articles

A token is a temporary key that enables you to access a system or network without having to give credentials every time you access a resource. These tokens contain information such as : User identity Groups to which the user belongs User privileges There are two types of token: Delegate: Created when a user logs on to a machine or connects to a machine via RDP, these tokens enable a user to usurp the identity of a user on another machine on the network (e.g. a service accessing files on an...

DefinitionServer Message Block (SMB) is a protocol for sharing files, accessing printers and other resources on a network. It is generally present on ports 445 and 139. It is natively included on Windows. For Linux machines, it is necessary to first install a Samba server, as Linux does not use this protocol by default. SMB enumerationSMB enumeration aims to discover the different shares available on the network, the access permissions to the share and the users and groups present on the mac...

DefinitionPrintNightmare is an attack exploiting a vulnerability in the Windows print spooler which allows a simple user to execute remote commands with administrator privileges. The term PrintNightmare actually refers to two vulnerabilities exploiting the print spooler. One allows privilege escalation and the other allows remote code execution. In this article, we’ll focus solely on the latter. On June 7, 2021, Microsoft released its latest security patch for this vulnerability, which allows...

DefinitionThe NTLM protocol is an old authentication protocol used by Windows machines to authenticate at domain or network level. It’s a Challenge / Response protocol, so it lets you authenticate to a server without the password ever passing over the network. This protocol is widely used by companies in conjunction with the Kereberos protocol. Only companies with a good cyber maturity no longer use it, as it’s not easy to do without. How it worksWhen a client wants to authenticate to a ...

DefinitionA very simple attack to retrieve credentials stored in the SYSVOL share, which can be used to gain a shell or escalate privileges. A GPP (Group Policy Preference) is an old-fashioned feature that lets you configure preferences on machines in an Active Directory. Unlike GPOs, GPPs are not strictly applied to machines in an AD domain, and allow users to modify settings after they have been applied. GPPs are often used for : Create desktop shortcuts Configure network drives automatic...

A Golden ticket attack is a specific type of attack on the kerberos authentication protocol. Kerberos is used to securely authenticate users and services on a network. What is a Golden ticket attack?The Golden ticket attack exploits the way Kerberos works, and in particular the generation of the TGT by the KDC. If an attacker gains access to the krbtgt account, the account used by the KDC to sign TGTs, an attacker can create fake tickets known as “Golden Tickets”. These tickets allow an attac...