New attack on Active Directory

[Garming Sam]

I find it continually confuddling why mimikatz continues to reimplement
what Samba is doing, and has been doing for a long while. They could
probably also build something much more sophisticated (in terms of
persistence and footprint) by just stripping down Samba.


Cheers,

Garming


On 31/01/18 06:36, Jeremy Allison via samba-technical wrote:
> https://blog.alsid.eu/dcshadow-explained-4510f52fc19d
>
> I'm still reading, but thought people on this list
> might want to get familiar with it.
>
> Don't know if it affects Samba yet.
>