36: Jeremy from Marketing

Episode Summary

Executive Summary: Jack interviews penetration tester Tinker about an internal red-team engagement where he posed as “Jeremy from Marketing” to test a large company’s defenses from inside. Tinker’s week-long effort showed how layered controls—strong passwords, MFA, logging, NAC gaps, and anomaly detection—can frustrate attackers and ultimately expose them through unusual behavior, especially PowerShell use in finance.

Main Topics: Internal red-team penetration test: The episode follows Tinker’s covert assignment as an internal contractor to assess a company’s defenses after assuming perimeter breaches could already exist. Reconnaissance and stealth: Tinker begins by quietly mapping usernames, domain structure, hosts, and network traffic while trying not to trigger logs or suspicion. Credential capture and cracking: Using Responder and a GPU cracking rig, he harvests NTLM hashes and eventually recovers some cleartext passwords after adjusting for password policy. Defense-in-depth and access restrictions: The company’s controls—12-character passwords, MFA, restricted remote access, limited local admin rights, encryption, and logging—blocked many common attack paths. Social engineering and MFA bypass: Tinker successfully bypasses Citrix MFA by phoning a user, impersonating IT, and obtaining the one-time code via social engineering. Physical access and endpoint exploitation: He escalates by entering the IT shack, taking laptops, finding an unencrypted machine, and discovering an unquoted service path weakness plus a third-party access-control gap. Detection and response by blue team: He is ultimately caught because finance users almost never run PowerShell, demonstrating the company’s anomaly detection and incident response maturity.

Key Arguments: Attackers often start quietly and only become noisy when they are blocked; stealthy reconnaissance is the foundation of effective penetration testing. Default Windows and AD environments can leak enough data to build a strong target map, especially through username enumeration and network share discovery. Responder-style LLMNR/NBT-NS poisoning can still yield credentials if network hardening is incomplete, but strong password policy can reduce cracking success. Multi-factor authentication significantly raises the bar, but social engineering can still defeat users and recover time-sensitive codes. Encryption, endpoint logging, NAC, and restricted admin rights create multiple friction points that force attackers to expend more time and creativity. Behavioral detection matters: the company caught Tinker because PowerShell from a finance workstation was anomalous, not because malware was detected. Defense in depth is effective not by making compromise impossible, but by increasing attacker cost until the environment becomes unattractive or errors surface.

Data Points: Password policy minimum length: 12 characters - The company required strong passwords, which pushed users toward passphrases and made cracking harder. MFA rollout timing: Next week - An email Tinker found said multi-factor authentication would be implemented in email the following week. Hash cracking setup: 8 NVIDIA GTX 1080 Ti GPUs - Tinker used a dedicated GPU server off-site to crack captured NTLM hashes. Observed hash capture yield: 5 to 15 hashes total - He reported pulling down this many hashes after running Responder. Typical cracking throughput: 300 billion guesses per second - Tinker described the scale of his NTLM cracking environment. NetNTLMv2 cracking throughput: 6 to 12% of NTLM speed - He noted NetNTLMv2 was slower to attack than standard NTLM. Responder cadence: 2 times a day, 15 to 20 minutes each - He ran Responder in the morning and around noon to catch login traffic. Laptops removed from IT shack: About 30 laptops - He carried multiple armloads from the IT storage room to his cubicle. Unencrypted laptops found: 2 laptops - Only two of the laptops he examined were not encrypted. Shells popped after malware deployment: 8 Meterpreter sessions - His staged payload triggered multiple callbacks after the finance user logged in. MFA response window: About 60 seconds - Citrix MFA code needed to be captured and entered before expiration.

Pivotal Quotes: "The quieter you become, the more you can hear." — Jack Reesider: Used to describe the value of staying silent and observing during early reconnaissance. "What kind of lockdown prison is this place, right?" — Tinker: His reaction after finding that apps in the single sign-on portal each had separate MFA requirements. "It’s not enough to detect an attack. You have to do proper response and containment." — Jack Reesider: Wrap-up emphasizing that the company’s success came from both detection and incident response.

Implications: The episode shows that mature security is layered, behavioral, and operational—not just tool-based. Strong MFA, encryption, least privilege, and logging can slow attackers enough to expose them, while user-facing social engineering remains a major risk.