Person
person:tinker_secor
Also: Tinker, TinkerSec
Penetration tester and Red Teamer featured in the episode.
Penetration tester and Red Teamer featured in the episode.
“My name is Tinker Secor. I am a penetration tester or Red Teamer”
“His name there is @TinkerSec.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | ASSOCIATED_WITH | penetration testing | Explicit | 36 |
| outgoing | ASSOCIATED_WITH | Red Team | Explicit | 36 |
| outgoing | MEMBER_OF | United States Marine Corps | Explicit | 36 |
| outgoing | USES | Reconnaissance | Explicit | 36 |
| outgoing | USES | lateral movement | Explicit | 36 |
| outgoing | USES | privilege escalation | Explicit | 36 |
| outgoing | USES | exfiltration | Explicit | 36 |
| outgoing | USES | persistence | Explicit | 36 |
| outgoing | USES | Kali Linux | Explicit | 36 |
| outgoing | USES | Ubuntu | Explicit | 36 |
| outgoing | USES | Wireshark | Explicit | 36 |
| outgoing | USES | Responder | Explicit | 36 |
| outgoing | USES | Net-NTLMv2 | Explicit | 36 |
| outgoing | USES | GPU password-cracking rig | Explicit | 36 |
| outgoing | USES | Nvidia GTX 1080 Ti | Explicit | 36 |
| outgoing | USES | Hashcat | Explicit | 36 |
| outgoing | USES | brute-force password cracking | Explicit | 36 |
| outgoing | USES | password spraying | Explicit | 36 |
| outgoing | USES | Active Directory | Explicit | 36 |
| outgoing | USES | SYSVOL | Explicit | 36 |
| outgoing | USES | single sign-on | Explicit | 36 |
| outgoing | USES | Citrix | Explicit | 36 |
| outgoing | USES | social engineering | Explicit | 36 |
| outgoing | USES | physical intrusion | Explicit | 36 |
| outgoing | USES | pass the hash | Explicit | 36 |
| outgoing | EXPLOITS | unquoted service path | Explicit | 36 |
| outgoing | USES | PowerShell | Explicit | 36 |
| outgoing | USES | reverse shell | Explicit | 36 |
| outgoing | USES | Veil | Uncertain | 36 |
| outgoing | USES | Metasploit | Explicit | 36 |
| outgoing | USES | Meterpreter | Explicit | 36 |
Tinker Secor ASSOCIATED_WITH penetration testing
Tinker identifies himself as a penetration tester who tests clients' security by hacking computers and breaking into buildings.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I am a penetration tester or Red Teamer”
Tinker Secor ASSOCIATED_WITH Red Team
Tinker says he is a Red Teamer depending on the engagement.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I am a penetration tester or Red Teamer”
Tinker Secor MEMBER_OF United States Marine Corps
Tinker says he used to be a Sergeant in the Marine Corps.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I used to be a Sergeant in the Marine Corps”
Tinker Secor USES Reconnaissance
Tinker describes password, active, and environmental reconnaissance as part of his standard approach.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“Get in and do password reconnaissance, active reconnaissance”
Tinker Secor USES lateral movement
Tinker includes lateral movement in his standard penetration-testing approach and later says he needs to move onto servers.
Explicit Confidence 98% · Tinker Secor EP 36 Details
“initial breach, lateral movement, pivot”
Tinker Secor USES privilege escalation
Tinker includes privilege escalation in his standard approach and attempts to escalate to system level.
Explicit Confidence 98% · Tinker Secor EP 36 Details
“escalation privileges, actions and target”
Tinker Secor USES exfiltration
Tinker lists exfiltration as a possible phase of his penetration-testing methodology.
Explicit Confidence 95% · Tinker Secor EP 36 Details
“exfiltration, and persistence may be in there if you need to”
Tinker Secor USES persistence
Tinker lists persistence as a possible phase of his methodology and later says he obtained persistence on a finance computer.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I get persistence”
Tinker Secor USES Kali Linux
Tinker brought a Kali image on USB and had Kali virtual machines on his rogue laptop.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“a Kali image burnt on a USB”
“loaded with Ubuntu as a base image with some Kali VMs”
Tinker Secor USES Ubuntu
Tinker says his personal hacking laptop used Ubuntu as its base image.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“loaded with Ubuntu as a base image”
Tinker Secor USES Wireshark
Tinker used Wireshark to sniff packets and identify hardware and host naming patterns.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“the first thing I did is run Wireshark”
“started trapping a lot of – sniffing a lot of the packets”
Tinker Secor USES Responder
Tinker ran Responder to induce systems on the local subnet to disclose Net-NTLM authentication hashes.
