Getting The Goods With smbexec
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Milam, Eric
Individuals often upload and execute a payload to a remote system during penetration tests for foot printing, gathering information, and to compromise additional hosts. When trying to remain stealthy, uploading a shell to a target may not be wise. smbexec takes advantage of native Windows functionality and SMB authentication to execute commands on remote Windows systems without having to upload a payload, decreasing the likelihood of being stopped by AntiVirus. The original intent of creating smbexec was to upload and execute obfuscated payloads using samba tools. Since the first PoC, it has expanded its capability to do more, including dumping local and domain cached password hashes, clear text passwords from memory, and stealing the NTDS.dit file from a Windows Domain controller all without the need for a shell on the victim. We will explore the creation of smbexec, the components behind it, and how to leverage its functionality to get the goods from a system without having to use a payload. Eric Milam is a principal security assessor on the Accuvant LABS enterprise assessment team with over fifteen (15) years of experience in information technology. Eric has performed innumerable consultative engagements including enterprise security and risk assessments, perimeter penetration testing, vulnerability assessments, social engineering, physical security testing, wireless assessments and extensive experience in PCI compliance controls and assessments. Eric is a project steward for the Ettercap project as well as creator and developer of the easy-creds and smbexec projects. IRC J0hnnyBrav0 Materials:
 How's it going? First of all, I want to say holy shit, I'm speaking at DEF CON and it's an honor. And second of all, holy shit, people actually showed up. So thank you very much. That's an honor as well. So I'm going to talk to you today about getting the goods with S&B Exact. And my name is Eric Milam, some people might know me as Bravo Hacks. Thank you very much. That's the end. So, of course, don't you know who I am? I'm on the attack and pen team for AccuVant Labs with a bunch of great people. My boy, Pure Hate, we do a lot of pen tests together. Involved with some open source projects. Maybe you guys have heard of Easycred's, S&B Exact, of course. Ettercap, we took over Ettercap a few years ago. And involved with the Cali Linux distribution. So what is this all about? Right? Basically we're going to go over what is S&B Exact, what does it do, why should you actually care. There's nothing zero day here, so you can boom me if you want. But automation is awesome. This is a tool you can use immediately. It's not some weird exploit that the sun and the moon have to line on a certain day. And it makes post exploitation much easier. At least it has for me. So what is S&B Exact? S&B Exact is a bash script. Because everybody who knows me knows I don't know how to code for shit. But I'm very good with the Googles. And I just put a bunch of shit together until it works. So it's about 1,500 lines and about a million different functions. Put it together in a week, about 100 hours worth of time, about a year's worth of Mountain Dew. The power of the tool really lies in S&B Client to get and put files and when they exceed to execute those. And we have patched them for hash passing. So that works as well. So why write S&B Exact? I mean there's awesome tools out there, right? Has anybody heard of the meta-sploits? Awesome tools. Why would you actually need this? We were on a bunch of pen tests and we started to realize that the PSXExec module was getting popped with our payloads. So we used the custom EXE option but that was also getting popped. So we threw that to the community and basically Mubix, wherever Mubix is, found out real quick for us. That basically what it was triggering on was the injection and service protection. So fuck you Trend Micro but thanks for the motivation. We appreciate it. So after we ran into this a few times, Pure 8 actually found a blog post by Carnal Ownage that was basically upload and execute your payload and that's kind of where the script was born from. So originally, right, we just wanted to get our shells. We wanted our shells so we wrote it so it would create an obfuscated payload that would bypass most AVs. The newer versions, you can actually enable Hyperion, Cryptor.exe and Encrypted as well. We also had it so it would create a meta-sploit.exe file for us and launch that. It would either launch it in X-Term or Screen depending on