Jayson Grace - MOSE: Using Configuration Management for Evil
Introduces MOSE, an open-source tool for weaponizing Chef, Puppet, Ansible, and Salt configuration management systems during red team engagements.
Summary
Weaponizing Configuration Management
Jayson Grace presents MOSE (Master of Server Exploitation), an open-source offensive tool designed to weaponize enterprise configuration management systems during red team engagements.
Configuration Management Attack Surface
Chef, Puppet, Ansible, and Salt are deployed to manage configuration across thousands of servers simultaneously — making the configuration management infrastructure one of the highest-value lateral movement targets in enterprise networks.
MOSE Architecture
MOSE automates the process of identifying the configuration management system in use, locating the orchestration server, and injecting malicious code into the management system's configuration manifests. On the next agent run, the malicious code executes on all managed nodes.
Real-World Attack Scenarios
Grace demonstrates deploying a Cobalt Strike beacon to 3,000+ servers simultaneously through a compromised Chef server, achieving complete environment compromise from a single pivot point with no additional lateral movement required.
Related talks
Main Stage·35 min
Justin Perdok
Justin Perdok exploits User-ID mapping features in Palo Alto and SonicWall enterprise firewalls, spoofing domain identities to bypass network segmentation rules.
Main Stage·24 min
droogie
Revives Windows null session attacks against modern Active Directory environments, demonstrating significant unauthenticated enumeration capabilities.
Main Stage·36 min
Nikhil Mittal
Introduces RACE, an open-source toolset for persistent Active Directory access using minimal-privilege ACL modifications invisible to most monitoring.