Where 2 Worlds Collide: Bringing Mimikatz et al to UNIX
summary
Claims that Active Directory–joined UNIX boxes let attackers escalate into the AD forest with concrete artifacts: proof-of-concept mimikatz-like Unix tools plus Metasploit post‑exploit modules and John the Ripper rules that crack cached hashes and extract plaintext from process memory. Tests show SSSD and a commercial winbind-style product expose cache files, IPC sockets and Kerberos tickets (often in /tmp), and many attacks require root but some IPCs are world-accessible. Mitigations include disabling credential caching, restricting ptrace, and applying SELinux and vendor hardening.
AI-written summary · about
chapters (8)
- 0:00Introduction and scope
- 2:58Active Directory theory
- 8:07Threat modeling and vectors
- 12:52Practical attack analysis
- 17:54Developing exploitation tools
- 28:03Operator-side mitigations
- 34:03Vendor collaboration
- 37:23Conclusion and Q&A
related talks
50mBeyond the Mcse: Active Directory for the Security Professional
45mYou « try » to detect mimikatz
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse Them
40mTop Active Directory Attacks: Understand, then Prevent and Detect
37mThreat Hunting in Active Directory Environment
51mAbusing Microsoft Kerberos: Sorry You Guys Don't Get It
58mHacking in 2016 - How is our systems broken?