Hacker News Reader

It sounds like the initial compromise is easier than it should be, though (I can't believe that after 20 years of known issues of accepting a password hash as password equivalent in MS Windows, that MS is still making this mistake?!!

> The example below uses a few techniques: LDAP reconnaissance to discover AD FS, DCSync to export the service account’s hashes, and then Pass the Hash (PtH) to gain a session on the AD FS Server as the service account.

Yes, but also no. There's nothing inherently wrong with describe the types of keys that are stealable. Especially if it leads to mitigations.

To your point, complaining about reporting on golden tickets is like complaining when a locksmith talks about his new lockpicking methods. Of course if a locksmith ever gets to the lock it's already over, so why let them even speak?

"It rather involved being on the other side of this airtight hatchway" - Raymond Chen