Know Your Adversary | SpecterOps with Special Guest Raj Patel (Ep. 19)
Source: YouTube · SpecterOps · published Nov 12, 2026 · 23:26
Specter Ops researcher Raj Patel used AI (Codex) to discover SMB and LDAP signing bypasses that defeat NTLM relay protections, enabling full domain takeover until patched (2:00-3:05, 8:02-8:20).
Key Takeaways:
• Codex found that an established SMB session key can be reused to relay another user's credentials, signed with the known key—breaking the SMB signing defense trusted for 20-25 years (2:00-3:05, 6:34-6:53).
• The bug affected every Windows version; any authenticated user could chain it to DCSync and domain admin, with patching as the only defense (9:43-10:17).
• After the SMB patch, Raj found a similar LDAP bypass—even via anonymous connections—enabling relay between domain controllers for instant domain takeover via RBCD or shadow credentials; reported to MSRC Oct 6, patched Oct 13 (11:32-11:46, 13:11-14:45, 15:00-15:30).
• Critical reveal: NTLMv1 with extended security remains vulnerable to both bypasses—Microsoft's fix only covers NTLMv2 (19:55-20:20).
Patch domain controllers immediately and accelerate moving away from NTLM entirely (21:55-23:11).
Sources:
- 2:00-3:05 Codex discovers reusable session keys
- 6:34-6:53 SMB signing bypass mechanics
- 8:02-8:20 "Raj broke Active Directory"—signing isn't a control
- 9:43-10:17 All Windows versions affected, patch-only defense
- 13:11-14:45 LDAP signing bypass details
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Raj Patel set out to research Keros relay. What he found challenged a defense that security teams had trusted for years. We follow his research from SMB to LDAP. Explore AI's role in their discovery and discuss what it means for protecting Active Directory. This is Know Your Adversary by Spectre Ops. >> Welcome back to the Know Your Adversary podcast. I'm Jared Atinson. I'm Justin Kohler >> and today we're joined by our colleague at Spectre Ops, Raj Patel. Raj, uh, do you want to maybe give us a little bit of an introduction to you? Tell us a little bit about yourself, how you got started in cyber security, where you find yourself today. >> So I started in cyber security six years ago I think and I started as an intern in a pentesting team. So my professor told me if you get your OCP then …