PLEASE JOIN US FOR THE NEXT INSTALLMENT IN THE BLACK HAT WEBCAST SERIES

Walking Your Dog in Multiple Forests - Breaking AD Trust Boundaries through Kerberos Vulnerabilities

Thursday, June 03, 2021

11:00AM - 12:00PM PDT // 60 MINUTES, INCLUDING Q&A

Sponsored By:

ExtraHop

In larger enterprise environments multiple Active Directory forests are often in use to separate different environments or parts of the business. To enable integration between the different environments, forests trusts are set up. The goal of this trust is to allow users from the other forest to authenticate while maintaining the security boundary that an Active Directory forest offers.

In 2018, this boundary was broken through default delegation settings and Windows features with unintended consequences. In 2019 the security boundary was once again established through a set of changes in Active Directory. This research introduces a vulnerability in Kerberos and forest trusts that allows attackers to break the trust once again.

The talk will provide technical details on how Kerberos works over forest trusts and how the security boundary is normally enforced. Then the talk will discuss a flaw in how AD forest trusts operate and how this can be combined with a vulnerability in the Windows implementation of Kerberos to take over systems in a different forest (from a compromised trusted forest).

The talk will be accompanied by a proof-of-concept and a demonstration of abusing the vulnerability.

Webcast Presenters

Dirk-jan Mollema

Dirk-jan Mollema is one of the core researchers of Active Directory and Azure AD at Fox-IT. Amongst the open-source tools published to advance the state of AD research are aclpwn, krbrelayx, mitm6 and a Python port of BloodHound. He blogs at dirkjanm.io, where he publishes about new Active Directory attack chains, which included the discovery of the PrivExchange vulnerability. He is also co-author of ntlmrelayx and contributor to several other open-source tools and libraries. He presented previously at TROOPERS, DEF CON and BlueHat and was part of the 75 MSRC most valuable researchers 2018/2019 through his Azure AD research.

Jeff Deininger

Deininger has over 15 years of experience in security and IT operationswith a focus on data center technologies, service delivery and DevOps. As an AWS Security Specialist, he is interested in the observability conditions that create effective early warning systems for detecting and containing cybersecurity events.

Upcoming Black Hat Events

BLACK HAT USA

July 31 - August 5, 2021 | Las Vegas + Virtual

Black Hat c/o Informa Tech

Informa Tech Holdings LLC | Registered in the United States with number 7418737 605 Third Ave., 22nd Floor, New York, New York 10158, USA

This email was sent to newsletter@newslettercollector.com.

To understand how we use your personal information, please see our Privacy Policy | Unsubscribe