Using M(achine)ITM to Attack Active Directory
Researchers reveal machine-in-the-middle attacks targeting Active Directory authentication protocols, extending relay attacks beyond NTLM to Kerberos and hybrid environments.
Summary
Machine-in-the-Middle on Active Directory Protocols
Adversaries have long leveraged Machine-in-the-Middle (MitM) attacks against Windows authentication, exploiting the lack of mutual authentication and cryptographic signing across legacy network protocols.
Relay Attacks Beyond NTLM
Sagi Sheinfeld, Eyal Karni, and Yaron Zinar demonstrate that credential relay attacks are not restricted to NTLM, revealing novel injection techniques targeting Kerberos authentication workflows.
Compromising Critical and Hybrid Infrastructure
The speakers detail attack vectors that compromise client systems, domain-joined Unix machines, virtualization clusters, and hybrid cloud Active Directory deployments to achieve remote code execution.
Mitigation and Defensive Guidance
The authors present defensive recommendations, auditing procedures, and protocol hardening configurations to neutralize machine-in-the-middle relay threats across enterprise networks.
Related talks
Main Stage·33 min
Jim Rush · Tomais Williamson
New NTLM coercion vectors and relay attacks discovered in Windows services before Microsoft's phased deprecation of NTLM.
Main Stage·34 min
Yuval Gordon
Discloses critical design flaws in delegated Managed Service Accounts (dMSAs) in Windows Server 2025, enabling unprivileged domain users to become Domain Admins.
Main Stage·45 min
Tamás Jos
Tamás Jos presents a post-exploitation technique to proxy Windows authentication protocols remotely without elevated privileges, enabling full domain takeover.