Comments for Strategic Cyber LLC http://blog.strategiccyber.com A blog about Armitage, Cobalt Strike, and Red Teaming Mon, 22 Apr 2013 13:42:42 +0000 hourly 1 http://wordpress.com/ Comment on PSA: A Safety Lesson about Team Servers by rsmudge http://blog.strategiccyber.com/2013/04/21/psa-a-safety-lesson-about-team-servers/#comment-986 Mon, 22 Apr 2013 13:42:42 +0000 http://blog.strategiccyber.com/?p=2035#comment-986 This blog post was written because it was a funny side effect and I really wanted to show a different side of the exercise red team. I strongly disagree with your statement about safety features in the Metasploit Framework. It’s like asking for a child safety lock on a tank.

We do not need a forgiving way to destroy systems. We only destroy systems in an exercise environment. We destroy them because it is funny. We do not want you to recover them.

Penetration testers do not destroy systems during their engagements.

I appreciate your speculation about all of the things that could go wrong, but I really feel it’s misplaced. Please, take this blog post for what it was meant to be “haha, the (National CCDC) red team got a taste of their own medicine”.

]]> Comment on PSA: A Safety Lesson about Team Servers by sapling http://blog.strategiccyber.com/2013/04/21/psa-a-safety-lesson-about-team-servers/#comment-985 Mon, 22 Apr 2013 12:51:02 +0000 http://blog.strategiccyber.com/?p=2035#comment-985 Glad to hear you didn’t have anything major destroyed and yet I have to say perhaps its time for metasploit to institute some additional protection measures. I mean what if you were at a client site mounted a remote file system of theres after hacking in and then that command was issued. Well I bet your never working for that company again.
Regardless tell the team members next time the faster way and more forgiving way is to use fdisk. That way if he realizes his mistake before he runs a reboot the system isn’t completely screwed. And if i am not mistaken because its just the partition table it should still be recoverable with a boot disk allowing you to recover the system.

]]> Comment on Metasploit 4.6 – Now with less Open Source GUI by Simon Earl http://blog.strategiccyber.com/2013/04/11/metasploit-4-6-now-with-less-open-source-gui/#comment-962 Mon, 15 Apr 2013 18:50:50 +0000 http://blog.strategiccyber.com/?p=1953#comment-962 When are you going to let the UK people have a play with Cobalt Strike ?

]]> Comment on Missing in Action: Armitage on Kali Linux by rsmudge http://blog.strategiccyber.com/2013/03/13/missing-in-action-armitage-on-kali-linux/#comment-951 Sat, 13 Apr 2013 03:04:06 +0000 http://blog.strategiccyber.com/?p=1741#comment-951 service metasploit start is necessary once and only once. It also starts the commercial stuff that Armitage doesn’t use. You’re just wasting memory and CPU letting it run. Armitage is capable of starting msfrpcd, to its specifications, for you. I really recommend letting it do so.

]]> Comment on Missing in Action: Armitage on Kali Linux by Tralala http://blog.strategiccyber.com/2013/03/13/missing-in-action-armitage-on-kali-linux/#comment-950 Sat, 13 Apr 2013 02:54:15 +0000 http://blog.strategiccyber.com/?p=1741#comment-950 It not work for me

But what i did go for /etc/rc.local
and add
service postgresql start && service metasploit start
and all start work for me.

]]> Comment on Metasploit 4.6 – Now with less Open Source GUI by rsmudge http://blog.strategiccyber.com/2013/04/11/metasploit-4-6-now-with-less-open-source-gui/#comment-943 Fri, 12 Apr 2013 03:14:50 +0000 http://blog.strategiccyber.com/?p=1953#comment-943 I wouldn’t say these events are related. Kali is a new distro and the team there has been extremely responsive to requests to add tools that users suggest.

]]> Comment on Metasploit 4.6 – Now with less Open Source GUI by Mike Landeck http://blog.strategiccyber.com/2013/04/11/metasploit-4-6-now-with-less-open-source-gui/#comment-942 Fri, 12 Apr 2013 03:06:48 +0000 http://blog.strategiccyber.com/?p=1953#comment-942 Interesting trend in front end GUI’s being dropped. Besides armitage and msfgui being dropped from metasploit I noticed that gerix, the GUI for the aircrack-ng suite is not included in the default kali distro.

Keep up the good work and great attitude.

]]> Comment on Metasploit 4.6 – Now with less Open Source GUI by Todd Gustafson http://blog.strategiccyber.com/2013/04/11/metasploit-4-6-now-with-less-open-source-gui/#comment-939 Thu, 11 Apr 2013 22:23:48 +0000 http://blog.strategiccyber.com/?p=1953#comment-939 Thank you Mudge. Love your stuff

- T

]]> Comment on Missing in Action: Armitage on Kali Linux by Zach http://blog.strategiccyber.com/2013/03/13/missing-in-action-armitage-on-kali-linux/#comment-915 Fri, 05 Apr 2013 20:30:45 +0000 http://blog.strategiccyber.com/?p=1741#comment-915 Sorry I didn’t check back from my post a few weeks ago. I had all sorts of problems when initially downloading the iso of Kali. After fixing small problem one after another I finally just gave up and downloaded the VM image and everything started working no problem.

Thanks for the help

]]> Comment on Pivoting through SSH by Darren Martyn http://blog.strategiccyber.com/2013/03/28/pivoting-through-ssh/#comment-900 Mon, 01 Apr 2013 16:27:16 +0000 http://blog.strategiccyber.com/?p=1756#comment-900 Is there any chance of support for forwarding a local port (the listener) through a pivot host like so?
ssh -R 0.0.0.0:4444:0.0.0.0:4444 root@pivot -p 22

And then setting the payload to connect back to port 4444 on pivot after forwarding localport 4444 to 4444 on pivot? I have tried this in the past with no luck so far, think it would be an interesting feature for getting around egress filtering after compromising a host on the “edge” of a network, for example, a router or firewall appliance.

]]>