Published | JUMPSEC LABS

TokenSmith – Bypassing Intune Compliant Device Conditional Access

by Sunny Chau | Dec 20, 2024 | Azure Cloud, burpsuite, Cloud Red Team, Initial Access, Red Teaming

Conditional Access Policies (CAPs) are the core of Entra ID’s perimeter defense for the vast majority of Enterprise Microsoft 365 (M365) and Azure environments. The core ideas of conditional access are: Require specific auth strength in scenarios where you wish to grant access Block access in undesirable scenarios If a scenario are neither covered by a or b, then the minimal auth strength (password) would be sufficient A special condition for CAP requirements is that authentication can be required to come from an “Intune Compliant” device (also known as “company managed” to the user), otherwise the authentication would be unsuccessful. In our adversarial engagements, more hardened M365 environments often have this requirement for a large subset of cloud apps used by the company, making running post-exploitation Entra ID tools like GraphRunner, RoadRecon, Teamfiltration, etc. difficult....

BCP, as easy as ABC?

A Business Continuity Plan (BCP) is a strategic playbook created to help an organisation maintain or quickly resume business functions in the face of disruption. (Pratt, Tittel,...

Weaponize Your Word – Malicious Template Injection

Weaponize Your Word - Malicious Template Injection Historically, files sent via email have been a common initial access technique employed by threat actors. Personally, I have...

Breaking into Libraries – DLL Hijacking

by Patryk Zajdel | Oct 24, 2024 | Red Teaming, Windows

Breaking into Libraries - DLL Hijacking Many of us have likely encountered DLL errors when trying to open Windows applications. If you were like my younger self, you might have naively downloaded a missing DLL from sites like dll-files.com and placed it in the application directory without giving it a second thought. This blog post will examine the risks associated with this approach. Dynamic...

Active Cyber Defence – Taking back control

by Umair Qamar | Oct 15, 2024 | Detection, Incident Response

Every good cybersecurity article needs a Sun Tzu quote, here is one lesser known quote from Sun Tzu to start us off. What Happened? Recently, JUMPSEC’s Detection and Response Team (DART) caught a Red Team inside one of our MxDR clients' networks using a honeypot server. The honeypot server was set up using Thinkst Applied Research’s project called OpenCanary. This open-source project...

NTLM Relaying – Making the Old New Again

by David Kennedy | Sep 17, 2024 | Red Teaming

I am old enough to remember that it was not always possible to get domain admin within the first hour of a test via Active Directory Certificate Services (ADCS) misconfigurations or over permissioned SCCM NAA accounts. At present we are spoilt for choice in regards to privilege escalation vectors within the on-premise AD environment's, but I wanted to take a look at some of the other...

Building Forensic Expertise: A Two-Part Guide to Investigating a Malicious USB Device (Part 2)

by Emilia Chau, Marin Gheorge, Muhammad Jawad | Sep 11, 2024 | Forensics, Incident Response

In this part 2, we'll walk you through the step-by-step process of setting up and conducting a Digital Forensics and Incident Response (DFIR) investigation using a virtual machine (VM). We’ll cover everything from configuring the VM to ensure it’s completely isolated to tackling the challenges of USB passthrough with a write blocker. You'll also learn about the risks of using public threat...

Building Forensic Expertise: A Two-Part Guide to Investigating a Malicious USB Device (Part 1)

by Emilia Chau, Marin Gheorge, Muhammad Jawad | Aug 28, 2024 | Forensics, Incident Response

JUMPSEC believes heavily in learning and developing through real world experience. The incident described in this blog post presented a fantastic opportunity for 3 junior team members to learn first hand how to conduct, report and respond to an incident investigation. This blog post is split into two parts: Part I focuses on the prerequisites and preparation work done before kicking off the...

Adversary at the Door – Initial Access and what’s currently on the menu

by Patryk Zajdel | Aug 20, 2024 | Initial Access, Red Teaming

Based on the data from the Cyber Security Breaches Survey 2024, phishing with malicious links or malware remains the most common initial access vector, followed by impersonation. The challenge with impersonation attacks is that current technology often struggles to accurately determine the purpose of a website. Although checks on domain maturity, reputation, categorization, and certificates are...

SSH Tunnelling to Punch Through Corporate Firewalls – Updated take on one of the oldest LOLBINs

by Sunny Chau | Aug 13, 2024 | Adversary Infrastructure, Initial Access, Red Teaming

In my formative days of learning network hacking, SSH tunnelling was amongst the first tunnelling techniques that I learnt. I still remember trying to repeatedly decode my notes and diagrams on the rather cumbersome syntax of single port forwarding with the -L and -R flags, which at the time was taught as “the way to do it”. If your foothold is (luckily) a Linux server, then you’re blessed with...

How to Handle Development Projects in a Pentest Company

by Bjoern Schwabe | Aug 6, 2024 | Jumpsec, Research

If you are a pentester you probably never really think about programming. Instead you are testing what others have developed. However, every now and then a quick python or bash script is needed to exploit some stuff you have found, or automate a certain process you are using. Things become interesting when you are in a penetration testing company that has many strong penetration testers and...

« Older Entries

JUMPSEC LABS

TokenSmith – Bypassing Intune Compliant Device Conditional Access

BCP, as easy as ABC?

Weaponize Your Word – Malicious Template Injection

Breaking into Libraries – DLL Hijacking

Active Cyber Defence – Taking back control

NTLM Relaying – Making the Old New Again

Building Forensic Expertise: A Two-Part Guide to Investigating a Malicious USB Device (Part 2)

Building Forensic Expertise: A Two-Part Guide to Investigating a Malicious USB Device (Part 1)

Adversary at the Door – Initial Access and what’s currently on the menu

SSH Tunnelling to Punch Through Corporate Firewalls – Updated take on one of the oldest LOLBINs

How to Handle Development Projects in a Pentest Company

[Latest Posts]

[Categories]

GitHub Activity

Twitter

Latest from JUMPSEC

Disclaimer