what you've commented out. If it doesn't recognize X is running, it will automatically launch your text on screen. So that's kind of where it was at. And then we started learning a little bit more about WinEXE and we're like, you know, hey, we can basically run native Windows commands and there's a lot of cool stuff that we could probably end up doing. So I'm not a Windows guy so again, I went to Google and Google told me what to do and we started realizing some of the great things that we could do with it because what we really wanted the tool to do was to basically kind of go undetected and just look like normal Windows traffic or normal network traffic to our victims. So WinEXE, I don't know if anybody is familiar with it, I hope you guys are, it's awesome. It's similar to the SysInternals PSXE modules, I'm sorry, the SysInternals PSXE tools, and it also has a system flag. It also has an uninstall flag which is also awesome and I'll explain those a little bit later. There's no quote unquote payload necessary. You can basically run WinEXE and just issue CMD and it'll give you a command shell back from the victim computer without executing a binary. And it looks like normal Windows traffic to offset. Basically, you're getting what they should end up seeing as a successful login over the network. There are some caveats which I'll discuss later that might be red flags. So if you can execute commands of system, the possibilities are virtually limitless. So you can dump hashes from workstation or server, create volume shadow copy, run other tools of system, enable, disable UAC, bypass it. You can also check systems for DAA accounts logged in or running a process. Is that some type of sign for me or? What? I'm not fucking with anybody. You all know the drill. What does every new speaker do? So I'm Mormon. Not really. I'm a recovering Mormon. Thank you. Thank you. As you were. Let's see him get back into it now. Oh, you can't hear me? Okay. I know. All right. So is this better? All right. I apologize. Okay. So where were we at? So basically we can execute shit of system. Fuck it. We might as well. Is that the alcohol or? So we're like, holy fuck, let's get some hashes, right? You know, old school way was to get the registry keys out and do it. So let's automate that. So we wrote SMB exec to dump the hashes from workstations and servers. What it basically does is it just runs the Windows command reg exe save and it saves the registry key. So sys plus ssam is your local hashes. Everybody probably knows that. Sys plus sec is your domain cache credentials. And then we run it through cred dump which converts it into the hashes in the John format. And of course we've got a high quality hash there as well. So one of the other things that I was on a pen test somebody brought up to me was WCE. Yes, I know about Mimikatz. I know it's awesome. The integration with Metasploit is incredible. There's no political battle for me over this. It's just this was a tool I found. It's awesome. I worked with Hernin on it. He let me incorporate it into SMB exec. And WCE basically with the minus W flag will dump clear text passwords out of memory. So it took me about five lines of code to code that in. That was another reason. It was super simple. And it runs automatically as part of the hash grab functionality. If you want to turn that off you can. You just comment it out the code. So SMB exec we're like shit let's get stuff off the domain controller too while we're at it. So again I went to my friend Google and Google told me how to go out and run everything from the command line. And so what this will actually do is it will log in over 4 to 5, create a volume shadow copy. It will save off the NTDS.Dit, the sys key. When it's done it will clean up after itself. It deletes the volume shadow copy it created and it does all this. And I know there was a blog post in 2011 about this but I don't know if most people know this. There was actually a blog post in forum post back in 2005 about doing this as well. So it's been around for a while. It's there. Once everything is good it runs NTDS extracted and Libby SEDB gets the hashes up for you. It also creates a tab separated, cred list for you for other functionality within SMB exec. So let's go ahead and see a demo. So I recorded the demo so fuck it we'll do it live. Is that look all right to you guys? Let me just ‑‑ all right. So that's ‑‑ that's going to be exact. So the first thing you're going to do is you're going to just really quickly just do system enumeration, create a quick host list. And basically what it's doing is just