This speech will begin with an introduction to the Active Directory architecture, a recap of the Active Directory weaknesses throughout the past decade, ranging from MS14-068 to Zerologon, and the state-of-the-art intranet intrusion techniques, such as pass-the-hash, pass-the-ticket, man-in-the-middle attacks, to inform the audience on current information gap between the attacker and the defender.

In view of the findings of several red teaming exercises, Hans and his team found that defenders still consider the old-school large-scale scanning and system account addition, and administrator privilege escalation to be the hacking techniques on intranet. Hans will also share how hackers invade corporate networks, perform lateral movement, and hunt down systems’ high-value targets. 

 

Hackers leverage service vulnerabilities such as SharePoint exploit to conduct lateral movement, obtain domain administrator privilege, and to DCSync domain servers to gain control of the highest domain administrator privileges, similar to ransomware widely deploying software to end users to establish persistent backdoors such as Gold Ticket. Security tools (WAF, IPS, EDR, AV software, etc.) and common bypassing techniques encountered during red teaming exercises will also be discussed.

 

Hans aspires to promote world peace and help defender to leave office early to work from home.