Finding a Needle in an Encrypted Haystack
summary
Claim: three new practical NTLM relay bypasses let attackers authenticate to targets even when server signing or channel binding are enabled. Exploit techniques are named your session key is my session key, drop the mic, and EPA bypass; demos use Impacket to remove NetBIOS AV pairs, strip the MIC, or inject crafted channel bindings, then retrieve session keys and run SMB/LDAP commands to add enterprise admins or dump hashes. Microsoft ships patches for some issues; deterministic detection is possible by decrypting Netlogon messages and comparing AV-pair target names to Netlogon originators.
AI-written summary · about
chapters (9)
- 0:00Introduction to NTLM relay
- 1:36How NTLM relay works
- 4:28Standard NTLM mitigations
- 8:15Historical vulnerabilities
- 13:01Session key bypass exploit
- 21:21Bypassing message integrity
- 27:46EPA and channel binding bypass
- 36:44Deterministic relay detection
- 44:58Conclusion and takeaways
related talks
51mAbusing Microsoft Kerberos: Sorry You Guys Don't Get It
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
58mHacking in 2016 - How is our systems broken?
26mBypassing Local Windows Authentication To Defeat Full Disk Encryption
47mCunning With CNG: Soliciting Secrets From Schannel
29mWhy You Need to Detect More Than PtH
49mThe Remote Malicious Butler Did It!