Justin Hendricks

Security Engineer. My opinions are my own.

[Justin Hendricks @Script_Happens]

@424f424f @_dirkjan @m3g9tr0n @Flangvik Note, organizations can help mitigate token theft with conditional access policies that require device bound tokens and/or enabling continuous access evaluation: https://t.co/GComVAdIdW
https://t.co/tJxog9FPQ7

[Microsoft Security Response Center @msftsecresponse]

📢 BlueHat 2023: Applications to Attend are NOW OPEN! 📢 If you are interested in attending @MSFTBlueHat in Redmond, WA, USA, Feb 8-9, 2023, please submit your application here: https://t.co/yYUPQtGfWl (Applications close Jan 6, 2023)

[Justin Hendricks @Script_Happens]

@scriptjunkie1 @Lee_Holmes The "$$" typo makes it look like a maldoc that figured out how to UI redress the Enable Macros banner 😂

[Justin Hendricks @Script_Happens]

@SteveSyfuhs Remember in 2012 when everyone wanted to kill PtH but it survived. At wdigest died...

[Justin Hendricks @Script_Happens]

@_wald0 @inversecos @mcohmi @kfosaaen @merill @DrAzureAD I always reference the Azure AD Graph API docs for what methods are supported: https://t.co/GJimA15LuF

There are internal versions that the Azure portal uses that allow different operations as well: https://t.co/5VPQHER0bq

[Justin Hendricks @Script_Happens]

@ilanas @SteveSyfuhs @marypcbuk What if it really just runs on top of Active Directory? 🤯

[Justin Hendricks @Script_Happens]

@shawnhernan @Essb33 Exploiting MS10-070-->web.config MachineKey-->RCE is a fun way to learn about both padding oracle and deserialization RCE.

[spotheplanet @spotheplanet]

Noticed that the number of visits to these notes started growing even while they were WIP (yeah, I work in prod 😅), so here they are:
https://t.co/rx6MyZJnmd

Thank you for sharing @harmj0y @tifkin_ @topotam77 @ExAndroidDev , it's all beautiful!

[Steve Syfuhs @SteveSyfuhs]

It's been a while since our last thread and I need to kill time while a ginormous time travel trace file finishes copying, so let's talk a bit about LSA, the Windows Local Security Authority.

[Microsoft Threat Intelligence @MsftSecIntel]

Automatic on-premises Exchange Server mitigation is now in Microsoft Defender Antivirus. We have taken this additional step to further support our customers who have not yet implemented the complete security update. Learn more: https://t.co/QUlXgUZdZp

[Justin Hendricks @Script_Happens]

@maaverix @GossiTheDog Source moved. Here is latest: https://t.co/fwbHv8LdIG

[Justin Hendricks @Script_Happens]

@irsdl Same technique here: https://t.co/AbbqR4dEwd

[Justin Hendricks @Script_Happens]

@irsdl It will read some web.configs but fails if special characters like % are in the config

[Justin Hendricks @Script_Happens]

The nmap script that tests for CVE-2021-26855 had false negatives with 301 and 302 redirects (typically federated auth). This was fixed yesterday. Latest version:
https://t.co/IknjN4vRkL

[John Lambert @JohnLaTwC]

Run Exchange but are on an out-of-support Cumulative Update level and can't get updates for the March vulnerabilities?

The Exchange team has delivered: https://t.co/u7GnYChQV8

[Justin Hendricks @Script_Happens]

Also, there is a script to compare against files on the Exchange server it's run on: https://t.co/2Cc83WKcxG

[John Lambert @JohnLaTwC]

Looking for hashes of known good Exchange files? Here are hashes from the Exchange team:
https://t.co/XzYPnGliuq

[Microsoft Security Response Center @msftsecresponse]

Providing alternative mitigation techniques to help Microsoft Exchange customers needing more time to patch deployments & are willing to make risk & service function trade-offs. These mitigations are not remediation & aren't full protection against attack. https://t.co/n6GD7vjMXD

[Justin Hendricks @Script_Happens]

@SwiftOnSecurity @azonenberg @johnmisczak @Tsigorf It is important for CDN data centers in not so friendly countries. Also, can prevent BMC compromise resulting in host OS compromise.