When It Snows It Pours – Anatomy of a ServiceNow Red Team

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://mdsec.co.uk/2026/08/when-it-snows-it-pours-anatomy-of-a-servicenow-red-team
• Blog Title: When It Snows It Pours – Anatomy of a ServiceNow Red Team
• Suggested Section: Network Services Pentesting → 80,443 - Pentesting Web → ServiceNow

🎯 Content Summary

Scope, severity, and architecture

MDSec describes ServiceNow as a cloud control plane that can disconnect an attacker from an initially compromised workstation while exposing user accounts, credentials, workflows, MID servers, internal networks, discovery infrastructure, and security data. The introduction frames a scenario in which approximately 6,000 employees could be two steps away from controlling the organisation's IT infrastructure; in three engagements, more than 10,000 users ...

🔧 Technical Details

Decoupled ServiceNow initial access: After compromising an endpoint, wait for a user to authenticate to the SaaS platform, steal and reuse the browser session, and inspect the user's ServiceNow record for escalation-capable roles. File-share searches should also include application names such as ServiceNow, because MID-server config.xml files may contain cloud-tenant credentials. This creates a control-plane foothold that is operationally separated from the original workstation.

Role-to-Glide-script privilege chains: Treat any role that can create catalog items, User Criteria, transforms, reports, workflows, or diagnostic records as a potential server-side code-execution primitive. A lower-privileged role such as catalog_admin can create a sc_cat_item record with a User Criteria script, execute it through uc_item_diagnostics.do, and insert an intermediate role such as actio...

🤖 Agent Actions

Plan:

1. Inspect the repository structure and at least five relevant web/service pages.
2. Check whether ServiceNow techniques are already documented and select one best-fit file.
3. Add concise, source-cited technical content without duplicating existing material.
4. Validate formatting, links, references, and the final diff.
   I found an existing dedicated servicenow.md page, so I’ll extend that single page rather than create or duplicate content elsewhere. The new material will focus on the reusable post-authentication techniques: role-to-Glide escalation, REST transform abuse, scheduled persistence/C2, ECC/MID execution, credential recovery, adaptive-authentication policy manipulation, and forensic review points.
   Implementation is complete. I’m now validating Markdown structure, citation/reference consistency, forbidden-source absence, source reachability, and the repository build where available.
   Updated src/network-services-pentesting/pentesting-web/servicenow.md with:

• MID config.xml and session-based initial access
• Role-to-Glide privilege-escalation chains
• REST transform-map abuse
• Business-rule persistence and scheduled Glide C2
• ECC Queue and MID-server command execution
• MID-side credential recovery
• Adaptive Authentication policy manipulation
• Detection and containment artifacts

Added the MDSec post as numbered reference [7] with inline citations.

Validation completed:

• git diff --check passed
• Citation, reference, footer, and code-block checks passed
• Forbidden sources absent
• Source URL returned HTTP 200
• mdbook was unavailable in the environment

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://mdsec.co.uk/2026/08/when-it-snows-it-pours-anatomy-of-a-servicenow-red-team

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting → 80,443 - Pentesting Web → ServiceNow".

Repository Maintenance:

• MD Files Formatting: 1031 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0