MSSQL Lateral Movement

Using discovered credentials to move laterally in an environment is a common goal for the NCC Group FSAS team. The ability to quickly and reliably use a newly gained set of credentials is essential during time-constrained operations. This blog post explains how to automate lateral movement via MSSQL CLR without touching disk* or requiring XP_CMDSHELL and how this can be prevented and detected.

Sign over Your Hashes – Stealing NetNTLM Hashes via Outlook Signatures

In your emails, getting your hashes  Capturing NetNTLM hashes from network communications is nothing new; a quick Google for 'Capture NTLM Hashes' throws up blog posts discussing the various ways to force SMB communications to an attacker and the numerous existing tools to capture the authentication attempt and extract the password hash. Sniffing SMB traffic requires elevated permissions … Continue reading Sign over Your Hashes – Stealing NetNTLM Hashes via Outlook Signatures

Helping Engineering Teams Tackle Security Debt in Embedded Systems: U-Boot Configuration Auditing Introduced in Depthcharge v0.2.0

Depthcharge v0.2.0 is now available on GitHub and PyPi. This release introduces new “configuration checker” functionality and includes some major updates intended to improve usability. A tl;dr summary can be found in the CHANGELOG file. This blog post dives a bit more into the motivations for the changes, envisioned use-cases, and how this update fits … Continue reading Helping Engineering Teams Tackle Security Debt in Embedded Systems: U-Boot Configuration Auditing Introduced in Depthcharge v0.2.0

Tool Release – HTTPSignatures: A Burp Suite Extension Implementing HTTP Signatures

HTTPSignatures is a PortSwigger Burp Suite extension that implements the Signing HTTP Messages draft-ietf-httpbis-message-signatures-01 specification draft document. What motivated my creation in this tool was the lack of an easy way to test applications and services using HTTP Signatures. This extension allows Burp Suite users to seamlessly test applications that require HTTP Signatures. What are … Continue reading Tool Release – HTTPSignatures: A Burp Suite Extension Implementing HTTP Signatures

Tool Release – Carnivore: Microsoft External Assessment Tool

Carnivore is a tool for assessing on-premises Microsoft servers such as ADFS, Skype, Exchange, and RDWeb. Carnivore's functionality covers every stage an attacker would follow - from discovering relevant subdomains, to uncovering username format and username enumeration, to password spraying and additional post authentication activities for Skype such as retrieving the global address list or … Continue reading Tool Release – Carnivore: Microsoft External Assessment Tool

Tool Release – ScoutSuite 5.10

We’re proud to announce the release of a new version of our open-source, multi-cloud auditing tool ScoutSuite (on Github)! Notable improvements and features include: CoreBreaking change: support for Python 3.5 has been deprecatedMoved unit tests from nose to pytest & improved coverageBug fixes and improved error handlingAWSCreated a ruleset for the AWS CIS Benchmark version 1.2Can … Continue reading Tool Release – ScoutSuite 5.10

Tool Release – ICPin, an integrity-check and anti-debug detection pintool

by Nicolas Guigo ICPin is an Intel pintool leveraging the framework's JIT mode designed to track a binary's integrity checks. It records all reads and all writes performed by the target executable or dynamically loaded library on its text section and outputs a human readable text file describing each memory access with its type (R|W) … Continue reading Tool Release – ICPin, an integrity-check and anti-debug detection pintool

Conference Talks – August 2020

This month, NCC Group researchers will be presenting their work at the following conferences: Dirk-Jan Mollema, "ROADtools and ROADrecon," to be presented at Black Hat USA 2020 (Virtual - August 1-6 2020)Chris Nevin, "Carnivore: Microsoft External Attack Tool" to be presented at Black Hat USA 2020 (Virtual - August 1-6 2020)Rory McCune, "Mastering Container Security … Continue reading Conference Talks – August 2020