OverLAPS: Overriding LAPS Logic
Discloses subtle logic and authorization bypasses in Microsoft Windows Local Administrator Password Solution (LAPS) that enable credential theft.
Summary
Windows LAPS in Enterprise Active Directory
Microsoft Windows Local Administrator Password Solution (LAPS) manages and randomizes local administrator account passwords on domain-joined machines, storing credentials securely in Active Directory or Azure.
Discovering Logic and Authorization Flaws
Antoine Goichot analyzes the internal encryption and permission check mechanisms of Windows LAPS (including modern Azure-backed Windows LAPS), discovering subtle authorization discrepancies in password retrieval.
Overriding LAPS Logic for Lateral Movement
By manipulating object ACLs and exploiting attribute synchronization timing, attackers with delegated permissions can force password recalculation or access plaintext administrative passwords across domain endpoints.
Hardening LAPS Deployments
Securing LAPS requires implementing strict Active Directory attribute access controls, auditing password read events, and migrating to modern cloud-managed LAPS with end-to-end encryption.
Related talks
Main Stage·34 min
Yuval Gordon
Discloses critical design flaws in delegated Managed Service Accounts (dMSAs) in Windows Server 2025, enabling unprivileged domain users to become Domain Admins.
Main Stage·39 min
Mehdi Elyassa
Explores new offensive attack paths and privilege escalation techniques targeting Microsoft System Center Configuration Manager (MECM/SCCM) in enterprise networks.
Creator Stage·43 min
Brandon Colley
Walks through attack paths in the Game of Active Directory lab environment and demonstrates practical misconfiguration mitigations.