The Secret Life of Krbtgt
Christopher Campbell details the Secret Life of Krbtgt Christopher Campbell SECURITY RESEARCHER A tale of peril and woe, Krbtgt is the domain account that you just can't quit.
Summary
Architecture and Background
The Secret Life of Krbtgt Christopher Campbell SECURITY RESEARCHER A tale of peril and woe, Krbtgt is the domain account that you just can't quit. Quiet and harmless, it has been with your enterprise since you first installed Active Directory. Although disabled, it has witnessed years of poor configurations, remote code execution vulnerabilities and bad administrator passwords.
Vulnerability Analysis
Come hear Krbtgt's story and see why its days should be numbered. If you don't laugh, you'll cry. This talk is targeted at Windows administrators, penetration testers and incident handlers and will explore why Microsoft's implementation of Kerberos is not the answer to its many credential problems.
Exploitation and Demonstrations
Chris is a security practitioner with over a decade of experience attacking and securing enterprise networks. Currently, he is a security researcher and developer for the Harris Corporation. Formerly, Chris spent over 12 years in the U.S.
Remediation and Defensive Strategies
Army Reserve and spent four years as an operator in the Computer Exploitation section of the U.S. Army Red Team. He has a Master of Science in Information Assurance from Capitol College and holds several industry certifications that he’d prefer you not hold against him. Chris is one of the developers of PowerSploit and has given presentations at BlackHat USA, Derbycon, Shmoocon Firetalks and multiple Bsides events. He maintains a blog at www.obscuresec.com and is active on twitter (@obscuresec).
Related talks
Main Stage·50 min
Sean Metcalf
Sean Metcalf breaks down modern Active Directory exploitation vectors—including Golden Tickets, Skeleton Key, and DCShadow—alongside essential enterprise hardening practices.
Main Stage·34 min
Yuval Gordon
Discloses critical design flaws in delegated Managed Service Accounts (dMSAs) in Windows Server 2025, enabling unprivileged domain users to become Domain Admins.
Main Stage·20 min
Ceri Coburn
Ceri Coburn demonstrates privilege escalation across mixed-vendor environments where Linux/Unix MIT and Heimdal Kerberos stacks integrate with Windows Active Directory.