BaffledJimmy

Links for this post: Puppet 101 Puppet is a configuration management tool that makes use of a client-server relationship. Each managed endpoint has a puppet-agent that communicates through SSL back to a Puppet master / PuppetServer. Settings and configuration come together and are server by PuppetServer to form a catalog, which is what the Puppet-Agent applies to the managed host. There has apparently been some issues in the open source community with Puppet seeming to reduce support for the fully…

Read More Read More

I’ve been looking at the public version of PoshC2 and how easy it can be to detect, yet it is still exceptionally successful at bypassing a significant number of so-called EDRs and AVs – even more so if the execution method is fairly good – GadgettoJS is still undetected by a lot of AV solutions. I should probably highlight I am absolutely not a malware analyst, but if I can find these obvious IOCs in two or so hours, hopefully…

Read More Read More

TLDR TLDR: Consider adopting some of the JSOC communication rules for your organisations, and empower your highly skilled staff to communicate across the enterprise and make potentially disruptive decisions to prevent the situation worsening. Your organisation hired them for a reason, so trust them to make decisions without micromanagement. Your existing organisational processes are unlikely to be well suited to a fast-moving cyber incident unless you have an ongoing programme of real-world exercising and purple teaming and have worked through…

Read More Read More

Note: If anyone knows of a better / simpler / suited to automation / more lightweight solution to this problem please let me know @BaffledJimmy! Why Modern enterprises are complex beasts, with shadow IT, unruly configuration management and hybrid cloud deployments being business as usual. Throughout a red team engagement, it is difficult to maintain operational safety and security, whilst also maximising your visibility of the target environment and ensuring that your phishes, weaponised artifacts and communications channels are appropriately…

Read More Read More

Large organisations are now including Splunk as part of their monitoring suite, but a significant number are not securing their installations properly.  Organisations either use plaintext protocols for the web based control panel, or do not activate the anti-brute force protections within the Splunk user control panel.  Splunk is also capable of using Active Directory based authentication, which may link into other administrative credential management such as CyberArk. I’m going to run through a demonstration of how one poorly configured…

Read More Read More

Many organisations make use of the Cisco ASA series of devices to provide their users with VPN connectivity. Usually it is configured through an ASA management application and users connect using the Cisco AnyConnect VPN Client.  There are a myriad of ways to provide authentication, with Google Authenticator, machine certificates and Active Directory integration being the most common. Organisations often then direct their users to a URL such as https://vpn.organisation.com which will prompt them to download the latest version of…

Read More Read More

I have a thing for abusing sysadmin tools and trying to live off the land as much as possible.  This post discusses the possibility of a management host being compromised, and an entire estate being affected very quickly.  Less ethical people could even create an Ansible playbook to start crypto mining or similar, but this post will focus on pentest persistence through various methods. This post actually grew out the work I was doing to automate C2 infrastructure using Terraform…

Read More Read More

I recently attended the 7 Day Boot Camp from Firebrand UK.  Over here, Firebrand have a reputation for being quite pricey which puts a lot of budget managers off when they see the headline figure.  However, you get what you pay for and I would recommend them for your organisation’s training.  They also do a Firebrand Passport which can give you pretty large discounts when you buy blocks of training upfront – ideal for larger organisations or those with a…

Read More Read More

We tend to spend a lot of time stuck in hotel rooms or data centres, crunched over a computer.  Coupled with a swanky expenses policy can mean a rapidly expanding waistline and poor CV health.  Plenty of research exists to suggest that this is a ‘BAD THING’. This quick workout is something that you can adapt and add to as you get fitter or more robust.  You don’t need anything apart from time to complete this workout, however if you…

Read More Read More