doing a quick end map scan looking for systems with 1, 3, 9, 4, 5 open and it builds a list for you. Then we're going to go ahead and go into option 3 which is obtain hashes, work stations and servers. Please provide the username. I'm just going to spit it out here. This is Martin's password. So feel free if you see pure hate anywhere. That's how you log in as accounts. Here it's a local account. Again, thanks to Mubix local. This will give it a period or a dot which is how developers recognize local host. And then it recognizes that there was a list created so it's going to run against that. So this does take a little bit of time. You'll see. It's basically what it's doing is going out. It's authenticating. It's logging into the box, pulling down the registry keys. And then when that's done, it will basically upload my obfuscated WCE. It will run that command. It will pump it all out. So it does take a little bit. So let me go over here and get this ready. I'm just getting rid of some of the stuff here that I know comes out of it. Can everybody see that? I made the font super big. I'm a little hard up here. But I try. Is that a red card? Okay. So there we go. Right. So basically it's pretty much done. There's our local hashes. Here's our domain cache credentials. And I want to give a shout out to Royce Davis who's on our team, ready who actually updated the code. And I want to give a shout out to Royce Davis who's on our team. He's a great developer. He's a great developer. He's a great developer. He's a great developer. So I want to give a shout out to Royce Davis who's on our team, ready who actually updated the carlis's cache grab and redid it so it worked standalone. So that includes VISTA as well as non-Vista versions. And here's what I love the most. If I can spell right. Boom. Clear text passwords. Right. So if you look at that. That's 20 characters. I mean you're not going to characters. I mean, you're not going to crack that shit. There's no way. So it's awesome that you can just get out there. So here's one here, top dog, Bravo Hacks password. So I'm going to go ahead and use that one. So let's go ahead and get the domain ‑‑ go after the domain controller. So again, three, go after the domain controller. I'm going to authenticate his top dog. This was Martin's old password. And then I know that the domain controller, of course, is this. But, you know, there's simple dig commands or whatever you can look up and find it. So it asks you for the path to the NTS.Dit. You can put any drive, any path. Oh. Oh, wait a second. It helps if I give it the correct IP address. Okay. Found the NTS.Dit. Now it says where do you want to save this stuff off to, right? You can give it a different path if you want. I'm going to see leave it the same, see Windows temp. So it checks to make sure that the path provided actually exists. It checks to make sure that there's disk space. It creates a volume shadow copy. It copies those files off to your local machine, the NTS.Dit and the sys. It then deletes those files that were created. It removes the volume shadow copy that it created. And then it runs libiasdb to extract it and NTS extract to get the hashes out. And you can see it's running there. Takes a little bit. Dramatic pause here. And then success. Looks like we got what it came for. So let's make sure that's true. That's true. So there you go. That's all the hashes off the domain controller right there for you. And it was like you were never there. So I have one other surprise for you. Might not be much of a surprise. Here's the domain controller. Oops. I just spelled something wrong. Oh. That's our desktop. So let's go back to the desktop. Thank you. Thank you very much. Hey, it's Windows Server 2012. What do you know? So this is going to work for a while. All right. So hold on. Sorry. Okay. So the caveats, right? You're going to need credentials to start with. You're going to need something with local admin rights. It could be a domain account. It could be a local account. But administrator and password tends to work in nine out of the ten domains we pentest. So go ahead and do that. Of course there's NBNS spoofing. I'm partial to Ettercap. But that's just me. And of course there's always MSO8067. So when someone's actually carrying or paying attention, WinAXE actually creates a service that could be stopped or become a red flag. It actually has a binary that it does install. I believe it's either the Windows or the system 32 or one of the paths. So that could be a red flag. It could get caught. So it touches disk basically. Sometimes AV doesn't