droogie - Go NULL Yourself
Revives Windows null session attacks against modern Active Directory environments, demonstrating significant unauthenticated enumeration capabilities.
Summary
NULL Sessions in Modern Active Directory
droogie presents research demonstrating that null session (unauthenticated) SMB enumeration — a technique from the Windows NT era — remains surprisingly effective against modern Windows Server and Active Directory environments due to default configuration weaknesses.
Null Session Enumeration
Null sessions allow unauthenticated SMB connections that can enumerate domain users, groups, shares, and group policy information through MSRPC endpoints (SAMR, LSARPC) without any valid credential.
Default Configuration Analysis
Despite Microsoft's attempts to restrict null sessions over the years, many organizations leave legacy settings enabled, and some configurations required for backward compatibility (pre-Windows 2000 compatibility mode) restore enumeration capabilities.
Attack Chaining
The talk demonstrates how unauthenticated user enumeration chains into password spraying, AS-REP roasting (Kerberos pre-authentication disabled accounts), and targeted phishing using harvested employee names.
Related talks
Main Stage·36 min
Nikhil Mittal
Introduces RACE, an open-source toolset for persistent Active Directory access using minimal-privilege ACL modifications invisible to most monitoring.
Main Stage·44 min
Marina Simakov
Presents new NTLM relay attack techniques targeting previously protected services in modern Windows environments.
Briefings·36 min
Baptiste David · Tillmann Oßwald
Windows Hello is the flagship of Microsoft's passwordless strategy.