Hi, I'm DOMAIN Steve, Please Let Me Access VLAN2
Justin Perdok exploits User-ID mapping features in Palo Alto and SonicWall enterprise firewalls, spoofing domain identities to bypass network segmentation rules.
Summary
User-Based Network Policy Enforcement in Next-Gen Firewalls
To simplify firewall rules, enterprise firewalls (such as Palo Alto Networks User-ID and SonicWall SSO) dynamically map IP addresses to Active Directory usernames.
Exploiting Probing and Authentication Interception Mechanisms
Justin Perdok investigates how firewalls actively probe endpoints via NetBIOS, WMI, or XML-RPC to determine the currently logged-on user.
Spoofing Domain User Identities to Escape Network Segments
By forging NetBIOS responses or manipulating authentication probes, an unprivileged user on an isolated VLAN can spoof high-privilege domain identities, prompting the firewall to open restricted routes.
Hardening Next-Gen Firewall Identity Mappings
Perdok outlines essential configuration guidelines, advising network architects to disable unauthenticated IP probing and enforce cryptographic endpoint verification.
Related talks
Main Stage·24 min
droogie
Revives Windows null session attacks against modern Active Directory environments, demonstrating significant unauthenticated enumeration capabilities.
Main Stage·36 min
Nikhil Mittal
Introduces RACE, an open-source toolset for persistent Active Directory access using minimal-privilege ACL modifications invisible to most monitoring.
Main Stage·44 min
Marina Simakov
Presents new NTLM relay attack techniques targeting previously protected services in modern Windows environments.