Hack.lu 2017 Malicious use of Microsoft “Local Administrator Password Solution”
Channel: Cooper
Date: 2017-10-17

Malicious use of Microsoft “Local Administrator Password Solution”

by Maxime Clementz & Antoine Goichot

“Local Administrator Password Solution”, known as LAPS, provides management of local account passwords of domain joined computers. Passwords are stored in Active Directory (AD) and protected by ACL, so only eligible users can read it or request its reset.

We started some security research on this solution and managed to get illegitimate access to local administrator credentials (and to control the generation of a new administrator password) in a post-exploitation scenario (to maintain presence on a compromised computer). Moreover, depending on the method used to deploy LAPS, we also elaborated a privilege escalation scenario.

Both scenarios will be demonstrated on stage, we will explain the inner working of LAPS and our exchanges with the Microsoft Security Response Center.

Bio: Maxime Clementz & Antoine Goichot

Maxime @maxime_tz and Antoine @AntoineGoichot joined the Cyber Security Advisory team at PwC Luxembourg in 2012 and 2015, respectively. Their favourite assignments are penetration tests and information security advisory. When they have the occasion to perform vulnerability research or Security R&D, they are always delighted to present their results (Hack.lu 2012, 2015 and now 2017!).