OK.
Let's talk through these briefly in the last video I said these solutions pretty easy.
Well that's kind of true.
Kind of false.
The solution is easy if we just go willy nilly and we disable IPG sixth this completely prevents this
attack.
Right.
If ITV 6 isn't enabled in the network then guess what.
We can't be an ITV six DNS server because there's nothing for us to do.
So disabling IP 6 can have unwanted side effects.
So the recommended thing to do is actually to prevent some of these.
So we just defined block rules instead of allow rules when we have our firewall.
So I've listed those here.
Not to worry too much about them.
This could be something to just copy a picture of and have for your notes especially if you're studying
up.
I don't think you'll ever be asked as an interview but if you're ever pulling off this sort of attack
it might be good to know for a client purpose.
Another thing to note is that if we're not using w pad then we should disable it with group policy.
And this tells you just how to do that.
And then the relaying.
So we did relaying to Al DAP and al that as we only can mitigate this by enabling Al that signing and
channel binding.
So that's another mitigation strategy here.
So we could have prevented the El that attack that you saw but typically end up signing and channeled
binding are not enabled by most clients.
I can't remember a time that I have seen it.
So last thing to consider is that we can put users into the protected users group and that would prevent
impersonation or delegation which we didn't actually cover a delegation attack but I did show you that
blog posting where it had the delegate access.
If we're able to do delegate access against a machine then we can you know just abuse that feature even
more.
And so sure to fully disable this there's a few different things that we have to do.
We can cut the head off by disabling IP B6 but best practice says hey you know we should actually just
do some block rules in the firewall.
We should disable a W pad we should disable or enable elder signing and channel binding and we should
consider moving our admin users to the protected users group.
So with this being said again don't worry too much about this.
I just like to cover the mitigation strategies to talk about it if you want to practice this in your
lab if you want to go back as we're going through some of these and you want to turn off different things.
I'm showing you in defenses and try to mitigate these I say more power to you see how this works and
how it affects certain attacks.
And I think that's a really awesome strategy as well.
Otherwise just take maybe a screenshot of this and don't focus too much on memorizing it.
So from here we got one more video left to tie everything together and then we're gonna get into post
exploitation enumeration.
So I'll catch you in the next video.