Hacker’s Paradise: Top 10 Biggest Threats When Working From Home
summary
Demonstrations show macro-triggered PowerShell downloading a reverse shell, a DLL-hijack persistency that escalates to SYSTEM, and an SMB relay using smbrelayx.py that succeeds because SMB signing is off and NTLMv2 is relayed; a password-spray across ~6,000 accounts yields 2,129 predictable passwords; local service credentials are dumped from the registry with CQSecretsDumper and evidence of past execution is recovered via PrefetchParser. Tools: Netcat, PowerShell, psexec; mitigations: MFA, allowlisting, SMB signing, attack-surface reduction.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:00Remote Work
- 2:30Employees
- 4:25Macros
- 5:55Demo
- 10:02Problems
- 14:53Network Segmentation
- 16:50Lack of SMB Signing
- 17:47SMB Relay
- 22:27Process IDs
- 35:02Falling for Evil Tools
related talks
52mStart covering your bases & Stop chasing APT headlines
58mHacking in 2016 - How is our systems broken?
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
42mStart Covering Your Bases And Stop Chasing APT Headlines
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse Them
25mInvestigating PowerShell Attacks
47mThe Blurred Lines between Cybercrime and Statecraft