2026-10-02 –, STAGE 2 (Ghost in the Shellcode) Language: English
"You need local admin for that." It's one of the most repeated assumptions in offensive Windows tradecraft, and it's mostly wrong.
Most of these techniques are gated by a specific set of access-mask and DACL permissions, not by group membership, so the real question isn't "am I admin?" but "what do I actually need?" This talk answers that systematically: what each lateral-movement technique truly requires, instead of what folklore and our tooling assume.
We'll walk through the true minimum rights behind service creation and reconfiguration, DCOM, WinRM, WMI (over both DCOM and WSMAN), Remote Registry, Remote GhostTask, Remote Network Provider hijack, RDP and RDP Shadowing, SSH, and User Right Assignments. Along the way we'll hit the under-documented Microsoft policy that silently breaks "non-admin service creation," the granular access masks that make these paths work (0x0003 on the SCM, 0x00011 for shadowing, and friends), and why those same minimal rights double as quiet persistence.
The uncomfortable part cuts both ways. BloodHound edges, NetExec's "Pwned!", and group-membership checks systematically miss these configurations, so attackers slip through and defenders never see it. I'll cover MovementHound, a PowerShell minimal-rights enumerator that surfaces these overlooked paths and feeds the missing edges straight into BloodHound, with a recorded demo of it in action.
Expect granular access-mask details and honest caveats.
Offensive Security Researcher, with a soft spot for Windows internals and Active Directory. Ever since I was a kid I wanted to know what was happening under the hood, taking things apart just to understand why they worked, and that itch never went away; it just grew into a passion for breaking and understanding Windows environments.