Month: February 2021

Mimikatz can be a tool not only for hackers. During migrations to Cloud from IaaS many times I need to export the certificate to reuse on the cloud – most of them -p private kay is protected against the export. But it is easy to do with Mimikatz. Moreover, it is easier than using certificates MMC. Here is a step by step process: Disable Antivirus including Windows Defender using gpedit.msc. Execute gpupdate /force. Download Mimikatz https://blog.gentilkiwi.com/mimikatz – binaries. Execute: crypto::capi privilege::debug crypto::cng crypto::certificates /systemstore:local_machine /store:my /export If you cannot find your certificate here: Get-ChildItem Cert:LocalMachineMy Just instead of looking where it is go to IIS Management or simply open webpage, export certificate without the private key, import it to the LocalMachine using mmc.exe/certificate. At this point, the certificate has not private key associated, but you can download DigiCert utility run this utility as an administrator, choose the certificate to right-click, and repair the certificate. In that way, private kay that exists on the machine will be found and you can export the certificate with a private key once again using: crypto::certificates /systemstore:local_machine /store:my /export The certificate will have the password: mimikatz.

Właśnie mija 2 lata od ostatniej największej i najbardziej wartościowej konferencji IT, która odbyła się fizycznie – a nie wirtualnie. Myślę tutaj o Microsoft Ignite. Chyba każdy z nas tęskni za takimi konferencjami, wymianą doświadczeń z innymi uczestnikami wspaniałym kontaktem z prelegentami. Konferencja nie była darmowa, była płatna i to nie mało – ale to gwarantowało, że materiały były naprawdę wartościowe. Całe szczęście do dzisiaj z nich możemy korzystać. Poniżej link, gdzie znajduje się ich cały zestaw: Liste et liens de téléchargement des sessions Ignite 2019 Gdyby zniknęły poniżej skopiowane zestawienie i jak patrzę na SAS to oglądać możemy do listopada 2024 roku. Two years have passed since the last largest and most valuable IT conference, which was held physically – not virtually. I am thinking of Microsoft Ignite here. Probably each of us misses such conferences, exchange of experiences with other participants, great contact with the speakers. The conference was not free, it was paid and it was not enough – but it guaranteed that the materials were really valuable. Fortunately, we can still use them today. Below is the link where you can find their entire set: Liste et liens de téléchargement des sessions Ignite 2019 If the … Conference – Community – Networking – Ignite – Great MaterialsRead more

Nowadays Hardening Operating system is a must! There are a lot of tools that can help to do this. One of my favorites is CIS Hardened Images that do more than others. Other solutions and companies can help on this also like Qualys and finally Azure Security Center. But the recommendation is one part, but the next part is implementation. So I launched Azure Security Center Recommendations for Linux Github repo that is based on the recommendation from Azure Security Center and I hope some of you can contribute to them. From another way you can visit some Security Technical Implementation Guides (STIG) scripts – especially I recommended these forked ones, but you can always jump to the source: https://github.com/MariuszFerdyn/Ubuntu_18.04_STIG https://github.com/MariuszFerdyn/Standalone-Windows-STIG-Script https://github.com/MariuszFerdyn/STIG-SCRIPTS   So once again – please visit: https://github.com/MariuszFerdyn/AzureSecurityCenterOSRemediations/tree/main/Linux and contribute, now I cover only Redhat/Fedora and these, but updates will be only in Github: NAME Zeroconf networking should be disabled. CCEID CCE-14054-1 RULE SEVERITY Critical FULL DESCRIPTION Zeroconf networking should be disabled. (disabled) POTENTIAL IMPACT An attacker could use abuse this to gain information on network systems, or spoof DNS requests due to flaws in its trust model ACTUAL VALUE File /etc/sysconfig/network should contain one or more lines … Azure Security Center Recommendations for LinuxRead more