Explicit Confidence 99% · Jack Rhysider EP 36 Details
“The next day he comes in, fires up Responder”
“I will run Responder twice a day”
Tinker Secor USES Net-NTLMv2
Tinker collected Net-NTLMv2 hashes from Responder activity.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I pulled down these hashes. Again, they’re Net-NTLMv2 hashes.”
Tinker Secor USES GPU password-cracking rig
Tinker used an offsite GPU password-cracking rig to process hashes collected with Responder.
Explicit Confidence 99% · Jack Rhysider EP 36 Details
“He loads these up into his GPU password-cracking rig”
Tinker Secor USES Nvidia GTX 1080 Ti
Tinker's password-cracking rig consisted of eight Nvidia GTX 1080 Ti cards.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“It was eight Nvidia GTX 1080 TIs mounted in a 4U Rack server.”
Tinker Secor USES Hashcat
Tinker used Hashcat to try billions of password guesses against captured hashes.
Explicit Confidence 99% · Jack Rhysider EP 36 Details
“Then he runs a tool called Hashcat to cycle through billions of passwords”
Tinker Secor USES brute-force password cracking
Tinker used brute-force password cracking against captured authentication hashes.
Explicit Confidence 99% · Jack Rhysider EP 36 Details
“This is brute force password-cracking.”
Tinker Secor USES password spraying
Tinker performed a targeted password spray against workstations using recovered usernames and passwords.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I do a very targeted spray with their username and their password against all of it.”
Tinker Secor USES Active Directory
Tinker queried Active Directory and later extracted users, groups, host names, and other domain information.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I logged into SYSVOL on the main controller, pulled all of Active Directory.”
Tinker Secor USES SYSVOL
Tinker used a stolen user's credentials to access SYSVOL and retrieve domain scripts and configuration information.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I logged into SYSVOL on the main controller”
“You can mount SYSVOL and get all the group post preference.”
Tinker Secor USES single sign-on
Tinker accessed the company's single sign-on environment using recovered credentials and investigated its applications.
Explicit Confidence 98% · Tinker Secor EP 36 Details
“Get into their single sign-on, their internet.”
Tinker Secor USES Citrix
Tinker targeted Citrix because he expected it to provide access to hosted internal applications or servers.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“One thing caught my eye though, in the single sign-on, was Citrix.”
Tinker Secor USES social engineering
Tinker impersonated IT over the phone to persuade an employee to disclose a Citrix MFA code.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I lie to them and then I say hey, I’m somebody else from IT”
“She read it to me. I typed it in within the minute”
Tinker Secor USES physical intrusion
Tinker physically entered the IT room after finding its door propped open and removed laptops for testing.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I walk in real quick and I see stacks and stacks of laptops.”
“I start taking armloads, like full handfuls of these laptops to my cubicle”
Tinker Secor USES pass the hash
Tinker attempted to authenticate to other computers using the recovered local administrator hash.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“First thing I try to do is pass the hash which just uses the actual hash as a password.”
Tinker Secor EXPLOITS unquoted service path
Tinker found an unquoted service path and attempted to use it to execute a malicious program with system privileges.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“the one that worked was unquoted service path”
“it will run your program as in this sense, system”
Tinker Secor USES PowerShell
Tinker used PowerShell in a reverse-shell payload delivered to another workstation.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“He wrote an executable that will then call my PowerShell, reverse shell.”
Tinker Secor USES reverse shell
Tinker deployed a PowerShell reverse shell to obtain remote access to a finance workstation.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“my PowerShell, reverse shell”
“I’ve got a little thumb drive with my malware on it”
Tinker Secor USES Veil
Tinker says the PowerShell remote-shell payload was a tweaked version of Veil or a similar PowerShell tool.
Uncertain Confidence 90% · Tinker Secor EP 36 Details
“I think it was just a tweaked version of Veil or some sort of PowerShell, remote shell.”
Tinker Secor USES Metasploit
Tinker used Metasploit to listen for and manage the reverse-shell connection from the compromised finance computer.
Explicit Confidence 99% · Jack Rhysider EP 36 Details
“He pulls Metasploit up and waits and watches.”
Tinker Secor USES Meterpreter
Tinker's payload opened multiple Meterpreter sessions on the finance computer.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“Then I see Meterpreter Session Two, Session Three, Session – it popped eight shells.”