Missing The Forest For The Trees: When Server Hardening Isn’t Enough

No ratings

Presented at BSidesVancouver 2019 by

Hudson Bush

youtu.be

Performing intensive server hardening without considering the other possible exploit paths can end up being a futile exercise. In fact, it’s almost like going for a smoke break at Fort Knox and leaving the back door open in the process.This is a case study on how to breach an Active Directory domain without even touching the domain directly, although the lessons can apply to most applications and platforms. Both red team and blue team demos are included, so the problem as well as possible solutions are discussed.