Tamas Jos: Passwordless Remote Authentication
A DEF CON 31 talk introducing a new post-exploitation technique in Windows networks. It allows an attacker to use a victim’s authentication remotely by proxying NTLM or Kerberos through a compromised machine — without admin privileges and without knowing the password.
By leveraging SSPI and LSASS, a small agent on the victim’s system forwards the authentication context to the attacker.
This enables actions from the attacker’s own machine under the victim’s identity — such as accessing SMB or LDAP services, or performing attacks like Kerberoasting.
By leveraging SSPI and LSASS, a small agent on the victim’s system forwards the authentication context to the attacker.
This enables actions from the attacker’s own machine under the victim’s identity — such as accessing SMB or LDAP services, or performing attacks like Kerberoasting.