7 Minute Security

Brian Johnson

7 Minute Security is a weekly information security podcast focusing on penetration testing, blue teaming and building a career in security. The podcast also features in-depth interviews with industry leaders who share their insights, tools, tips and tricks for being a successful security engineer.

  1. 3 DAYS AGO

    7MS #691: Tales of Pentest Pwnage – Part 75

    Holy schnikes, today might be my favorite tale of pentest pwnage ever. Do I say that almost every episode? yes. Do I mean it? Yes. Here are all the commands/links to supplement today’s episode: Got an SA account to a SQL server through Snaffler-ing With that SA account, I learned how to coerce Web auth from within a SQL shell – read more about that here I relayed that Web auth with ntlmrelayx -smb2support -t ldap://dc --delegate-access --escalate-user lowpriv I didn’t have a machine account under my control, so I did SPNless RBCD on my lowpriv account – read more about that here Using that technique, I requested a host service ticket for the SQL box, then used evil-winrm to remote in using the ticket From there I checked out who had interactive logons: Get-Process -IncludeUserName explorer | Select-Object UserName Then I queued up a fake task to elevate me to DA: schtasks /create /tn "TotallyFineTask" /tr 'net group "Domain Admins" lowpriv /add /domain' /sc once /st 12:00 /ru "DOMAIN\a-domain-admin" /it /f …and ran it: schtasks /run /tn "TotallyFineTask"

    32 min

  2. 29 AUG

    7MS #690: Tales of Pentest Pwnage – Part 74

    Today’s tale of pentest pwnage is a classic case of “If your head is buried in the pentest sand, pop it out for a while, touch grass, and re-enumerate what you’ve already enumerated, because that can lead to absolute GOLD!”

    21 min

  3. 22 AUG

    7MS #689: Pwning Ninja Hacker Academy – Part 2

    Hello friends!  Today your friend and mine, Joe “The Machine” Skeen joins me as we keep chipping away at pwning Ninja Hacker Academy!  Today’s pwnage includes: “Upgrading” our Sliver C2 connection to a full system shell using PrintSpoofer! Abusing nanodump to do an lsass minidump….and find our first cred. Analyzing BloodHound data to find (and own) excessive permissions against Active Directory objects

    16 min

  4. 16 AUG

    7MS #688: Building a Pentest Training Course Is Fun and Frustrating

    Today I talk about a subject I love while also driving me crazy at the same time: building a pentest training course! Specifically, I dissect a fun/frustrating GPO attack that I need to build very carefully so that every student can pwn it while also not breaking the domain for everybody else. I also talk about how three different flavors of AI failed me in solving a simple task.

    22 min

  5. 11 AUG

    7MS #687: A Peek into the 7MS Mail Bag – Part 5

    Hi friends, we’re doing something today we haven’t done in a hot minute: take a dip into the 7MinSec mail bag! Today we cover these questions: If I’m starting a solo business venture as a security consultancy, is it a good idea to join forces with other solo security business owners and form a consortium of sorts? Have you ever had anything go catastrophically wrong during a pentest?  Yes, and this is an important link in the story: https://github.com/fortra/impacket/issues/1436 What ever happened with the annoying apartment neighbor who stomped around like a rhino when you made any noise during COVID? What happened to the “difficult family situation” you vaguely talked about a few months ago that involved police and lawyers – did that ever get resolved?

    57 min

  6. 1 AUG

    7MS #686: Our New Pentest Training Course is Almost Ready

    Oh man, I’m so excited I can hardly sleep. Our new three-day (4 hours per day) training is getting closer to general release. I talk about the good/bad/ugly of putting together an attack-sensitive lab that students can abuse (but hopefully not break!), and the technical/curriculum-writing challenges that go along with it.

    24 min

  7. 25 JUL

    7MS #685: The Time My Neighbor Almost Got Scammed Out of $13K

    Today’s kind of a “story time with your friend Brian” episode: a tale of how my neighbor almost got scammed out of $13k.  The story has a lot of red flags we can all keep in mind to keep ourselves (as well as kids/friends/parents/etc.) safer from these types of shenanigans.

    23 min

  8. 18 JUL

    7MS #684: Pwning Ninja Hacker Academy

    Hey friends, today we start pwning Ninja Hacker Academy – cool CTF-style lab that has you start with no cred and try to conquer domain admin on two domains!

    23 min
See All (690)

About

7 Minute Security is a weekly information security podcast focusing on penetration testing, blue teaming and building a career in security. The podcast also features in-depth interviews with industry leaders who share their insights, tools, tips and tricks for being a successful security engineer.

Information

  • Creator
    Brian Johnson
  • Years Active
    2014 - 2025
  • Episodes
    690
  • Rating
    Clean
  • Copyright
    © Brian Johnson
  • Show Website
    7 Minute Security

You Might Also Like