When Everyone's Dog is Named Fluffy
summary
Demonstrates a working domain‑wide persistence method that remotely writes JSON answers into LSA secrets by changing registry ACLs (proof‑of‑concept Python), computes the AES key from local registry artifacts to encrypt the secret, and then uses an RDP NLA bypass (RDP file flag) to access the Winlogon reset UI and reset passwords to the answer "fluffy" (they even use emojis). The proof also restores the previous NTLM hash via an undocumented SamSetInformationUser call so the change is invisible. Fixes: enforce NLA GPO, audit ACLs and reset events, or disable questions in enterprise.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:32The story begins
- 1:21Windows Security Questions Feature Overview
- 1:45Usage
- 2:05The History of Security Questions
- 2:45Windows Passwords vs. Security Questions
- 4:48Security Attack Scenarios
- 7:18Roadmap
- 7:43LSA Secrets Introduction
- 7:57LSA Secrets Encryption
- 9:18LSA Secrets Permissions
- 10:29blackhat Security Question LSA Secret
- 11:11Remote LSA Secrets Read/Write Implementations
- 12:02Remote Password Reset
- 14:36Restore Previous Password
- 15:27Demo
- 18:01Goal Achieved
- 18:42Recommendations
related talks
47mCunning With CNG: Soliciting Secrets From Schannel
47mFinding a Needle in an Encrypted Haystack
49mThe Remote Malicious Butler Did It!
26mBypassing Local Windows Authentication To Defeat Full Disk Encryption
23mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
35mWalking Your Dog in Multiple Forests - Breaking AD Trust Boundaries through Kerberos Vulnerabilities
14mOnelogon: Taking over Active Directory Accounts via Netlogon