Thread by @_wald0

New abuse primitives that take advantage of legitimate administrative protocols and features are wildly exciting. Why? Because no object is an island. Everything is interconnected, and that interconnectedness can have enormous impact. Thread: 🧵

You may or may not be familiar with the childrens' book, "If You Give a Mouse a Cookie:"

It's a classic children's moral illustrating the slippery slope idea:

If you give a mouse a cookie, it will ask for a glass of milk.
But it's too hard to drink the milk, so now the mouse wants a straw.
The mouse is worried it has a milk mustache, so now it wants a mirror.

etc

The mouse just keeps asking for more and more stuff which, in the context of what it already has, is reasonable:

It's reasonable to give the mouse milk to go with its cookie, a straw with the milk, etc - but the mouse can effectively horse trade up to whatever it wants.

We can understand and model this with math.

"If You Give a Mouse a Cookie" is a graph comprised of vertices and edges:

These discrete connections, when seen in isolation, are reasonable. The same is true in AD: it's reasonable for these particular connections to exist, but together they form an attack path:

Now, back to the original point. Finding new abuse primitives that abuse legit functionality can have extraordinarily high impact. For example, what if we found a new abuse that bypasses this path, connecting Domain Users to Domain Admins instantly?

Or, what if we had disparate, unconnected paths?

Whenever someone finds new abuses, that new abuse is very likely going to be the missing link between disparate paths, connecting Domain Users with Domain Admins:

Mathematically, the impact on the number of paths in a graph grows at a rate of O(n!) - factorial growth. That's a LOT more than even exponential growth:

Why do I say all this? Because when you consider the above, plus the fact that we are still in the infant days of Azure research, you should be excited at the impact your own Azure research can have - it is MUCH greater than you think!

In my @1ns0mn1h4ck talk, I'll try to give you all the context and fundamental building blocks you need to stat finding new abuse primitives. You can register for Insomni'hack here: insomnihack.ch/register/