Published | JUMPSEC LABS

Hunting for ‘Snake’

by Ryan Saridar + Francesco Iulio | May 26, 2023 | Detection, Jumpsec

Following the NCSC and CISA’s detailed joint advisory on the highly sophisticated ‘Snake’ cyber espionage tool, JUMPSEC threat intelligence analysts have provided a condensed blueprint for organisations to start proactively hunting for Snake within their network, contextualising key Indicators of Compromise (IoC), and providing additional methods to validate the effectiveness of Snake detections. Snake’s capabilities The implant dubbed ‘Snake’ has been attributed to Centre 16 of Russia’s state sponsored FSB. The tool has been collecting intelligence in over 50 countries for up to 20 years, targeting research facilities, government networks, financial services, communications organisations, and other Critical National Infrastructure (CNI) organisations, meaning these organisations should be particularly vigilant and take precautionary steps to protect their networks. Described by CISA...

Advisory CVE-2023-30382 – Half-Life Local Privilege Escalation

Software: Half-Life Affected versions: Latest (<= build 5433873), at the time of writing Vendor page: www.valvesoftware.com CVE Reference: CVE-2023-30382 Published: 23/05/2023...

Butting Heads with a Threat Actor on an Engagement

After compromising a sensitive external server JUMPSEC’s Red Team found that they were not the first ones there…

Advisory CVE-2022-37832 – Mutiny Network Monitoring Appliance hardcoded credentials

by Ryan Saridar + Francesco Iulio | Dec 15, 2022 | Jumpsec, Vulnerability

Software: Mutiny Network Monitoring Appliance Affected versions: <= 7.2.0-10855 Vendor page: www.mutiny.com CVE Reference: CVE-2022-37832 Published: 16/12/2022 CVSS 3.1 Score: 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Attack Vector: Network Credit: Ryan Saridar Summary An attacker can log in as root remotely to the appliance via SSH. Mitigation Upgrade to version 7.2.0-10855 onwards to...

Online Machine Learning: how to integrate user feedback

by Newt Tan | Dec 12, 2022 | Research

When designing and implementing a machine learning model, ensuring it is continually updated is a challenge that all engineers encounter. In this article, I explore the online machine learning technique that I used during a project and present how it was implemented for effective results. Choosing a machine learning method Machine learning solutions can be mainly split into offline and...

Implementation and Dynamic Generation for Tasks in Apache Airflow

by Newt Tan | Nov 23, 2022 | Detection, Research

I recently worked on a project focused on log anomaly detection using manageable machine learning pipelines. The pipelines mainly include data collection --- feature extraction --- feature engineering --- detection/prediction --- updating (maintenance). It’s important to have a solid UI to manage the pipelines so I can easily review the chain of pipelines. After much research, I found many...

QUEST KACE Desktop Authority Pre-Auth Remote Code Execution (CVE-2021-44031)

by tellson | Sep 8, 2022 | Uncategorized

Software: QUEST KACE Desktop AuthorityAffected Versions: 11.1 and earlier. Vendor page: https://www.quest.com/products/kace-desktop-authority/CVE Reference: CVE-2021-44031Published: 19/11/2021CVSS 3.1 Score: 9.8 CriticalAttack Vector: Pre-authenticated Remote Code ExecutionCredits: Tom Ellson JUMPSEC recently discovered multiple vulnerabilities in Quest KACE Desktop Authority 11.1. This is an...

Abusing SharedUserData For Defense Evasion and Exploitation

by jordanjay | Aug 11, 2022 | Uncategorized

Over the past few weeks, I have been working on a custom packer in my spare time. In doing so, I needed to create a method of delaying execution within the unpacker stub that didn’t use any pre-defined functions. This post documents what I discovered during this project as well as some future plans I have for this method. What is SharedUserData and Why does it exist?_KUSER_SHARED_DATA...

(ZOHO) ManageEngine Desktop Central – Path Traversal / Arbitrary File Write

by tellson | Aug 2, 2022 | Uncategorized

Software: Zoho ManageEngine Desktop CentralAffected Versions: Before 10.0.662Vendor page: https://www.manageengine.com/products/desktop-central/vulnerabilities-in-reports-module.htmlCVE Reference: CVE-2021-46165 & CVE-2021-46166Published: 09/01/2022CVSS 3.1 Score: 8.8 HighAttack Vector: SQL Injection / Arbitrary File WriteCredits: Tom Ellson This is the second post in our two part series on...

(ZOHO) ManageEngine Desktop Central – SQL Injection / Arbitrary File Write

by tellson | Aug 2, 2022 | Uncategorized

Software: Zoho ManageEngine Desktop CentralAffected Versions: Before 10.0.662Vendor page: https://www.manageengine.com/products/desktop-central/vulnerabilities-in-reports-module.htmlCVE Reference: CVE-2021-46164Published: 09/01/2022CVSS 3.1 Score: 8.8 HighAttack Vector: SQL Injection / Arbitrary File WriteCredits: Tom Ellson This is the first post in a two part series on Manage Engine Desktop...

Azure – Securing Shared Access Signatures (SAS)

by tellson | Jul 14, 2022 | Uncategorized

« Older Entries

JUMPSEC LABS

Hunting for ‘Snake’

Advisory CVE-2023-30382 – Half-Life Local Privilege Escalation

Butting Heads with a Threat Actor on an Engagement

Advisory CVE-2022-37832 – Mutiny Network Monitoring Appliance hardcoded credentials

Online Machine Learning: how to integrate user feedback

Implementation and Dynamic Generation for Tasks in Apache Airflow

QUEST KACE Desktop Authority Pre-Auth Remote Code Execution (CVE-2021-44031)

Abusing SharedUserData For Defense Evasion and Exploitation

(ZOHO) ManageEngine Desktop Central – Path Traversal / Arbitrary File Write

(ZOHO) ManageEngine Desktop Central – SQL Injection / Arbitrary File Write

Azure – Securing Shared Access Signatures (SAS)

[Latest Posts]

[Categories]

GitHub Activity

Twitter

Latest from JUMPSEC

Disclaimer