Locked Masky: remotely dump domain user credentials via an ADCS

[itsMe]

This is the hidden content, please

• Sign In
• or
• Sign Up

Masky is a python library providing an alternative way to remotely dump domain users’ credentials thanks to an ADCS. A command line tool has been built on top of this library in order to easily gather PFX, NT hashes, and TGT on a larger scope.

This tool does not exploit any new vulnerability and does not work by dumping the LSASS process memory. Indeed, it only takes advantage of legitimate Windows and Active Directory features (token impersonation, certificate authentication via Kerberos & NT hashes retrieval via PKINIT). A blog post was published to detail the implemented technics and how Masky works.

This is the hidden content, please

• Sign In
• or
• Sign Up