7 ms·

Abusing Exchange: One API call away from Domain Admin

• dang 8y ago
  Url changed from https://www.theregister.co.uk/2019/01/25/microsoft_exchange_domain_admin_eop https://www.theregister.co.uk/2019/01/25/microsoft_exchange_..., which points to this.
• cheschire 8y ago
  Is there some fundamental flaw I don't know about in kerberos that keeps people going back to NTLM in this decade?
  • amaccuish 8y ago
    It's more old products that don't support Kerberos (think old scanners that store scans on a file share, or an old http proxy), or the fact that Kerberos doesn't work if using IP addresses to connect to things, or from machines outside of a domain.
  • jve 8y ago
    Probably one side of equation is that NTLM just works. For kerberos, you mostly have additional effort to manually add SPN. Moreover for load balanced Exchange, you must deal with alternate service account: https://docs.microsoft.com/en-us/exchange/architecture/client-access/kerberos-auth-for-load-balanced-client-access?view=exchserver-2019 https://docs.microsoft.com/en-us/exchange/architecture/clien...
    • jve 8y ago
      Moreover (didn't have time to read yet) seems that there is just today public disclosure which highlights some issues with Kerberos: https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html Don't get me wrong - thats not a case where someone should choose NTLM over more secure Kerberos. Just that we should note Kerberos should be configured appropriately.
  • deleted 8y ago
    [deleted]