Marina Simakov - Relaying Credentials has Never Been Easier
Presents new NTLM relay attack techniques targeting previously protected services in modern Windows environments.
Summary
Modern NTLM Relay Attacks
Marina Simakov (security researcher, Preempt Security) presents new NTLM relay attack vectors and techniques that bypass Microsoft's published mitigations and target services previously believed to be protected from relay attacks.
NTLM Relay Background
NTLM relay attacks intercept NTLM authentication handshakes and forward them to a different target server, authenticating as the victim to services they didn't intend to access. Microsoft's mitigations (SMB signing, EPA/channel binding) block relay in many scenarios.
Bypass Techniques
Simakov presents CVE-2019-1040, a vulnerability in the NTLM authentication protocol that allows dropping MIC (Message Integrity Code) and modifying authentication messages, enabling relay even to SMB-signed targets. The bypass breaks EPA (Extended Protection for Authentication) for many real-world configurations.
Cross-Protocol Relay
The talk demonstrates relaying NTLM from HTTP to LDAP/LDAPS, enabling creation of new computer accounts and delegation rights in Active Directory without any credentials — providing a path to full domain compromise from only network access.
Related talks
Main Stage·33 min
Jim Rush · Tomais Williamson
New NTLM coercion vectors and relay attacks discovered in Windows services before Microsoft's phased deprecation of NTLM.
Main Stage·24 min
droogie
Revives Windows null session attacks against modern Active Directory environments, demonstrating significant unauthenticated enumeration capabilities.
Main Stage·36 min
Nikhil Mittal
Introduces RACE, an open-source toolset for persistent Active Directory access using minimal-privilege ACL modifications invisible to most monitoring.