4678 matches found
PetitPotam: Novel Attack Chain Can Fully Compromise Windows Domains Running AD CS
The PetitPotam attack vector was assigned CVE-2021-36942 and patched on August 10, 2021. See the Updates section at the end of this post for more information. Late last month July 2021, security researcher Topotam published a proof-of-concept PoC implementation of a novel NTLM relay attack...
Microsoft Windows Active Directory Certificate Services can allow for AD compromise via PetitPotam NTLM relay attacks
Overview Microsoft Windows Active Directory Certificate Services AD CS by default can be used as a target for NTLM relay attacks, which can allow a domain-joined computer to take over the entire Active Directory. Description PetitPotam is a tool to force Windows hosts to authenticate to other...
CISA’s Top 30 Bugs: One’s Old Enough to Buy Beer
In a perfect world, CISA would laminate cards with the year’s top 30 vulnerabilities: You could whip it out and ask a business if they’ve bandaged these specific wounds before you hand over your cash. This is not a perfect world. There are no laminated vulnerability cards. But at least we have th...
Audit Logs Store LDAP Password in Plain Text
h3. Problem In Confluence, when an external LDAP directory is created/modified, Audit logs store the LDAP connection password as plain text. h3. Environment 7.4.x . h3. Steps to Reproduce 1. In Confluence, create or modify a directory as Microsoft Active Directory, Crowd, Jira etc 2. After...
Audit Logs Store LDAP Password in Plain Text
h3. Problem In Confluence, when an external LDAP directory is created/modified, Audit logs store the LDAP connection password as plain text. h3. Environment 7.4.x . h3. Steps to Reproduce 1. In Confluence, create or modify a directory as Microsoft Active Directory, Crowd, Jira etc 2. After...
AD Starter Scan - Kerberoasting
Binary data adsikerberoasting.nbin...
AD Starter Scan - Non-Expiring Account Password
Binary data adsiaccountpwd.nbin...
AD Starter Scan - Kerberos Pre-authentication Validation
Binary data adsikerberospreauth.nbin...
AD Starter Scan - Null sessions
Binary data adsinullsession.nbin...
AD Starter Scan - Kerberos Krbtgt
Binary data adsikerberoskrbtgt.nbin...
AD Starter Scan - Weak Kerberos encryption
Binary data adsikerberosenc.nbin...
AD Starter Scan - Blank passwords
Binary data adsiblankpwd.nbin...
AD Starter Scan - Primary Group ID integrity
Binary data adsipgid.nbin...
Podcast: Why Securing Active Directory Is a Nightmare
This week, Microsoft rushed out a fix for a Windows NT LAN Manager exploit dubbed “PetitPotam” that forces remote Windows systems to reveal password hashes that can be easily cracked. The frenzy begs the question: Why is securing Microsoft Active Directory AD such a nightmare? When security...
Microsoft Active Directory Certificate Services NTLM Relay (CVE-2021-36942; CVE-2022-26925)
An NTLM relay vulnerability exists in Microsoft Active Directory Certificate Services. A remote attack can coerce Windows hosts to authenticate to other machines via the MS-EFSRPC protocol and obtain its NTLM credential. Successful exploitation could lead to complete takeover of the target domain...
Microsoft Releases Guidance for Mitigating PetitPotam NTLM Relay Attacks
On July 23, Microsoft released KB5005413: Mitigating NTLM Relay Attacks on Active Directory Certificate Services AD CS to address a NTLM Relay Attack named PetitPotam. CISA encourages users and administrators to review KB5005413 and apply the necessary mitigations. This product is provided subjec...
How to Deploy Citrix Gateway Plug-in and Endpoint Analysis Installer Packages for Windows by Using Active Directory Group Policy
This article contains information about deploying the Citrix Gateway Plug-in and Endpoint Analysis EPA Microsoft Installer MSI packages for Windows by using an Active Directory Group Policy. If users do not have administrative privileges to install the Citrix Gateway Plug-in and EPA Plug-in on th...
Microsoft Rushes Fix for ‘PetitPotam’ Attack PoC
Microsoft was quick to respond with a fix to an attack dubbed “PetitPotam” that could force remote Windows systems to reveal password hashes that could then be easily cracked. To thwart an attack, Microsoft recommends system administrators stop using the now deprecated Windows NT LAN Manager NTLM...
New PetitPotam NTLM Relay Attack Lets Hackers Take Over Windows Domains
A newly uncovered security flaw in the Windows operating system can be exploited to coerce remote Windows servers, including Domain Controllers, to authenticate with a malicious destination, thereby allowing an adversary to stage an NTLM relay attack and completely take over a Windows domain. The...
AvosLocker enters the ransomware scene, asks for partners
This blog post was authored by Hasherezade In mid-July we responded to an incident that involved an attack on a Microsoft Exchange server. The threat actor used this entry point to get into a Domain Controller and then leveraged it as a springboard to deploy ransomware. While examining the...