How to own any windows network via group policy hijacking attacks
No ratings
Presented at Syscan 2015 by
Group Policy is a key central management technology component of Microsoft Windows domain-based networks. Its power, flexibility, scalability and ease-of-use are probably one of the key reasons that Microsoft Windows has maintained complete dominance in the business desktop market in spite of significant competition in the consumer market by Apple and Google. However, with great power comes great responsibility (Could. Not. Resist.) This talk will demonstrate how an attacker with the ability to intercept network traffic can gain SYSTEM level code execution on any domain member within a windows domain in default configuration up to and including Windows 8.1/2012R2. Additionally, two specific vulnerabilities will be described that allow this attack to work even when using more secure configuration options, such as those available via Microsoft Security Compliance Manager.