like WCE. But what I've gone ahead and done and the reason why it took a little bit longer to run was I've actually obfuscated the resource DLLs that are within the WCE binary and the WCE binary itself. So it takes an extra couple of seconds. But I'm pretty sure AV is going to have a hard time with it. And that's just part of what I release. So authentication over report 139, 445 is required. If you can't do that, this doesn't work. And then low cards exchange principle. Any contact with something is going to leave a trace. Like I said, this touches disk. This will not stand up to a forensic investigation. But I can tell you that most admins are going to look at the server and think everything is just fine. It does have a lot of logins. That's the main thing. Since it's automated, it might log in three or four times. That might look bad if they're looking for that. So where can I get SMB exact? It's out on SourceForge or GitHub under Bravo hacks. There's six modules created by Royce Davis on our AcuVont team. Two of them are in the framework. That's PSX command and NTDS grab. Impact it. It looks like they developed something in Python that was based on Royce's work. SMB exact version 2.0. Like I said, I know bash. I don't know anything else. And I don't really know bash that well. So a couple guys on our team ported it to Ruby. So it's multi-threaded. It works better. Less hiccups that come along with bash script. And that's Brandon McCann and Thomas McCarthy also from Pentesquig. So credit where credit to do. Of course WCE, her name is Shoah, SMB client and Winixy hash passing patches. Joe McCunn, Emilio Escobar, who's also the lead developer of VetterCat. Skip Duckwall, of course. Mr. Duckwall. The original vanish script. The Samba team of course, Winixy. Metasploit, HD, Egypt, everybody. Thank you so much. Appreciate it. Fedora and Map team. CredDump, NTDS extract. The list goes on and on. So basically I couldn't, SMB exact really wouldn't work without that. So I don't know if I have time for questions, but please give the hackers for charity a go buy a t-shirt or something. We love those guys. On Twitter I'm Bravo Hacks. On IRC I'm Johnny Bravo. Thank you very much. Thank you.
 How's it going? First of all, I want to say holy shit, I'm speaking at DEF CON and it's an honor.  And second of all, holy shit, people actually showed up. So thank you very much. That's an honor as well.  So I'm going to talk to you today about getting the goods with S&B Exact. And my name is Eric Milam, some people might know me as Bravo Hacks.  Thank you very much. That's the end. So, of course, don't you know who I am? I'm on the attack and pen team for AccuVant Labs with a bunch of great people.  My boy, Pure Hate, we do a lot of pen tests together. Involved with some open source projects. Maybe you guys have heard of Easycred's, S&B Exact, of course.  Ettercap, we took over Ettercap a few years ago. And involved with the Cali Linux distribution.  So what is this all about? Right? Basically we're going to go over what is S&B Exact, what does it do, why should you actually care.  There's nothing zero day here, so you can boom me if you want. But automation is awesome. This is a tool you can use immediately.  It's not some weird exploit that the sun and the moon have to line on a certain day. And it makes post exploitation much easier.  At least it has for me. So what is S&B Exact? S&B Exact is a bash script.  Because everybody who knows me knows I don't know how to code for shit. But I'm very good with the Googles.  And I just put a bunch of shit together until it works. So it's about 1,500 lines and about a million different functions.  Put it together in a week, about 100 hours worth of time, about a year's worth of Mountain Dew.  The power of the tool really lies in S&B Client to get and put files and when they exceed to execute those.  And we have patched them for hash passing. So that works as well.  So why write S&B Exact? I mean there's awesome tools out there, right?  Has anybody heard of the meta-sploits? Awesome tools. Why would you actually need this?  We were on a bunch of pen tests and we started to realize that the PSXExec module was getting popped with our payloads.  So we used the custom EXE option but that was also getting popped.  So we threw that to the community and basically Mubix, wherever Mubix is, found out real quick for us.  That basically what it was triggering on was the injection and service protection.  So fuck you Trend Micro but thanks for the motivation. We appreciate it.  So after we ran into this a few times, Pure 8 actually found a blog post by Carnal Ownage  that was basically upload and execute your payload and that's kind of where the script was born from.  So originally, right, we just wanted to get our shells.  We wanted our shells so we wrote it so it would create an obfuscated payload that would bypass most AVs.  The newer versions, you can actually enable Hyperion, Cryptor.exe and Encrypted as well.  We also had it so it would create a meta-sploit.exe file for us and launch that.  It would either launch it in X-Term or Screen depending on what you've commented out.  If it doesn't recognize X is running, it will automatically launch your text on screen.  So that's kind of where it was at.  And then we started learning a little bit more about WinEXE and we're like,  you know, hey, we can basically run native Windows commands and there's a lot of cool stuff  that we could probably end up doing. So I'm not a Windows guy so again, I went to Google  and Google told me what to do and we started realizing some of the great things that we could do with it  because what we really wanted the tool to do was to basically kind of go undetected and just look like normal  Windows traffic or normal network traffic to our victims.  So WinEXE, I don't know if anybody is familiar with it, I hope you guys are, it's awesome.  It's similar to the SysInternals PSXE modules, I'm sorry, the SysInternals PSXE tools,  and it also has a system flag. It also has an uninstall flag which is also awesome  and I'll explain those a little bit later. There's no quote unquote payload necessary.  You can basically run WinEXE and just issue CMD and it'll give you a command shell back  from the victim computer without executing a binary.  And it looks like normal Windows traffic to offset. Basically, you're getting what they should end up  seeing as a successful login over the network. There are some caveats which I'll discuss later  that might be red flags. So if you can execute commands of system,  the possibilities are virtually limitless. So you can dump hashes from workstation or server,  create volume shadow copy, run other tools of system, enable, disable UAC, bypass it.  You can also check systems for DAA accounts logged in or running a process.  Is that some type of sign for me or?  What? I'm not fucking with anybody. You all know the drill. What does every new speaker do?  So I'm Mormon. Not really. I'm a recovering Mormon.  Thank you.  Thank you.  As you were.  Let's see him get back into it now.  Oh, you can't hear me? Okay. I know.  All right. So is this better? All right. I apologize.  Okay. So where were we at? So basically we can execute shit of system. Fuck it. We might as well.  Is that the alcohol or? So we're like, holy fuck, let's get some hashes, right?  You know, old school way was to get the registry keys out and do it. So let's automate that.  So we wrote SMB exec to dump the hashes from workstations and servers.  What it basically does is it just runs the Windows command reg exe save and it saves the registry  key. So sys plus ssam is your local hashes. Everybody probably knows that. Sys plus sec is your  domain cache credentials. And then we run it through cred dump which converts it into the hashes  in the John format. And of course we've got a high quality hash there as well.  So one of the other things that I was on a pen test somebody brought up to me was WCE. Yes, I  know about Mimikatz. I know it's awesome. The integration with Metasploit is incredible.  There's no political battle for me over this. It's just this was a tool I found. It's awesome.  I worked with Hernin on it. He let me incorporate it into SMB exec. And WCE basically with  the minus W flag will dump clear text passwords out of memory. So it took me about five lines of  code to code that in. That was another reason. It was super simple. And it runs automatically as  part of the hash grab functionality. If you want to turn that off you can. You just comment  it out the code. So SMB exec we're like shit let's get stuff off the domain controller too  while we're at it. So again I went to my friend Google and Google told me how to go out and run  everything from the command line. And so what this will actually do is it will log in over 4  to 5, create a volume shadow copy. It will save off the NTDS.Dit, the sys key. When it's done it  will clean up after itself. It deletes the volume shadow copy it created and it does all this.  And I know there was a blog post in 2011 about this but I don't know if most people know this.  