Nov 3, 2021

Hunting backdoors in Active Directory Environment

 

 Notes:

  • Abusing AD permissions for standard user.
    • DS Replication permissions (DC Sync attack)
      • DS-Replication-Get-Changes
      • DS-Replication-Get-Changes-All
      • Alows a principal to retrieve NT hashes remotely via the MS-DRSR protocol for any security principal (krbgt a/c or domain admin)
      • Detection: event ID 4662
      • Hunting: DS Replication permission
    • Send as Permission
      • Can be configured in AD or Exchange Admin Center
      • Detection: Event ID 1
      • Hunting: SendAs permission
    • Commonly targeted AD permission
      • GenericAll, Generic Write, WriteDACL, WiteOwner, User Force change password
    • Valuable AD attributes
      • ms-mcs-admpwd, msDS-Key-CredentialLink, msDS-AllowedToActOnBehalfOfOtheridentity
  • Added backdoor to access to ADFS Token Signing Certificate (TSC)
    • Golden SAML token attack
      • Bypass MFA and access cloud services
      • considered the bedrock of security 
      • ADFS service account and local administrators can access the container
      • Hunting: review authentication policy for backdoor access to Token Signing Certificate
  • Admin SD Holder and SDProp
    • Hunting: review DACL templates of AdminSD Holder container
    • Detection: directory service access event ID 4662
  • Credential harvesting via AAD with PTA agent 
    • PTA - pass thru authentication
    • Hunting: suspicious DLL at PTA agent
    • Detection: PTA spy
  • Machine$ Account
    • Steal hash and create silver ticket.
    • password rotated every 30 days
    • Hunting: suspicious registry value (MaximumPasswordAge)
    • Detection: un-approved changes
  • Creating malicious GPO
    • delegation right to edit GPO
    • push ransomware via logon script
    • schedule malicious task
    • enable weak LANMAN hash authentication
    • create restricted group
    • Hunting: review GPOPermissions and the DACL for sysvol folder
    • Detection: event ID 5136, 5137

 Links:

  •  https://www.youtube.com/watch?v=xeCCYmE4bZM

Nov 2, 2021

Tools for Kubernetes

Here are some useful Interactive Terminal and Graphical UI Tools for managing multiple Kubernetes or K8s clusters.

Octant (graphical-based UI)

Octant is a browser-based UI aimed at application developers giving them visibility into how their application is running. It is useful for anyone who forget the various options to kubectl to inspect your K8s Cluster and/or workloads. 

Octant is also a VMware Open Source project and it is supported on Windows, Mac and Linux (including ARM) and runs locally on a system that has access to a K8S Cluster. After installing Octant, just type octant and it will start listening on localhost:7777 and you just launch your web browser to access the UI.

It is easy to switch context between different K8s Cluster with a simple drop down along with namespace filtering which is quite helpful in narrowing down a specific deployments, usually for informational or troubleshooting purposes.

With Octant, you just select the pod that you are interested in and clicking on the Logs tab (for debugging). You can also filter on specific key words which can be handy when the logs are flying across your screen; or you may just choose to access the pod with the built in terminal access.

Kubevious 

Kubevious comes with a slick browser-based UI, and allow you to navigate through your application in a hierarchal fashion and quickly drill down into the application details and configurations within a single view. 

Kubevious has a nice visual graphics, and requires to deploy  it at ever K8s Cluster.

kubelive

Kubelive is a terminal-based UI using Node.js. It is easy to use but it currently is limited to just a handful of kubectl commands. It has the ability to easily navigate through the various namespaces for a given K8s Cluster and quickly show the status of given set of pods.

It allowed you to quickly show the various namespaces without typing a bunch of commands and the underlying containers that we had just deployed. 

K9s (terminal-based UI)

K9s is another terminal-based UI that highly recommended, and it has a similar experience like Kubelive with the ability to easily navigate through namespaces and pods. 

K9s works just like Kubelive, you just type the command after installing the binary and it will give you access to the specific K8s Cluster which you have context in.

Lens

Lens an Electron-based desktop application that runs on Windows, Mac and Linux. It integrates with Prometheus to visualize and see trends in resource usage metrics, including CPU, memory, network and disk, with the total capacity, actual usage, requests and limits 

It can connect to a local K8s Cluster and you can also add a custom configuration by copying/pasting the kube configuration which I thought was pretty nice. 

Lens has the capability to quickly search for filter out the things, and supports terminal access to a pod directly.

Lens Open Source Project (OpenLens)

OpenLens is where Team Lens develops the Lens IDE product together with the community. It is backed by a number of Kubernetes and cloud native ecosystem pioneers.

Lens - The Kubernetes IDE

Lens - The Kubernetes IDE ("Lens IDE") is a distribution of the OpenLens repository with Team Lens specific customizations released under a traditional EULA.

Lens IDE is a standalone application that runs on MacOS, Windows and Linux operating systems. It provides the full situational awareness for everything that runs in Kubernetes, and makes it easy for people just getting started.


Links:

  • bat - https://github.com/sharkdp/bat
  • kube-ps1 - https://github.com/jonmosco/kube-ps1
  • Octant - https://github.com/vmware-tanzu/octant
  • Kubevious - https://github.com/kubevious/kubevious
  • kubelive - https://github.com/ameerthehacker/kubelive
  • K9s - https://github.com/derailed/k9s
  • OpenLens - https://github.com/lensapp/lens
  • Lens - https://k8slens.dev/
  • https://williamlam.com/2020/04/useful-interactive-terminal-and-graphical-ui-tools-for-kubernetes.html

 

Nov 1, 2021

Python Cheatsheet for Beginners

Python Cheatsheet for Beginners (PDF File)☞ https://morioh.com/p/b57f91f033dc#python #webdevelopment #machinelearning #developer #morioh
Python Cheatsheet

Download Free PDF Beginners Python Cheat Sheet for all Programmers.  The purpose of this set of deception sheets is to remind you of grammatical rules, but also to remind you of important concepts.

Links:

  • https://morioh.com/p/b57f91f033dc

Oct 29, 2021

Using VSCode in the Browser

You like Visual Studio Code? 

In this video, John will walk through using Visual Studio Code (VSCode) in the browser with zero installation experience.


Coding is never be so fun with this!!

Links:

Oct 28, 2021

Enhancing Cloud Security Operations : Visibility

Visibility is a key element to identify and respond to cloud security incidents. This session explores how we can leverage native offerings to help solve the visibility problem.

In this webinar, Roger shares the following topics with us, and helps us to keep up with the ever-changing threat landscape.

  • Cloud adoption
  • Security concerns
  • How do we solve the problems
  • Native tools
  • Gaps
  • 3rd party tools
  • Automation

Links:

  • https://www.youtube.com/watch?v=rEP53j60QXQ