2 ms·
> They can do a pass-the-hash attack, they don't even need to brute force it for the plaintext. Ok, but that's a very Windows-specific issue. I don't know of a
by franga2000 5y ago
> They can do a pass-the-hash attack, they don't even need to brute force it for the plaintext.
Ok, but that's a very Windows-specific issue. I don't know of any other widely-deployed system vulnerable to pass-the-hash.
- GekkePrutser 5y agoThat's true but we're a Windows shop, sadly :) I'm a bit appalled at the security of AD with PTH, Kerberoast etc. In some cases you can even continue to use a nabbed ticket after the compromised account has been locked! That should never be possible IMO. I'd love to move on from AD personally. But you know... Legacy galore.