Exploiting Windows Hello for Business
summary
Ability to write arbitrary public keys into MSDS-KeyCredentialLink on Windows Server 2016 DCs with KDC certs enables persistence: a self-signed cert injected into AD becomes a valid NGC credential, used with kikyo/mimikatz PKINIT to obtain a TGT (with PAC and NT hash) and perform pass-the-ticket. Authenticated users can read all key blobs, extract moduli, and crack ROCA-vulnerable TPM keys (ROCA/Infineon 4.4.t). Delivered tools: DSInternals PowerShell (get-adkeycredential) to audit and selectively delete keys; note stale-device cleanup and Microsoft's removed hard-coded “unusable” key.
AI-written summary · about
chapters (13)
- 0:00Introduction and overview
- 0:58Windows Hello for Business
- 4:02Active Directory integration
- 5:52Injecting custom keys
- 10:46Requirements and auditing
- 13:47Analyzing key data
- 17:14Rocqu attack vulnerability
- 20:10Referential integrity issues
- 24:35Key extraction and cracking
- 27:08Active Directory auditing
- 29:14Key management tools
- 33:05Mitigation strategies
- 34:14Q&A and conclusion
related talks
51mAbusing Microsoft Kerberos: Sorry You Guys Don't Get It
47mCunning With CNG: Soliciting Secrets From Schannel
23mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
50mBeyond the Mcse: Active Directory for the Security Professional
54mDPAPI and DPAPI-NG Decrypting All Users’ Secrets and PFX Passwords
41mSimulation Hacking, the Good, Bad and the Ugly
47mFinding a Needle in an Encrypted Haystack
40mThe Attacker’s Guide to SSO and Passwordless Technologies