Red Teaming Archives | JUMPSEC LABS

TokenSmith – Bypassing Intune Compliant Device Conditional Access

by Sunny Chau | Dec 20, 2024 | Azure Cloud, burpsuite, Cloud Red Team, Initial Access, Red Teaming

Conditional Access Policies (CAPs) are the core of Entra ID’s perimeter defense for the vast majority of Enterprise Microsoft 365 (M365) and Azure environments. The core ideas of conditional access are: Require specific auth strength in scenarios where you wish to grant access Block access in undesirable scenarios If a scenario are neither covered by a or b, then the minimal auth strength (password) would be sufficient A special condition for CAP requirements is that authentication can be...

Weaponize Your Word – Malicious Template Injection

by Max Clarke | Oct 30, 2024 | Detection, Initial Access, Red Teaming, Research, Windows

Weaponize Your Word - Malicious Template Injection Historically, files sent via email have been a common initial access technique employed by threat actors. Personally, I have seen emails containing malware prove effective, and in the case of an IR (Incident Response) involving a malware infection, it would be one of the first places I would look to identify the source of compromise. There are many techniques for bypassing an email solution to deploy malware on an endpoint, however an old...

Breaking into Libraries – DLL Hijacking

by Patryk Zajdel | Oct 24, 2024 | Red Teaming, Windows

Breaking into Libraries - DLL Hijacking Many of us have likely encountered DLL errors when trying to open Windows applications. If you were like my younger self, you might have naively downloaded a missing DLL from sites like dll-files.com and placed it in the application directory without giving it a second thought. This blog post will examine the risks associated with this approach. Dynamic Link Library (DLL) hijacking is a common occurrence that impacts Windows-based applications. This...

NTLM Relaying – Making the Old New Again

by David Kennedy | Sep 17, 2024 | Red Teaming

I am old enough to remember that it was not always possible to get domain admin within the first hour of a test via Active Directory Certificate Services (ADCS) misconfigurations or over permissioned SCCM NAA accounts. At present we are spoilt for choice in regards to privilege escalation vectors within the on-premise AD environment's, but I wanted to take a look at some of the other misconfigurations that proved to be fruitful before the advent of ADCS and SCCM and continue to land me quick...

Adversary at the Door – Initial Access and what’s currently on the menu

by Patryk Zajdel | Aug 20, 2024 | Initial Access, Red Teaming

Based on the data from the Cyber Security Breaches Survey 2024, phishing with malicious links or malware remains the most common initial access vector, followed by impersonation. The challenge with impersonation attacks is that current technology often struggles to accurately determine the purpose of a website. Although checks on domain maturity, reputation, categorization, and certificates are performed, a skilled adversary can still create sophisticated phishing infrastructure that hosts...

SSH Tunnelling to Punch Through Corporate Firewalls – Updated take on one of the oldest LOLBINs

by Sunny Chau | Aug 13, 2024 | Adversary Infrastructure, Initial Access, Red Teaming

In my formative days of learning network hacking, SSH tunnelling was amongst the first tunnelling techniques that I learnt. I still remember trying to repeatedly decode my notes and diagrams on the rather cumbersome syntax of single port forwarding with the -L and -R flags, which at the time was taught as “the way to do it”. If your foothold is (luckily) a Linux server, then you’re blessed with the -D flag to spin up a SOCKS proxy on the foothold itself to access the network via proxychains....

How Cloud Migration is Affecting AppSec – A Red Teamer’s Perspective

by Max Corbridge | Jul 4, 2024 | Application Security, Azure Cloud, Azure DevOps, Cloud Red Team, Initial Access, Jumpsec, Red Teaming

Introduction I’ve recently spoken at several conferences about the changes that are underway within red teaming as a result of cloud migration. My team and I have been delivering majority cloud red team work over the last year and the differences are becoming more apparent by the day. One point I’ve mentioned as ‘controversial’ at several of these events is that cloud migration has actually made AppSec more important than ever. I went some way to trying to explain why I think this is during my...

Putting the C2 in C2loudflare

by David Kennedy | Jun 28, 2024 | Adversary Infrastructure, Red Teaming

tl;dr How to bring up an entire C2 infrastructure with all your tooling and their corresponding redirectors within 5 minutes with the help of Azure Snapshots, Cloudflare and Tmux Resurrect. Every so often I seem to stumble across various ideas, that when combined, massively improve my overall productivity at work. Most of these ideas on their own are nothing new, but when used in tandem can really accelerate your productivity, which is what I wanted to illustrate in today's post. A great...

JUMPSEC LABS

TokenSmith – Bypassing Intune Compliant Device Conditional Access

Weaponize Your Word – Malicious Template Injection

Breaking into Libraries – DLL Hijacking

NTLM Relaying – Making the Old New Again

Adversary at the Door – Initial Access and what’s currently on the menu

SSH Tunnelling to Punch Through Corporate Firewalls – Updated take on one of the oldest LOLBINs

Putting the C2 in C2loudflare

[Latest Posts]

[Categories]

GitHub

Follow JumpsecLabs

Disclaimer