There was actually a blog post in forum post back in 2005 about doing this as well. So it's been  around for a while. It's there. Once everything is good it runs NTDS extracted and Libby  SEDB gets the hashes up for you. It also creates a tab separated, cred list for you for  other functionality within SMB exec. So let's go ahead and see a demo. So I recorded the demo  so fuck it we'll do it live. Is that look all right to you guys? Let me just ‑‑ all right. So  that's ‑‑ that's going to be exact. So the first thing you're going to do is you're going to  just really quickly just do system enumeration, create a quick host list. And basically what it's  doing is just doing a quick end map scan looking for systems with 1, 3, 9, 4, 5 open and it  builds a list for you. Then we're going to go ahead and go into option 3 which is obtain hashes,  work stations and servers. Please provide the username. I'm just going to spit it out here. This  is Martin's password. So feel free if you see pure hate anywhere. That's how you log in as  accounts. Here it's a local account. Again, thanks to Mubix local. This will give it a period or a  dot which is how developers recognize local host. And then it recognizes that there was a  list created so it's going to run against that. So this does take a little bit of time. You'll  see. It's basically what it's doing is going out. It's authenticating. It's logging into the box,  pulling down the registry keys. And then when that's done, it will basically upload my obfuscated  WCE. It will run that command. It will pump it all out. So it does take a little bit. So let me  go over here and get this ready.  I'm just getting rid of some of the stuff here that I know comes out of it. Can everybody see  that? I made the font super big. I'm a little hard up here. But I try. Is that a red card?  Okay. So there we go. Right. So basically it's pretty much done. There's our local hashes.  Here's our domain cache credentials. And I want to give a shout out to Royce Davis who's on  our team, ready who actually updated the code. And I want to give a shout out to Royce Davis who's  on our team. He's a great developer. He's a great developer. He's a great developer. He's a great  developer. So I want to give a shout out to Royce Davis who's on our team, ready who actually  updated the carlis's cache grab and redid it so it worked standalone. So that includes VISTA as  well as non-Vista versions. And here's what I love the most. If I can spell right. Boom. Clear  text passwords. Right. So if you look at that. That's 20 characters. I mean you're not going to  characters. I mean, you're not going to crack that shit. There's no way. So it's awesome that  you can just get out there. So here's one here, top dog, Bravo Hacks password. So I'm going to go  ahead and use that one. So let's go ahead and get the domain ‑‑ go after the domain  controller. So again, three, go after the domain controller. I'm going to authenticate his top  dog. This was Martin's old password. And then I know that the domain controller, of course, is  this. But, you know, there's simple dig commands or whatever you can look up and find it. So it  asks you for the path to the NTS.Dit. You can put any drive, any path. Oh. Oh, wait a second.  It helps if I give it the correct IP address. Okay. Found the NTS.Dit. Now it says where do you  want to save this stuff off to, right? You can give it a different path if you want. I'm going to  see leave it the same, see Windows temp. So it checks to make sure that the path provided  actually exists. It checks to make sure that there's disk space. It creates a volume shadow  copy. It copies those files off to your local machine, the NTS.Dit and the sys. It then  deletes those files that were created. It removes the volume shadow copy that it created.  And then it runs libiasdb to extract it and NTS extract to get the hashes out. And you can see  it's running there. Takes a little bit. Dramatic pause here. And then success. Looks like we  got what it came for. So let's make sure that's true. That's true. So there you go. That's all the  hashes off the domain controller right there for you. And it was like you were never there. So I  have one other surprise for you. Might not be much of a surprise. Here's the domain controller.  Oops. I just spelled something wrong. Oh. That's our desktop. So let's go back to the  desktop. Thank you. Thank you very much. Hey, it's Windows Server 2012. What do you know? So  this is going to work for a while. All right. So hold on. Sorry. Okay. So the caveats, right?  