The Remote Malicious Butler Did It!
summary
A network-only version of the Evil Maid attack turns up as the Remote Malicious Butler: a hacked internal host runs a rogue Domain Controller (Bluebox-style), hijacks DC traffic (ARP/DNS/LLMNR spoofing), connects to targets over RDP, triggers a password-change to poison MS-CACHEv2, extracts NTLM/MD4 blobs from LSA with mimikatz, then restores cache entries to remain stealthy. Live demo succeeds pre-patch; Microsoft patches arrive late 2015 and defenses include RDP reconnaissance hardening, NLA and Kerberos armoring.
AI-written summary · about
chapters (6)
- 0:00Introduction and announcements
- 0:53Analyzing the evil maid attack
- 4:44Technical breakdown of credential poisoning
- 16:27The remote butler attack concept
- 30:01Live demonstration
- 39:27Defense, mitigation, and conclusion
related talks
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
58mHacking in 2016 - How is our systems broken?
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
39mWindows Agentless C2: (Ab)using the MDM Client Stack
45mMCPwned: Hacking MCP Servers with One Skeleton Key... (Jonathan Leitschuh)
01h 06mComputrace Backdoor Revisited
47mFinding a Needle in an Encrypted Haystack
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures