Jumpsec Archives | JUMPSEC LABS

How to Handle Development Projects in a Pentest Company

by Bjoern Schwabe | Aug 6, 2024 | Jumpsec, Research

If you are a pentester you probably never really think about programming. Instead you are testing what others have developed. However, every now and then a quick python or bash script is needed to exploit some stuff you have found, or automate a certain process you are using. Things become interesting when you are in a penetration testing company that has many strong penetration testers and everyone writes these scripts. Clearly each script solves a particular problem, either for the tester...

How Cloud Migration is Affecting AppSec – A Red Teamer’s Perspective

by Max Corbridge | Jul 4, 2024 | Application Security, Azure Cloud, Azure DevOps, Cloud Red Team, Initial Access, Jumpsec, Red Teaming

Introduction I’ve recently spoken at several conferences about the changes that are underway within red teaming as a result of cloud migration. My team and I have been delivering majority cloud red team work over the last year and the differences are becoming more apparent by the day. One point I’ve mentioned as ‘controversial’ at several of these events is that cloud migration has actually made AppSec more important than ever. I went some way to trying to explain why I think this is during my...

Advisory CVE-2023-43042 – IBM Backup Products Superuser Information Disclosure

by Max Corbridge | Dec 21, 2023 | Exploitation, Jumpsec, Research, Security Bug, Vulnerability

Software: IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize products Affected versions: 8.3 Vendor page: https://www.ibm.com/support/pages/node/7064976 CVE Reference: CVE-2023-43042 Published: 08/12/2023 CVSS 3.0 Score: 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector: Network Credit: Max Corbridge Summary JUMPSEC’s Head of Adversarial Simulation (@CorbridgeMax) discovered that an unauthenticated user can determine whether the default superuser password...

Red Teaming the Cloud: A Shift in Perspective

by Max Corbridge | Dec 19, 2023 | Jumpsec

Having delivered entirely cloud red teams, JUMPSEC experts discuss the shifts in perspective necessary for red teamers when targeting cloud environments.

Ligolo: Quality of Life on Red Team Engagements

by Francesco Iulio | Jun 9, 2023 | Jumpsec, Network Tools

In recent months we, JUMPSEC’s red team, have been using a nifty little tool that we would like to share with you in this blog post. Ligolo-ng is a versatile tool that has been aiding our covert, and slightly-less-covert, engagements with regards to tunnelling, exfiltration, persistence, and widely improving the operators’ “quality of life” when carrying out assessments involving beaconing from within an internal network. This highly-useful tool is developed by Nicolas Chatelain and can be...

Hunting for ‘Snake’

by Francesco Iulio | May 26, 2023 | Detection, Jumpsec

Following the NCSC and CISA’s detailed joint advisory on the highly sophisticated ‘Snake’ cyber espionage tool, JUMPSEC threat intelligence analysts have provided a condensed blueprint for organisations to start proactively hunting for Snake within their network, contextualising key Indicators of Compromise (IoC), and providing additional methods to validate the effectiveness of Snake detections. Snake’s capabilities The implant dubbed ‘Snake’ has been attributed to Centre 16 of Russia’s state...

Advisory CVE-2023-30382 – Half-Life Local Privilege Escalation

by Ryan Saridar | May 23, 2023 | Jumpsec, Vulnerability

Software: Half-Life Affected versions: Latest (<= build 5433873), at the time of writing Vendor page: www.valvesoftware.com CVE Reference: CVE-2023-30382 Published: 23/05/2023 CVSS 3.1 Score: 8.2 AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H Attack Vector: Local Credit: Ryan Saridar Summary An attacker can leverage a stack-based buffer overflow via Half-Life’s command line arguments to compromise the account of any local user who launches the game. Technical details hl.exe does not adequately perform...

Advisory CVE-2022-37832 – Mutiny Network Monitoring Appliance hardcoded credentials

by Ryan Saridar | Dec 15, 2022 | Jumpsec, Vulnerability

Software: Mutiny Network Monitoring Appliance Affected versions: <= 7.2.0-10855 Vendor page: www.mutiny.com CVE Reference: CVE-2022-37832 Published: 16/12/2022 CVSS 3.1 Score: 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Attack Vector: Network Credit: Ryan Saridar Summary An attacker can log in as root remotely to the appliance via SSH. Mitigation Upgrade to version 7.2.0-10855 onwards to remediate the problem. Technical details Before version 7.2.0-10855, the SSH service allows password login...

JUMPSEC LABS

How to Handle Development Projects in a Pentest Company

Advisory CVE-2023-43042 – IBM Backup Products Superuser Information Disclosure

Red Teaming the Cloud: A Shift in Perspective

Ligolo: Quality of Life on Red Team Engagements

Hunting for ‘Snake’

Advisory CVE-2023-30382 – Half-Life Local Privilege Escalation

Advisory CVE-2022-37832 – Mutiny Network Monitoring Appliance hardcoded credentials

[Latest Posts]

[Categories]

GitHub

Follow JumpsecLabs

Disclaimer