🔑 Three-Headed Potato Dog: NTLM and Kerberos Coercion

New research demonstrates how DCOM can coerce Windows systems to authenticate remotely, allowing attackers to relay NTLM or Kerberos authentication to AD CS over HTTP. This enables remote and cross-session authentication relay attacks, targeting both machine and user accounts.

🔗 Research:
https://blog.compass-security.com/2024/09/three-headed-potato-dog/

🔗 Source:
https://github.com/sploutchy/impacket/blob/potato/examples/potato.py

#ad #windows #dcom #relay #potato