NTLM: The Last Ride
New NTLM coercion vectors and relay attacks discovered in Windows services before Microsoft's phased deprecation of NTLM.
Summary
The Long Goodbye of NTLM Authentication
Microsoft is planning to kill off NTLM (New Technology Lan Manager) authentication in Windows 11 and above. Let's speedrun coercing hashes out of a few more things before it fades into obscurity over the next twenty five years or so.
Novel NTLM Coercion Bugs Disclosed to Microsoft
There will be a deep dive on several new bugs we disclosed to Microsoft (including bypassing a fix to an existing CVE), some interesting and useful techniques, combining techniques from multiple bug classes resulting in some unexpected discoveries and some absolutely cooked bugs. We’ll also uncover some defaults that simply shouldn't exist in sensible libraries or applications as well as some glaring gaps in some of the Microsoft NTLM related security controls.
Related talks
Main Stage·47 min
Sagi Sheinfeld · Eyal Karni · Yaron Zinar
Researchers reveal machine-in-the-middle attacks targeting Active Directory authentication protocols, extending relay attacks beyond NTLM to Kerberos and hybrid environments.
Main Stage·44 min
Marina Simakov
Presents new NTLM relay attack techniques targeting previously protected services in modern Windows environments.
Main Stage·37 min
Or Yair · Shahak Morag
Discloses new remote denial-of-service vulnerabilities in Windows RPC and Active Directory that enable cascading Win-DoS and Win-DDoS epidemics across Domain Controllers.