Power Saturday 2019 E3 - SharePoint unexplained

@ClubPowerBI @aosComm @GUSS_FRANCEPower Saturday 2019
14 et 15 juin 2019, Paris
Power
Saturday

3 communautés pour partager,
échanger et apprendre
Power BI, Data, IA, Power Platform, Office 365, SharePoint, etc.

Merci à nos sponsors
http:// PowerSaturday.com
Silver
Bronze
Gold

The European SharePoint, Office 365 & Azure Conference
4 Days 2,500 Delegates 150+ Sessions 120 Speakers
Use code ESPC19SPSP for 10% discount on all tickets
www.sharepointeurope.com

Power
Saturday
SharePoint unexplained
Ivan Vagunin

❖ Ivan Vagunin, Ph.D.
❖ Systems Architect at Digia Oy
❖ MSCM: SharePoint
❖ Security researcher, MSRC TOP 100 BH 2018
❖ Occasional community contributor
❖ https://twitter.com/ivagunin
Who am I?

Troubleshooting
“Analyse and solve serious problems for a
company or other organization. trace and correct
faults in a mechanical or electronic system.”

Troubleshooting

“Backward chaining is the logical process of
inferring unknown truths from known
conclusions by moving backward from a solution
to determine the initial conditions and rules.”
Why did it happen?

Case of mysterious front page

❖SharePoint Online
❖Classic team site (with publishing features)
❖Users from external network see different
home page
Reconnaissance

Making assumption
IntranetReserve proxy
Company proxy
internet

Seeing is believing

Getting more test data

Spot the difference

❖Do not make rush assumptions
❖Plan MUI responsibly
❖Avoid using web parts for branding
Lessons learned

Case of lost access

❖ SharePoint 2013, 4 servers
❖ Intranet is a single site collection
❖ Non-privileged users lost access to Intranet
❖ Site collection admin still had access
❖ Non-privileged users had access few hours before incident
Reconnaissance

❖Preserve logs
❖Find relevant logs
❖Make notes
Working with logs

❖Use right tools to process logs
❖Use timing to correlate events in logs
❖Use least privilege principal
❖Use multiple site collection to isolate users
Lessons learned

Case of unsafe deserialization

CVE-2019-0604

KB4462171

sts2019-kb4462171-fullfile-x64-glb.exe

Microsoft.SharePoint.dll vs stsom.dll

Attacks against .net deserialization
❖Deserialization of user controlled type
❖Deserialization of user controlled object (or
some part of object)
https://www.blackhat.com/docs/us-17/thursday/us-17-
Munoz-Friday-The-13th-JSON-Attacks-wp.pdf

Entry points

Exploitation

❖Have patch management that makes sense
❖Estimate risks
❖Verify yourself
Lessons learned

Merci!

Evaluations

Power Saturday 2019 E3 - SharePoint unexplained

More Related Content

Similar to Power Saturday 2019 E3 - SharePoint unexplained (20)

More from PowerSaturdayParis (20)

Recently uploaded (20)

Power Saturday 2019 E3 - SharePoint unexplained