Pass-the-Hash 2: The Admin's Revenge

Presented at Black Hat USA 2013, Aug. 1, 2013, 10:15 a.m. (60 minutes)

Some vulnerabilities just can't be patched. Pass-The-Hash attacks against Windows enterprises are still successful and are more popular than ever. Since the PTH-Suite was released at Black Hat last year, Microsoft published their guide for mitigating the attack. Skip and Chris will cover some of the shortcomings in their strategies and offer practical ways to detect and potentially prevent hashes from being passed on your network. Learn how to stop an attacker's lateral movement in your enterprise.

Presenters:

• Christopher Campbell
  Chris Campbell (obscuresec) is a security researcher and former operator on the US Army Red Team. He contributes to the PowerSploit project and has presented at BlackHat, Derbycon, BsidesLV, BsidesPR and Shmoocon Firetalks.
• Alva Duckwall - Accuvant Labs
  Alva "Skip" Duckwall has been using Linux back before there was a 1.0 kernel and has since moved into the information security arena doing anything from computer/network auditing, to vulnerability assessments and penetration testing. Skip holds the following certs: GSE, CISSP, CISA, and RHCE. Skip currently works for Accuvant Labs doing penetration testing.

Links:

• https://www.blackhat.com/us-13/archives.html#Duckwall
• https://infocon.org/cons/Black Hat/Black Hat USA/Black Hat USA 2013/video/Black Hat 2013 - Pass-the-Hash 2 - The Admin's Revenge.mp4
• https://www.youtube.com/watch?v=A5xntvKaRlk
• https://media.blackhat.com/us-13/US-13-Duckwall-Pass-the-Hash-Slides.pdf
• https://media.blackhat.com/us-13/US-13-Duckwall-Pass-the-Hash-WP.pdf
• https://media.blackhat.com/us-13/US-13-Duckwall-Pass-The-Hash-2-The-Admins-Revenge-Code.zip

Similar Presentations:

• DerbyCon 3.0 All in the Family (2013) / Pass-The-Hash 2: The Admin’s Revenge
• DEF CON 23 (2015) / Forensic Artifacts From a Pass the Hash Attack
• Black Hat USA 2013 / Pass the Hash and Other Credential Theft and Reuse: Mitigating the risk of Lateral Movement and Privilege Escalation