Feature or a Vulnerability? Tale of an Active Directory Pentest

The talk opens with a question the speaker says comes up often in penetration test reports: whether a Windows behaviour counts as a feature or a flaw. Microsoft's documentation explains clearly right and wrong configurations, the speaker argues, but says little about the gray area in between. The examples come from recent engagements inside Active Directory networks, and the emphasis is on noisy techniques rather than stealth.

The middle of the talk follows an attack chain. Fallback name resolution over broadcast and multicast lets a tester answer requests and capture NTLM hashes, which can be cracked or relayed to hosts where that account holds local admin. From there, cached credentials, pass-the-hash and pass-the-ticket move the tester between machines. Kerberoasting exposes service account passwords that are often over-privileged, and trust relationships between domains and forests can enable ticket forging. Weak group policy and broad local admin rights round out the examples.

The closing section turns to defence. The speaker recommends disabling NetBIOS and LLMNR, enforcing SMB signing, using AES for Kerberos, moving to managed service accounts, limiting admin rights, and enabling Credential Guard. Honeypot accounts and correlating logons in a SIEM are presented as ways to catch lateral movement, and BloodHound is suggested for mapping attack paths. Changes should be tested first, since hardening can break software.