You're going to need credentials to start with. You're going to need something with local  admin rights. It could be a domain account. It could be a local account. But administrator  and password tends to work in nine out of the ten domains we pentest. So go ahead and do that.  Of course there's NBNS spoofing. I'm partial to Ettercap. But that's just me. And of course  there's always MSO8067. So when someone's actually carrying or paying attention, WinAXE  actually creates a service that could be stopped or become a red flag. It actually has a binary  that it does install. I believe it's either the Windows or the system 32 or one of the  paths. So that could be a red flag. It could get caught. So it touches disk basically. Sometimes  AV doesn't like WCE. But what I've gone ahead and done and the reason why it took a little bit  longer to run was I've actually obfuscated the resource DLLs that are within the WCE binary and  the WCE binary itself. So it takes an extra couple of seconds. But I'm pretty sure AV is going to  have a hard time with it. And that's just part of what I release. So authentication over report  139, 445 is required. If you can't do that, this doesn't work. And then low cards exchange  principle. Any contact with something is going to leave a trace. Like I said, this touches disk.  This will not stand up to a forensic investigation. But I can tell you that most admins are going  to look at the server and think everything is just fine. It does have a lot of logins. That's  the main thing. Since it's automated, it might log in three or four times. That might look bad  if they're looking for that. So where can I get SMB exact? It's out on SourceForge or GitHub  under Bravo hacks. There's six modules created by Royce Davis on our AcuVont team. Two of them  are in the framework. That's PSX command and NTDS grab. Impact it. It looks like they developed  something in Python that was based on Royce's work. SMB exact version 2.0. Like I said, I know  bash. I don't know anything else. And I don't really know bash that well. So a couple guys on  our team ported it to Ruby. So it's multi-threaded. It works better. Less hiccups that come along  with bash script. And that's Brandon McCann and Thomas McCarthy also from Pentesquig. So credit  where credit to do. Of course WCE, her name is Shoah, SMB client and Winixy hash passing patches.  Joe McCunn, Emilio Escobar, who's also the lead developer of VetterCat. Skip Duckwall, of course.  Mr. Duckwall. The original vanish script. The Samba team of course, Winixy. Metasploit, HD,  Egypt, everybody. Thank you so much. Appreciate it. Fedora and Map team. CredDump, NTDS extract.  The list goes on and on. So basically I couldn't, SMB exact really wouldn't work without that. So I  don't know if I have time for questions, but please give the hackers for charity a go buy a  t-shirt or something. We love those guys. On Twitter I'm Bravo Hacks. On IRC I'm Johnny Bravo.  Thank you very much.  Thank you.
DEF_CON_21_-_Eric_Milam_-_Getting_The_Goods_With_smbexec_dCQNFaEZkuw_0_407.png DEF_CON_21_-_Eric_Milam_-_Getting_The_Goods_With_smbexec_dCQNFaEZkuw_408_551.png DEF_CON_21_-_Eric_Milam_-_Getting_The_Goods_With_smbexec_dCQNFaEZkuw_552_2723.png DEF_CON_21_-_Eric_Milam_-_Getting_The_Goods_With_smbexec_dCQNFaEZkuw_2724_3995.png DEF_CON_21_-_Eric_Milam_-_Getting_The_Goods_With_smbexec_dCQNFaEZkuw_3996_5663.png DEF_CON_21_-_Eric_Milam_-_Getting_The_Goods_With_smbexec_dCQNFaEZkuw_5664_6119.png DEF_CON_21_-_Eric_Milam_-_Getting_The_Goods_With_smbexec_dCQNFaEZkuw_6120_6323.png DEF_CON_21_-_Eric_Milam_-_Getting_The_Goods_With_smbexec_dCQNFaEZkuw_6324_6623.png DEF_CON_21_-_Eric_Milam_-_Getting_The_Goods_With_smbexec_dCQNFaEZkuw_6624_7523.png DEF_CON_21_-_Eric_Milam_-_Getting_The_Goods_With_smbexec_dCQNFaEZkuw_7524_12023.png DEF_CON_21_-_Eric_Milam_-_Getting_The_Goods_With_smbexec_dCQNFaEZkuw_12024_16223.png DEF_CON_21_-_Eric_Milam_-_Getting_The_Goods_With_smbexec_dCQNFaEZkuw_16224_16835.png DEF_CON_21_-_Eric_Milam_-_Getting_The_Goods_With_smbexec_dCQNFaEZkuw_16836_20543.png DEF_CON_21_-_Eric_Milam_-_Getting_The_Goods_With_smbexec_dCQNFaEZkuw_20544_20795.png DEF_CON_21_-_Eric_Milam_-_Getting_The_Goods_With_smbexec_dCQNFaEZkuw_20796_21887.png DEF_CON_21_-_Eric_Milam_-_Getting_The_Goods_With_smbexec_dCQNFaEZkuw_21888_21935.png DEF_CON_21_-_Eric_Milam_-_Getting_The_Goods_With_smbexec_dCQNFaEZkuw_21936_22031.png DEF_CON_21_-_Eric_Milam_-_Getting_The_Goods_With_smbexec_dCQNFaEZkuw_22032_22127.png DEF_CON_21_-_Eric_Milam_-_Getting_The_Goods_With_smbexec_dCQNFaEZkuw_22128_22271.png DEF_CON_21_-_Eric_Milam_-_Getting_The_Goods_With_smbexec_dCQNFaEZkuw_22272_26903.png DEF_CON_21_-_Eric_Milam_-_Getting_The_Goods_With_smbexec_dCQNFaEZkuw_26904_27082.png