Attacking & Defending ServiceNow

The talk looks at ServiceNow, a cloud platform that often holds privileged connections into an enterprise, and how weak permissions and configuration can give an attacker a route inside. The presenters say their own red team work from 2021 uncovered many of these paths before public write-ups existed, and they frame the material as useful to both offense and defense.

Much of the content covers gaining a foothold and escalating from there. Low-privilege accounts could reach internal table and endpoint paths that the user interface does not expose, and a global text search endpoint returned sensitive material such as tickets and pasted credentials. Searching for base64-encoded forms of common account names surfaced basic authentication headers. Legacy login pages without single sign-on were reachable directly. The middle server, which runs on a host in the network and performs privileged tasks, was then driven through an internal command queue to run commands on a domain controller and, with uploaded files, to start a command-and-control session. The presenters also showed how to delete the queue records afterward.

For the lab, they described building a small Active Directory environment with open-source range tooling on modest hardware, plus a free ServiceNow developer instance that had waitlist delays. The takeaways for practitioners: restrict service accounts to web-services-only access, apply least privilege to the middle server, validate it deliberately, and monitor the command queue and global search activity to catch this kind of abuse.