Russel did a fantastic job presenting. His presentation was entertaining and had a ton of great information. He not only covered some of the techniques he uses when pen testing, he also talked about ways to mitigate them. If you didn’t walk away with a “To Do” list of things to check on your network, or a list of fun new things to try, you weren’t paying attention.

Here are the slides from the presentation:

Common Pen Testing Techniques

RISE - March 2016

PowerShell Empire

 

He demonstrated how PowerShell can be an admins best friend, or worst enemy, by showing us how easy it was to use PowerShell Empire to compromise a box.

 

Our own Grant Sims has since created step by step video showing how to use one of the PowerShell techniques Russel spoke about. He shows how to use PowerSploit to get a meterpreter shell: