Hacker’s Perspective on Your Infrastructure: Lessons from the Field
summary
A live red team demonstrates how trivial misconfigurations become domain takeover: a scheduled task escalates a local user into Domain Admin, password spray via CrackMapExec yields a single hit, SPN hashes are pulled with impacket and cracked with John to reveal real passwords, and an AD CS web enrollment is abused via impacket ntlmrelayx to fetch a DC certificate then use Kekeo to mint a DC ticket — all working end to end; AutoRuns, SDDL-hidden services and RWX memory injections explain why detections fail.
AI-written summary · about
chapters (10)
- 0:00Introduction and background
- 4:26Retail incident case study
- 7:29Warm-up demo: Persistence
- 13:41Human factor and Kerberos
- 23:46Analyzing hidden threats
- 31:09Permissions and access logic
- 33:22Advanced domain exploitation
- 40:00Threat hunting and detection
- 46:10Incident response readiness
- 48:11Leveraging AI and conclusion
related talks
58mHacking in 2016 - How is our systems broken?
49mStories from the trenches - How a red team exercise gained full control of a client network
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
52mStart covering your bases & Stop chasing APT headlines
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
39mHow to think like a hacker
23mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
12mIntroduction To Red Team Tooling And Opsec