Let the Children play - Leveraging AD CS for persistence and profit in Parent-Child configured forests.

No ratings

Presented at BSides Cape Town 2023 by

Tinus

In 2021, Active Directory Certificate Services came under scrutiny because of the opportunities it provides attackers for credential theft, domain escalation, and persistence. It has become a household name for red and blue teams. This talk will cover new discoveries from two perspectives: * Lateral Movement - Noisy compromises of the Parent domain to get to other Child domains are a thing of the past * Cross-Domain Escalation - A newly discovered default permission misconfiguration allowing forest-wide persistence from any Child domain