NetSPI Blog

Karl Fosaaen
May 12th, 2020

Attacking Azure Container Registries with Compromised Credentials

Azure Container Registries are Microsoft’s solution for managing Docker images in the cloud. The service allows for authentication with AzureAD credentials, or an “Admin user” that shares its name with the registry. For the purposes of this blog, let’s assume that you’ve compromised some Admin user credentials for an Azure Container Registry (ACR). These credentials […]

Scott Sutherland
May 4th, 2020

Evil SQL Client Console: Msbuild All the Things

Evil SQL Client (ESC) is an interactive .net SQL console client that supports enhanced SQL Server discovery, access, and data exfiltration capabilities.

Austin Altmann
April 30th, 2020

Introduction to Hacking Thick Clients: Part 1 – the GUI

Introduction to Hacking Thick Clients is a series of blog posts that will outline many of the tools and methodologies used when performing thick client security assessments. In conjunction with these posts, NetSPI has released two vulnerable thick clients: BetaFast, a premier Betamax movie rental service, and Beta Bank, a premier finance application for the […]

Austin Altmann
April 27th, 2020

Introducing BetaFast – NetSPI’s Vulnerable Thick Client

Another vulnerable application is being unleashed into the world. Developed here at NetSPI, BetaFast is a vulnerable thick client application and valuable resource for practicing security testing. History Years ago, a NetSPI consultant was venturing into the basement of our office building to retrieve some fresh fingerless gloves from storage. Wandering through the scarcely lit […]

Karl Fosaaen
April 16th, 2020

Gathering Bearer Tokens from Azure Services

In the previous Azure Managed Identities blog, we covered some simple proof of concept examples for using Azure Virtual Machine Managed Identities to escalate privileges in an Azure subscription. The example code relied on Azure OAuth bearer tokens that were generated from authenticating to the Azure metadata service. Since posting that blog, we’ve found a […]

Jake Karnes
March 30th, 2020

Decrypting Azure VM Extension Settings with Get-AzureVMExtensionSettings

TL;DR If you’re a local admin on an Azure VM, run the Get-AzureVMExtensionSettings script from MicroBurst to decrypt VM extension settings and potentially view sensitive parameters, storage account keys and local Administrator username and password. Overview The Azure infrastructure needs a mechanism to communicate with and control virtual machines. All Azure Marketplace images have the […]

Scott Sutherland
March 27th, 2020

Linux Hacking Case Studies Part 5: Building a Vulnerable Linux Server

This blog will share how to configure your own vulnerable Linux server so you can practice building and breaking at home.

Scott Sutherland
March 26th, 2020

Linux Hacking Case Studies Part 4: Sudo Horror Stories

This blog will cover different ways to approach SSH password guessing and attacking sudo applications to gain a root shell on a Linux system.

Scott Sutherland
March 25th, 2020

Linux Hacking Case Studies Part 3: phpMyAdmin

This blog will walkthrough how to attack insecure phpMyAdmin configurations and world writable files to gain a root shell on a Linux system.