The Walking Dead of AD: Escalating via Disabled Objects | Vourdas & Vasilopoulos | BSides312 2026

This talk explores a rare yet powerful Active Directory attack path that emerges from legacy DACL misconfigurations, recycled accounts, and residual object ownership. These overlooked conditions can silently reintroduce privileges even after apparent revocation, creating persistent escalation and access opportunities. We analyze how inherited permissions, transitive group memberships, and reanimated accounts from the AD Recycle Bin can combine to bypass conventional defenses. To address this, we developed a BloodHound integration that automatically detects, visualizes, and safely simulates these hidden paths, enabling defenders to identify and remediate dormant escalation routes before they can be abused. Slide deck here: https://github.com/nickvourd/Presentations/blob/main/2026/PDF/The_Walking_Dead_Of_AD_Bsides_312.pdf --- About Nikos Vourdas: Senior Offensive Security Consultant Nikos Vourdas, also known as nickvourd or NCV, is a Senior Offensive Security Consultant based in the US. With over five years of professional experience, he has actively participated in various global Tiber-EU and iCAST Red Teaming engagements. Regardless of his young age. He holds OSCE3, OSCP, OSWP, CRTL, CRTO and OASP certifications. Also, he has previously presented at DEF CON, DevSecCon, and various BSides events around the world. About Kyprianos Vasilopoulos: Tech Lead OffensiveX Kyprianos Vasilopoulos is a seasoned cybersecurity executive with over two decades of experience in red teaming, incident response, penetration testing, malware research, and offensive security strategy. He is currently the Chief Information Security Officer (CISO) at Apifon and the Co-Founder of OffensiveX, a premier hacking conference. He has led cyber operations and forensics for global events like the Beijing, Torino, and Athens Olympic Games, driven threat research and zero-day discovery at Trustwave SpiderLabs, and holds credentials from OffSec (OSCP, OSCE), Pentester Academy, Black Hills InfoSec, Zero-Point Security, and CyberWarfare Labs. He's appeared in major media like BBC News and is listed in the Zyxel Networks CVE Hall of Fame. Recorded live at BSides312 2026. --- Chapters: 0:00 Introduction and an Audience Photo for Mom 0:55 Who Am I: Nikos and Kyprianos 2:45 Once Upon a Time in California 3:00 The Engagement That Was Only a Retest 3:55 "Can You Gain Domain Admin?" 4:15 Enumerating With BloodHound 4:35 GenericWrite to a User Called Lazarus 4:55 The Catch: Lazarus Is Disabled 5:30 No Direct Path to Domain Admin 6:45 Fundamentals: ACLs, ACEs, DACLs and SACLs 8:15 What GenericWrite Actually Grants 9:10 Exploitation: Enabling the User 10:05 "Lazarus, Come Out" 11:00 Shadow Credentials vs. RBCD 12:20 Whisker and msDS-KeyCredentialLink 13:20 Certipy and Extracting the NT Hash 13:45 How Does Certipy Actually Work? 14:40 Understand What Your Tools Do Behind the Scenes 15:35 Re-Enumerate: ADCS Templates 16:30 ESC1 and Its Prerequisites 17:25 Domain Admin 17:50 Back in Chicago, Scratching My Head 19:15 Which Permissions Can Enable a Disabled User? 20:20 GenericAll and WriteOwner Examples 22:00 What Can You Do After Enabling? 22:55 Active Directory Contains More Than Users 24:45 ADCS Templates and ESC4 26:00 The adminCount=1 Problem and AdminSDHolder 27:30 The Rare Case: Inheritance Denied by Mistake 28:45 The Tools: Lazarus-WakeUp 30:15 BloodHound Cypher Queries 32:30 The Art of Defense 33:15 Remediation and Building a Detection 34:15 Five EDRs, None of Them Detect This 35:10 Don't Rely Only on Your EDR 36:00 Q&A 41:15 Closing: My Last Chicago Talk --- Mentioned in this talk: - BloodHound and SharpHound - Certipy - Whisker / pywhisker - Lazarus-WakeUp - SpecterOps AdminSDHolder research - Sigma rules - ELK / KQL Full BSides312 2026 playlist: https://www.youtube.com/playlist?list=PLZnyzZE8j8jw