Weaponizing DHCP DNS Dynamic Updates

Explore a novel attack tactic exploiting the "DHCP DNS Dynamic Update" feature in Microsoft environments during this 40-minute Black Hat conference talk. Delve into the complexities of DNS ecosystems and discover how unauthenticated attackers can potentially spoof arbitrary DNS records in Active Directory DNS zones. Learn about the security implications, including the possibility of intercepting authentication and achieving remote code execution. Examine various security settings designed to prevent such attacks and understand their potential shortcomings in certain scenarios. Gain valuable insights into this seemingly harmless yet potentially dangerous feature of the DHCP protocol, which is enabled by default in Microsoft DHCP servers.

Off The Record - Weaponizing DHCP DNS Dynamic Updates