Ruslan Sayfiev

Red Team Architect @FujitsuOfficial

[Ruslan Sayfiev @cryptopeg]

大企業でも被害が続く中、中小企業はどうセキュリティ対策を進めるか。
限られた人員と予算で、管理する資産やアクセスを整理する。その変更で攻撃者ができることを減らせたか、確かめる。
攻撃者の視点も交え、実際の改善につなげるための考え方をまとめてみました。 https://t.co/CuL4FeFxlo

[Ruslan Sayfiev @cryptopeg]

@EurekaBerry 参加申請させていただきました！
発表枠を狙ってみてます☺️

[Ruslan Sayfiev @cryptopeg]

@yousukezan いつか☺️

[Ruslan Sayfiev @cryptopeg]

@domchell Congratulations🎉
Hope that, the next chapter would be more exciting!

[tamaiyutaro @tamai_pc]

[宣伝] 「詳解 Active Directory & Windowsインフラ・ペネトレーションテスト」の書籍作成に少し関わらせていただきました。Active Directory を始め、WSUS や Configuration Manager についても取り上げられているので是非。
https://t.co/HIqtEpsN8r
#ActiveDirectory #ConfigMgr #WSUS

[田中ザック (Zach Mathis) @yamatosecurity]

AD攻撃の知識をレベルアップしたい方におすすめの一冊！

[Ruslan Sayfiev @cryptopeg]

@J4cx0L 過去にずっと間違ってたw

[Ruslan Sayfiev @cryptopeg]

@r00tapple @soc127_0_0_1 自分がそもそも顧客の環境/課題/成熟度に合わせて各案件をカスタマイズすべきだと思う派ですねー
※中々誰もこの考え方についてこないが、、、

[Ruslan Sayfiev @cryptopeg]

久々に参加のみの予定でしたが、発表枠が余ってたので、せっかく以前Interop Tokyoで登壇してた「攻撃者視点から考えるDetection Engineering」について少し皆に共有できればと思います。最近顧客の成熟度を上げるために、パープルチームやBlue Teamトレーニングなども実施したりしていますので、この辺りに振りつつお話が出来ればと思います。

[てきとう @tkito]

公開遅くなってすみません！
予告通り9/26(土)にオフラインイベントやります！

会場はGMOインターネットグループ様にお借りします。提供いただきありがとうございます！

OffSecLab Meetup in 渋谷 https://t.co/stecD3ZBCw #offsecstudy #GMOインターネットグループ #GMOYours

[Ruslan Sayfiev @cryptopeg]

dpapi-toolkit - one tool for almost any Windows DPAPI blob
https://t.co/jllMmMRSzx
If you've done red teaming or pentesting long enough, you know how much of Windows comes down to DPAPI blobs - credentials, certificates, configs, browsers, Wi-Fi, RDP, the lot. The real work is knowing exactly what is encrypted, where it lives, and how to unwrap it: which master key a given blob needs, and what type of blob you're even looking at.
I've always loved mimikatz - one of the first tools to bring DPAPI decryption to so many formats. But as you know, you have to be sure which format you're decrypting, and if you pick wrong, the parser just crashes.
So I wanted one tool that makes any DPAPI-encrypted blob just work: drop the blob, it tells you which master key it needs, drop that too, set the SID/PVK/SYSTEM-key, get the result. It also exports DPAPImk/MSONLINEACCOUNT hashes for offline password cracking, plus a lot of other functions - and it's built as a Web GUI with drag-and-drop and intuitive, step-based actions.
Fully offline - you bring the collected files. Built for red team / pentest and DFIR, and research.
If you love playing with DPAPI as much as I do, please give it a try!

[Ruslan Sayfiev @cryptopeg]

まさにこれが大事ですね。
まずはセキュリティ製品だけに頼るという認識を変えることが必要で、その中で設計と運用問題を可視化するためには製品の限界を超えて未検知にするという考え方ですね。ただし、そこは「EDRを回避出来ました。あとはなんとかして直してください」というのはダメですね。どのEDRも自動検知に限界があるものの、最も大事なのはどれぐらいのテレメトリーが取れるかが大事で、それに基づいて攻撃シナリオを考えた上でカスタムルールを作ることになります。そこはレッドチームの成果物にするのかアドバイザリー/パープルチームにするのかが少し悩ましい線がありますが、そこまで提供すべきだと思います。

[Ruslan Sayfiev @cryptopeg]

マーケットの価格について自分も色々疑問がありますが、レッドチームの活躍が自社がなんでも防御できる自信の確認と防御体験が一つと防御に予算をいっぱい使いまくってるのに本当に有効かどうかの確認ですね。
もちろん会社の成熟があがればあがるほど完全に目標達成できない(またはなんでも攻撃行為が検知されて動けない)場合もなくはないので、そこまで成長するのが最終目的になるはずです。
あとはそもそもの話ですが、レッドチームが最も攻撃力の高い脅威(aptや国家ハッカー)を目指さない限り、いつかそのような攻撃が来るとしたらというシナリオも出来なくなっていくんですね。

[Ruslan Sayfiev @cryptopeg]

@yuiyui12322 企業の運用/設計の弱いところを見つけ出して、セキュアにするのと、検知/対応ができるブルーチームの成長に繋げてあげるのは「いい」レッドチームの目指すことですねー

[Ruslan Sayfiev @cryptopeg]

@PumpkinSecurity Yeah, separate. Pre-Windows 2000 Compatible Access is the ACL that makes the null session work. SAMR monitoring is whether they see you use the pipe to pull the data.

[Ruslan Sayfiev @cryptopeg]

On red team engagements we often may start from a dropbox on the internal network (LAN/Wi-Fi) with no valid domain account. The DCs are easy to find via DNS, and still in plenty of environments anonymous access to the SAMR and LSARPC named pipes are open.
https://t.co/e94x09tKOi
Many of us lean on rpcclient for this (I do too), but over a null session it lists standard users by name only — no machine ($) accounts, full detail one queryuser at a time, and no way to RID-cycle when enumeration is locked down. enum4linux-ng and NetExec cover this ground too and I still use them. I wanted one command that does the whole pass and writes clean, reusable output:
• Users with full detail — descriptions, account restrictions, group memberships
• Groups resolved to their members
• Computer ($) accounts — via RID cycling, which is how you get them at all
• Domain + password/lockout policy, plus LSA/DNS (domain SID, forest, trusts)
• "Interesting" accounts flagged

Output is txt/csv/json plus ready-to-use lists: usernames for AS-REP roasting, computer names for the pre-Windows 2000 machine-account check. SAMR first; if that's locked it still returns LSA recon, with an optional LSA RID-cycling fallback.

Use it only on directories you are authorised to inspect.

[Ruslan Sayfiev @cryptopeg]

@PumpkinSecurity Standing check only if we have no foothold - we don’t run it first if we already have a user. If SAMR isn’t logged well it can still be the quieter way to pull users/groups. Otherwise it shows up at the end as a mitigation note.

[Ruslan Sayfiev @cryptopeg]

@PumpkinSecurity Yeah, I've seen it on the newer DCs too. To be fair, it's a legacy issue in terms of how the misconfiguration gets there. It mostly happens due to GPO migration and having Anonymous logon and Everyone present in the 'Pre-Windows 2000 Compatible Access' group.

[Ruslan Sayfiev @cryptopeg]

One more to go: adexview - browse, search and audit an AD Explorer snapshot offline, in your browser, from any OS.
https://t.co/YlSMMD0mtA
Every engagement I had a .dat file and questions BloodHound doesn't answer: subnets, DNS name to IP, DFS shares, GPO links, LAPS coverage, certificate templates, trusts. AD Explorer knows, one object at a time, on Windows only.
So I built adexview on top of adx-query by @takito1812, whose offline LDAP engine for snapshots proved the whole idea. Thank you, Víctor.
What you get:
- directory tree, every attribute decoded (ACLs, DNS, certs, flags)
- LDAP filters and full-text search over the whole snapshot
- an audit with findings: dangerous ACLs, DCSync, RBCD, ESC1-5, LAPS, trusts
- a multi-snapshot library with upload and convert
- password login by default

Pairs with adexsnap for taking the snapshot from Linux or macOS.

[Ruslan Sayfiev @cryptopeg]

AD Explorer snapshots without Windows.
https://t.co/1QOuc9rwBe
adexsnap is a Python CLI that talks LDAP from Linux or macOS and writes a real AD Explorer .dat file. Open it in AD Explorer, feed it to https://t.co/uj0O5nfBCU or BOFHound, ingest into BloodHound.
NTLM, Kerberos (ccache/kirbi), LDAPS. Built-in verifier.
Authorized use only. Hope it will be useful.