From beginners to experts, this is where hackers level up! Join today and learn how to hack.

Beau Bullock // TL;DR I compared three single-board computers (SBC) against each other with a specific goal of finding which one would serve best as a “penetration testing dropbox”, and maintain an overall price of around $110. Spoiler Alert: At the time I tested these Hardkernel’s ODROID-C2 absolutely destroyed the competition in this space. If you […]

Joff Thyer// Many of you have probably already looked at Beau Bullock’s fine blog entry on a penetration testing dropbox. Beau has some excellent guidance on how to build the base dropbox platform using different platforms. In this case, I selected the ODroid-C2 platform running KALI (ARM) edition and am going to extend upon that […]

How to limit the effectiveness of tools commonly used by malicious actors.

David Fletcher // Reporting is a penetration testing topic that doesn’t have a whole lot of popularity. People have a hard time being inspired to write about the technical details of their engagements. In some cases, testers skim the surface only identifying the successful portions of their test. In others, testers just regurgitate the output from […]

Scott Worden* // So you and your company had a pen test…now what? What to do, how to plan, and good SQUIRREL! ways to stay on track.   The 3 Stage of the Penetration Test The TESTER The TESTED Having the penetration tester reach your crown jewels, get root, own you, pwn you, own3d, 0wn3d, […]

Last month, Singapore hosted a summit between the leaders of North Korea and the United States. Accredited journalists invited to the event were given a press kit containing a bottle of water, vari…

Around 40% of organizations ignore critical security issues when they don’t know how to fix them

Incognito, originally a stand-alone application, allows you to impersonate user tokens. This was integrated into Metasploit and ultimately into Meterpreter.

Posts about Rotten Potato written by Administrator

Rapid7's VulnDB is curated repository of vetted computer software exploits and exploitable vulnerabilities.

Common Windows Privilege Escalation Vectors  Imagine this scenario:  You've gotten a Meterpreter session on a machine (HIGH FIVE!), and you opt for running getsystem in an attempt to escalate your privileges... but what that proves unsuccessful?  Should you throw in the towel?  Only if you're a quitter... but you're not, are you?  You're a champion!!!  :)  In this post I will walk us through common privilege escalation techniques on Windows, demonstrating how to "manually" accomplish each task as well as talk about any related Metasploit modules.  While most techniques are easier to exploit when escalating from Local Administrator to SYSTEM, improperly configured machines can certainly allow escalation from unprivileged accounts in the right circumstances.

Hey everyone, I've been encountering some problems with privilege escalation when the target has an AV installed, so here's a tutorial for when the almighty "getsystem" doesn't cut it and "bypassua...

How can we help you find the answers you need to questions about Rapid7 Products and Services?

Metasploit has a Meterpreter "getsystem" script, that will use a number of different techniques in attempt to gain SYSTEM level privileges on the remote target.

Metasploit is full of interesting and useful features such as the ability to generate an executable from a Metasploit payload.