Defense
Ok so the other day “we” as a community put out some guidance around post active directory compromise actions for when you can’t simply nuke the forest from orbit. Well, following on from that a friend asked about how to restore AdminSDHolder permissions? Read more “How to restore AdminSDHolder Object Permissions using ADSIedit”
Defense
Undertsanding the current state of cyber capability maturity across an organisation is no simple feat. The team at NCSC have created a really good set of guidance with CAF. With all things there’s different ways on consuming, understanding and leveraging good practises.
I often find have XLS workbooks incredibly valuable when looking at indicators of good practise inside organisations. With this in mind, I started to put the GAF indicators into a workbook. This isn’t complete yet. It needs refactoring so it can be pivoted etc. It also needs some parts added for metadata capture and analysis.
I’m publishing this because sitting collecting virtual dust is probably the least valuable thing that can occur.
Hopefully this is helpful to people, even in it’s current half baked state. I’ll and complete this at some point!
Read more “CAF Workbook”
Threat Intel
Ok so the situation is as per usual a bit fluid, when this first dropped I was looking at this with a “azure” lense, however as time goes on it appears this likely also covers any Linux distro with the Azure/SCOM/OMS agents installed. This may change the profile of risk considerable, not only from a public facing attack surafce but highly likely from a lateral movement persspective. I’m going to keep updating this as more intel comes in. (sorry I’d be clearer if I had a clearer picture myself)
This week 4 vulnerabilities were disclosed which affect Azure virtual machines running the Open Management Infrastructure (OMI) agent (think PowerShell remoting). As above the scope seems to be slightly wider with regard to SCOM/AZURE and OMS/Sentinel etc. agents for Linux (I want to confirm all of this but for now it seems this is the position)
Essentially these vulnerabilities allow for both network-based remove code execution (RCE) and local privilege escalation (LPE).
Read more “CVE-2021-38647 – Open Management Infrastructure (OMI) RCE – Linux hosts”
CTF
Ok today we are going to look at deploying Kali 2013.3. The install process for this is fairly standard and familiar from previous version but for those new to this world, it seems like a good place to start.
Boot from the ISO
Guides
Ok so this topic comes up a fair bit, but organisations and their management are often looking to ensure they are doing the right thing (no really this is a common phrase I hear with organisations) with regard to cyber security. THe challenge I think quite a few people have is even understanding what that even means. Sure you have a firewall, and antivirus and you had a yearly peneration test of a site that isn’t even touching your corproate network. You thought you were fine, but you keep seeing organisations get ransomared in the news and the board keep asking “are we ok?” so this then leads to a common position of maybe buying more widgets or thinking, well we haven’t been “hacked” so we must be doing ok.
Read more “What if not everyone is a cyber expert?”
Defense
Vulnerability Management, Assessments and Vulnerability scanning is sometimes treated a with distain in the Offensive security community, I personally don’t understand that. Vulnerability management is key to inputting into security strategy, architecture, and operations. It’s coupled heavily to many other processes such as:
Before we start deploying let’s think about some areas for consideration when performing vulnerability scans:
CTF
If we have high privilege access to a domain, we will likely want to establish persistence with high privilege access. One mechanism to do this is to assign ourselves permissions to the adminSDHolder object in active directory:
Here we have the default adminSDHolder permissions. We are going to add our user “low” in here with modify or full control permissions: Read more “Abusing AdminSDHolder to enable a Domain Backdoor”
CTF
Some hashes are obvious but even then, it’s a good job to check. There are a few ways to check a hash outside of manual validation.
Using the Hashcat example list:
https://hashcat.net/wiki/doku.php?id=example_hashes
Using hash-identifier:
https://github.com/blackploit/hash-identifier
Using cyberchef Analyse hash:
https://gchq.github.io/CyberChef/#recipe=Analyse_hash()
Using hash-id:
https://github.com/psypanda/hashID
Using HashTag:
https://github.com/SmeegeSec/HashTag
As you can see there are range of tools available to you, and remember if you want to keep the hashes to yourself you can download Cyberchef and run it locally!
Guides
This is a super-fast blog to show how to crack sshkeys with JohnTheRipper from Kali VM.
Create a key
ssh-keygen Read more “Cracking an SSH key with John the Ripper (JTR)”
Defense
Have you ever wanted to see what would occur in an environment if a worm was a make its way in? I often work with customers to show them about lateral movement from a human operated perspective however sometimes it’s useful for people to visualise this better and to demonstrate what could occur if a worm was set loose. A great tool to help with this is Infection Monkey from Guardicore (https://www.guardicore.com/
The process steps are as follows:
