Hacker at @OutsiderSec. Researches AD and Azure (AD) security. Likes to play around with Python and write tools that make work easier.
Sep 16, 2020 • 18 tweets • 5 min read
There seems to be quite some questions and confusion about the impact of exploiting Zerologon (CVE-2020-1472) on the environment. So here's a thread 👇
In the initial state, AD is working fine. There's a DC and a server. They trust each other because they have a shared secret: the machine account password. They can use this to talk to each other and establish encrypted channels. The shared secret is identical on both machines.