Nikhil Mittal - RACE: Minimal Rights and ACE for Active Directory Dominance
Introduces RACE, an open-source toolset for persistent Active Directory access using minimal-privilege ACL modifications invisible to most monitoring.
Summary
Active Directory ACL Abuse with RACE
Nikhil Mittal (founder of Hacking Articles and nishang) presents RACE (Registry ACLs for Covert Access Extension), a toolset for maintaining persistent Active Directory access through stealthy ACL modifications that require only minimal privileges.
ACL-Based Persistence
Rather than using traditional high-privilege persistence mechanisms (domain admin group membership, Golden Tickets) that trigger alerting, RACE exploits the Active Directory ACL model to grant targeted, minimal permissions that enable re-access when needed without maintaining constant high-privilege presence.
Registry ACL Modifications
The technique modifies Windows registry key ACLs and Active Directory object attribute ACLs to allow low-privilege accounts to read DPAPI-protected secrets, modify user account properties, or reset passwords — actions that appear as routine system operations in event logs.
Minimal Footprint Operations
Mittal demonstrates the complete RACE attack chain from initial domain user compromise to persistent administrative access using only ACL modifications, avoiding account changes and group additions that trigger modern detection rules.
Related talks
Main Stage·34 min
Yuval Gordon
Discloses critical design flaws in delegated Managed Service Accounts (dMSAs) in Windows Server 2025, enabling unprivileged domain users to become Domain Admins.
Main Stage·39 min
Mehdi Elyassa
Explores new offensive attack paths and privilege escalation techniques targeting Microsoft System Center Configuration Manager (MECM/SCCM) in enterprise networks.
Main Stage·21 min
Antoine Goichot
Discloses subtle logic and authorization bypasses in Microsoft Windows Local Administrator Password Solution (LAPS) that enable credential theft.