Common Attacks and Countermeasures: Back to the Basics of Security Practices
This video goes over typical attacks we do on engagements and how to fix the issues.
We are looking at shared local administrator password, LAPS, SMB Relaying, SMB Signing, Printer bug, NBNS/LLMNR and WPAD.
0:00 - Intro
1:41 - Shared Local Administrator Password
2:19 - Demo - Shared Administrator Password
5:45 - Remediation - Shared Local Administrator Password
7:50 - Demo - LAPS and Preventing over the network login with local accounts
23:51 - SMB Signing
24:39 - Demo - Relaying SMB
27:19 - Remediation - SMB Signing
28:20 - Demo - Require SMB Signing
29:58 - Printer bug - SpoolSample
31:43 - Demo - Printer bug
33:55 - Remediation - Printer bug
34:21 - Demo - Disable Print Spooler
35:33 - NBNS/LLMNR and WPAD
39:09 - Demo NBNS/LLMNR poisoning
41:19 - Remediation - NBNS/LLMNR and WPAD
43:25 - Demo - Disabling NBNS/LLMNR Broadcasts and WPAD