Hi friends, today we're talking about pentesting potatoes (not really, but this episode is sort of a homage to episode 333 where I went to Boise to do a controls assessment and ended up doing an impromptu physical pentest and social engineer exercise). I talk about what a blast I'm having hunting APTs in XINTRA LABS, and two cool tools I'm building with the help of Cursor:

• A wrapper for Netexec that quickly finds roastable users, machines without SMB signing, clients running Webclient and more.
• A sifter of Snaffler-captured files to zero in even closer on interesting things such as usernames and passwords in clear text.

Today we continue our journey from last week where we spun up a Hetzner cloud server and Ludus.cloud SCCM pentesting range! Topics include:

• Building a Proxmox Backup Server (this YouTube video was super helpful)
• Bridging a second WAN IP to the Hetzner/Ludus server
• Wrestling with the Hetzner (10-rule limit!) software firewall
• When attacking SCCM – you can get a version of pxethief that runs in Linux!

I had an absolute ball this week spinning up my first Hetzner server, though it was not without some drama (firewall config frustrations and failing hard drives). Once I got past that, though, I got my first taste of the amazing world of Ludus.cloud, where I spun up a vulnerable Microsoft SCCM lab and have started to pwn it. Can’t say enough good things about Ludus.cloud, but I certainly tried in this episode!