Uncategorized
Internet facing exposed RDP services with a weak securiy configuraiton are never a good idea. In our latest video Matthew Haynes and Daniel Card take a look at the RDP threat lanscape and then following up with a lab demo of a simple RDP brute force attack.
You can see the video here on our youtube channel! Remember to like and subscribe! Stay safe!
Defense
Active directory sits at the heart of most organisations and would be considered a crown jewel information system. Here we take a whirlwind tour of deploying and running Ping Castle, an active directory auditing and assessment tool.
Read more “Security Awareness Week – AD Audits using Ping Castle”
Defense
When a post starts like this:
“On May 14, Microsoft released fixes for a critical Remote Code Execution vulnerability, CVE-2019-0708, in Remote Desktop Services – formerly known as Terminal Services – that affects some older versions of Windows. In our previous blog post on this topic we warned that the vulnerability is ‘wormable’, and that future malware that exploits this vulnerability could propagate from vulnerable computer to vulnerable computer in a similar way as the WannaCry malware spread across the globe in 2017.” – https://blogs.technet.microsoft.com/msrc/2019/05/30/a-reminder-to-update-your-systems-to-prevent-a-worm/
“Microsoft is confident that an exploit exists for this vulnerability” Read more “CVE-2019-0708 – BlueKeep”
Defense
‘Red Teaming’ the latest phrase in the cyber security world that brings a shudder down my spine! Now don’t get me wrong, adversary simulation is awesome, it’s a great tool and when wielded correctly brings massive value to enhancing your security posture… but alas, they aren’t always deployed in a business aligned and value driven position.
They sound ‘sexy’ and any pentester is going to jump at the chance to do one, let alone the sales and marketing teams will be grinning as they will come in with higher revenue but also will increase their case study portfolio for delivered red teams! (I’m not knocking this, it’s the reality of doing business).
Having witnessed a number of these take place against organizations who I don’t feel are ready for them, I thought I would write a piece on things I would recommend having in place before conducting a ‘red team’ assessment. Read more “Things to do before you conduct a ‘red team’ assessment”
Guides
Those who know me know that I not only practise offensive security techniques from a business perspective, I also play in a CTF team and build PwnDefend CTF challenges. I came up with the idea of doing a red and blue team CTF sometime in 2018 however this isn’t as easy to build and run as you would think. Anyway, I digress… as part of my research and personal development I like to test out other platforms and pwn a few things so I thought I’d do a quick write up of the Pentester Academy Attack Defense labs Web Application Broken Authentication challenge. Spoiler alert.. I spoil this one (but it’s easy so don’t cry too hard!) Read more “Pentester Academy Attack Defense Labs – Web Application: Broken Authentication”
Defense
So, you have deployed Office 365, you’ve setup multi-factor authentication and deployed password managers so that your users can safely use MFA where it is supported but fall back to app passwords where it’s not. Great stuff… except by default you aren’t quite as secure as you would think!
Default Office365/Exchange Online Config
Now this is great for HTTP based communication methods. but email isn’t restricted to HTTP only. When we investigate the default deployment configuration we see that IMAP and POP3 are both enabled. The below screenshot shows the default mailbox feature configuration:
Now as we know, both IMAP and POP3 do not support a second or multi-factor authentication by default, so in the GUI you should disable those (unless you have a really specific business reason that means you MUST use these) Read more “Defending Office 365 against MFA bypass using IMAP”
Defense
Ok in this scenario we care going assume SQL login credentials (sqluser) are exposed and that firewall rules are wide (so we have layer 3 connectivity to the target).
We have loaded Metasploit and will be using the msssql_enum modue
Now that we have configured our target options we can run the module:
Guides
Covenant is a .NET c2 (Command & Control) Framework that aims to highlight the attack surface of .NET and aid red teamers! Today I’m going to jump into slip space with a Halo themed blog on my first use of Covenant in the lab. Let’s hope I don’t need Cortana to get this deployed (yes I’m a massive Halo nerd!)
First thing let’s head over to GitHub and check out the install notes:
The architecture seems to look like this:
Read more “Owning the Covenant like a Chief! – C2 Framework Review”
Defense
I was on Twitter the other day (when am I not? 😉) and a post caught me eye, an industry friend’s post caught my eye, challenging the audience to identify their location (specifically which station they are at!), this I thought might be a cool challenge. The first post below is from Paul (Gaming Works) which gives a limited amount of information and a nice image:
Read more “Using Open Source Intelligence in cool and scary ways”
Defense
Well with the year winding down you’ve probably seen that Microsoft just released an out of band security patch:
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2018-8653
CVE-2018-8653 is described as:
“A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website, for example, by sending an email.”
Read more “Happy Bugmass 2019! Critical vulnerability patched”
