Attacking Insecure ELK Deployments

Sat, 21 Mar 2020 00:00:00 +0000

Introduction

Nowadays, we see a continuous increase of the adoption of the Elasticsearch Logstash Kibana (ELK) stack for security monitoring purposes. The functionalities of the ELK stack fit nicely the purpose of a SIEM; in fact, within few minutes it is possible to spin up a cluster and deploy the data collectors on the endpoints.

Considering the open source nature of the Elastic project and the presence of ingestors like Winlogbeat , its increase in popularity is not surprising.

Extending BloodHound

Thu, 06 Feb 2020 00:00:00 +0000

This series of posts was inspired by porterhau5’s work that can be found here: Extending BloodHound: Track and Visualize Your Compromise .

1. The Problem

In a standard Active Directory assessment, a fundamental phase is the analysis of Group Policy Objects (GPOs). Usually, this activity is aimed at identifying the following:

Opportunities for lateral movement via misconfigurations of remote access policies and UAC¹;
Misconfigurations that could allow further compromise, such as lack of SMB signing;
Password policies;
Privilege Assignment;
Local group membership.

…and much more. The process of parsing GPOs is often tedious and very time consuming. Tools like Grouper2² can drastically reduce the required time, but the volume of the output is still quite considerable.

Red-Team on Riccardo Ancarani

Attacking Insecure ELK Deployments

Introduction

Extending BloodHound

1. The Problem