06 - Dustin "EvilMog" Heywood - Print Spooler to Domain Admin in 30 Minutes or less
Channel: Per Thorsheim
Date: 2020-11-23

This talk walks through the MS-RPRN Print Spooler Notify Service and how to force a domain controller to authenticate with you with an NTLMv1 hash of its Active Director Machine Account. The NTLMv1 is then reversed to NTLM so that a Silver Ticket can be generated and a dcsync executed. NTLMv1 is now a liability and this talk demonstrates how.