From Printers to Silver Tickets or Something
Demonstrates pivoting from compromised networked printers into Active Directory environments to forge Kerberos silver tickets.
Summary
Evil Mog from Team Hashcat and X-Force Red demonstrates an end-to-end Active Directory exploitation chain starting from an insecure network printer and escalating all the way to Kerberos Silver Tickets and domain credential dumping. He explains how embedded devices like network multifunction printers frequently store unencrypted LDAP service account credentials or permit simple bind capture when reconfigured to point to an attacker-controlled service.
The presentation walks through extracting cached credentials, identifying service principal names (SPNs), and formatting captured hashes for high-speed cracking with Hashcat. At 02:58, Evil Mog demonstrates configuring target service accounts and executing ticket requests. He details using Impacket tools at 08:22 and 09:48 to forge Silver Tickets with specific service rights, ultimately executing `secretsdump.py` (11:01) against domain controllers to harvest Active Directory domain hashes without generating domain-wide Golden Ticket alerts.
(AI summary — Gemini Flash)
Related talks
Password Village·12 min
EvilMog
Walks through exploiting embedded printer credentials to pivot across domain infrastructure and mint silver tickets.
Main Stage·46 min
Tianze Ding
Tianze Ding demonstrates chaining Microsoft Exchange vulnerabilities with Active Directory trusts, escalating a low-privilege domain user to full Domain Admin.
Main Stage·34 min
Yuval Gordon
Discloses critical design flaws in delegated Managed Service Accounts (dMSAs) in Windows Server 2025, enabling unprivileged domain users to become Domain Admins.