Spooky Authentication at a Distance
Tamás Jos presents a post-exploitation technique to proxy Windows authentication protocols remotely without elevated privileges, enabling full domain takeover.
Summary
Remote Authentication Proxying in Windows
Traditional credential harvesting requires dumping memory or executing high-privilege code on target machines, often triggering immediate EDR detections.
Unprivileged Post-Exploitation Relay Techniques
Tamás Jos introduces an unprivileged post-exploitation technique that proxies native Windows authentication protocols across remote network connections directly to an operator's workstation.
Complete User Impersonation Without Local Elevated Access
By establishing an authentication bridge, red-team operators can execute actions with the target user's identity across Active Directory services without touching local system credentials.
Zero-Interaction Domain Takeover via Malicious Peripherals
A live demonstration illustrates full domain takeover using a plug-and-play malicious hardware peripheral in a restricted environment without requiring user interaction.
Related talks
Main Stage·34 min
Yuval Gordon
Discloses critical design flaws in delegated Managed Service Accounts (dMSAs) in Windows Server 2025, enabling unprivileged domain users to become Domain Admins.
Main Stage·39 min
Mehdi Elyassa
Explores new offensive attack paths and privilege escalation techniques targeting Microsoft System Center Configuration Manager (MECM/SCCM) in enterprise networks.
Main Stage·21 min
Antoine Goichot
Discloses subtle logic and authorization bypasses in Microsoft Windows Local Administrator Password Solution (LAPS) that enable credential theft.