Owning One to Rule Them All

Presented at DEF CON 20 (2012), July 27, 2012, 1 p.m. (50 minutes).

As penetration testers, we often try to impact an organization as efficient and effective as we can to simulate an attack on an organization. What if you could own one system to own them all? That's it, one system. It's all you need, it's in every company, and as soon as you compromise it, the rest fall (no not a domain controller). This presentation will cover a recent penetration test where I came up with a unique avenue to getting over 13,000 shells in just a few minutes by popping one server. I'll be releasing some custom tools to make this simplistic and automate the majority of what was used on this attack. Let's pop a box. Dave Kennedy will be signing copies of his book, Metasploit: The Penetration Tester's Guide, at 14:00 on Friday at the No Starch Press table in the Vendor area.

Presenters:

• Dave DeSimone - Manager, Information Security
  Dave DeSimone is the Manager of Information Security for a Fortune 1000 company. DeSimone has developed, implemented, and operationalized the global vulnerability management program for multiple distinct international organizations. DeSimone's expertise is in penetration testing, security event response, network security, vulnerability/malware analysis and security architecture. DeSimone has also developed major programs including risk management, penetration testing, and application security. Twitter: @d2theave
• David Kennedy / ReL1K - Chief Security Officer   as Dave Kennedy
  Dave Kennedy is the Chief Security Officer (CSO) for a Fortune 1000 company. Kennedy is the author of the book Metasploit: The Penetration Testers Guide, the creator of the Social-Engineer Toolkit (SET), and the creator of Fast-Track. Kennedy has presented on a number of occasions at Black Hat, DEF CON, ShmooCon, BSIDES, Infosec World, Notacon, AIDE, Hashdays, Infosec Summit, and a number of other conferences. Kennedy is on the Back|Track and Exploit-DB development team and co-host of the Social-Engineer.org and ISDPodcast podcast. Kennedy is one of the co-authors of the Penetration Testing Execution Standard (PTES); a framework designed to fix the penetration testing industry. Kennedy is a co-founder of DerbyCon, a large-scale security conference in Louisville Kentucky. Kennedy <3's Python. Twitter: @dave_rel1k http://www.secmaniac.com/

Links:

• https://defcon.org/html/defcon-20/dc-20-speakers.html#Kennedy
• https://infocon.org/cons/DEF CON/DEF CON 20/DEF CON 20 video and slides/DEF CON 20 - Dave Kennedy and Dave DeSimone - Owning One to Rule Them All - Video and Slides.mp4 (Video and Slides)
• https://www.youtube.com/watch?v=Mz9Bg9KAKBs

Similar Presentations:

• DEF CON 24 (2016) / Secure Penetration Testing Operations: Demonstrated Weaknesses in Learning Material and Tools
• DEF CON 19 (2011) / Mamma Don't Let Your Babies Grow Up to be Pen Testers - (a.k.a. Everything Your Guidance Counselor Forgot to Tell You About Pen Testing)
• Notacon 8 (2011) / Strategic Penetration Testing - Changing the way we hack