BaffledJimmy

Reading Time: 12 minutesChecklists, Crew Resource Management, and Red Teaming Introduction – The Why Commercial aviation transformed itself from a high-risk industry into one of the safest in the world. That success came not from technology alone but from a deliberate cultural shift. Three innovations stand out: the disciplined use of checklists, a culture of relentless pursuit of excellence and continuous improvement in a no-blame culture, and the adoption of Crew Resource Management (CRM), which reshaped how teams communicate and make decisions under…

Read More Read More

Reading Time: 5 minutesRepo Link: Link Introduction PingCastle is one of the most well known tools for monitoring the security of your Active Directory domain. There is plenty of documentation around for it and is one of the quickest ways of prioritising quick win security improvements. There are various licence levels, but the Free version is the one we are focusing on currently. A recurring issue is that organisations run PingCastle on an irregular basis (often run via a third party consultancy), but…

Read More Read More

Reading Time: 21 minutesLinks for this post: Puppet 101 Puppet is a configuration management tool that makes use of a client-server relationship. Each managed endpoint has a puppet-agent that communicates through SSL back to a Puppet master / PuppetServer. Settings and configuration come together and are server by PuppetServer to form a catalog, which is what the Puppet-Agent applies to the managed host. There has apparently been some issues in the open source community with Puppet seeming to reduce support for the fully…

Read More Read More

Reading Time: 5 minutesI’ve been looking at the public version of PoshC2 and how easy it can be to detect, yet it is still exceptionally successful at bypassing a significant number of so-called EDRs and AVs – even more so if the execution method is fairly good – GadgettoJS is still undetected by a lot of AV solutions. I should probably highlight I am absolutely not a malware analyst, but if I can find these obvious IOCs in two or so hours, hopefully…

Read More Read More

Reading Time: 9 minutesTLDR TLDR: Consider adopting some of the JSOC communication rules for your organisations, and empower your highly skilled staff to communicate across the enterprise and make potentially disruptive decisions to prevent the situation worsening. Your organisation hired them for a reason, so trust them to make decisions without micromanagement. Your existing organisational processes are unlikely to be well suited to a fast-moving cyber incident unless you have an ongoing programme of real-world exercising and purple teaming and have worked through…

Read More Read More

Reading Time: 14 minutesNote: If anyone knows of a better / simpler / suited to automation / more lightweight solution to this problem please let me know @BaffledJimmy! Why Modern enterprises are complex beasts, with shadow IT, unruly configuration management and hybrid cloud deployments being business as usual. Throughout a red team engagement, it is difficult to maintain operational safety and security, whilst also maximising your visibility of the target environment and ensuring that your phishes, weaponised artifacts and communications channels are appropriately…

Read More Read More

Reading Time: 6 minutesLarge organisations are now including Splunk as part of their monitoring suite, but a significant number are not securing their installations properly.  Organisations either use plaintext protocols for the web based control panel, or do not activate the anti-brute force protections within the Splunk user control panel.  Splunk is also capable of using Active Directory based authentication, which may link into other administrative credential management such as CyberArk. I’m going to run through a demonstration of how one poorly configured…

Read More Read More

Reading Time: 3 minutesMany organisations make use of the Cisco ASA series of devices to provide their users with VPN connectivity. Usually it is configured through an ASA management application and users connect using the Cisco AnyConnect VPN Client.  There are a myriad of ways to provide authentication, with Google Authenticator, machine certificates and Active Directory integration being the most common. Organisations often then direct their users to a URL such as https://vpn.organisation.com which will prompt them to download the latest version of…

Read More Read More

Reading Time: 5 minutesI have a thing for abusing sysadmin tools and trying to live off the land as much as possible.  This post discusses the possibility of a management host being compromised, and an entire estate being affected very quickly.  Less ethical people could even create an Ansible playbook to start crypto mining or similar, but this post will focus on pentest persistence through various methods. This post actually grew out the work I was doing to automate C2 infrastructure using Terraform…

Read More Read More