Forced authentication

We have covered MITM capabilities and now will discuss in detail various ways to force authentication. The idea is that a standard user can force the target machine account (usually a domain controller) to connect to an arbitrary target. This is made possible through an automatic authentication attempt. You can find a repository with 15 known methods in 5 protocols[10]. Now, let’s dive a bit deeper into each method.

MS-RPRN abuse (PrinterBug)

This is a won’t-fix bug, which is enabled by default in every Windows environment. The idea is that by using a domain username and password, the attacker can trigger the RpcRemoteFindFirstPrinterChangeNotificationEx method and force authentication over SMB. We will demonstrate this attack later when discussing Kerberos’s unconstrained delegation in Chapter 5. A go-to tool for this abuse is called SpoolSample[11] and can be found on GitHub.

MS-EFSR abuse (PetitPotam)

The Encrypting File System...