OverLAPS: Overriding LAPS Logic#

Antoine Goichot (PwC Luxembourg)

• Why: LAPS is the mechanism most enterprises rely on to eliminate shared local-admin credentials across AD/Entra fleets. All prior research attacked it from the directory side; this flips to the endpoint, where the password actually lives — directly relevant to identity and endpoint posture.
• What: Client-side attacks against Windows LAPS ("LAPSv2") that let an attacker capture, manipulate, and rotate the local admin password on demand, using LAPS as a persistence mechanism on both on-prem and Entra-joined devices — a genuinely new angle, and by the same researcher who did the original 2017 LAPS abuse work. (from abstract only)
• How: PDB symbols plus light static analysis to understand LAPS internals; Frida dynamic hooking to intercept and control the password lifecycle; PoCs reproduced with Microsoft Detours for in-process hooks.
• Where applicable: Any Windows fleet running Windows LAPS or legacy LAPS; requires attacker code execution on the endpoint (a client-side precondition, not a directory compromise). General technique, not org-specific.