4 Get requests = 3 Domain admins: CyberArk magic you didn’t know about | SO-CON 26

Speaker: Marat Nigmatullin

CyberArk Privilege Access Management is a powerful tool for protecting privileged accounts, but what happens when its configuration and permissions are less than ideal? In this talk, we'll dive deep into the inner workings of CyberArk's Privileged Vault Web Access (PVWA) and Central Credential Provider (CCP) components, uncovering how misconfigurations and overlooked permissions can lead to unexpected and potentially dangerous consequences.

We'll demonstrate how the CCP REST API can be abused to extract credentials from CyberArk vaults, enabling privilege escalation in just a few simple steps. Additionally, we'll explore key concepts related to CyberArk's PVWA vault access controls, the integration of CCP into PVWA, and how specific configurations can be exploited to compromise credentials.

Slides: https://github.com/SpecterOps/presentations/tree/main/SO-CON%202026/Marat%20Nigmatullin%20-%204%20Get%20requests%20%3D%203%20Domain%20admins%20CyberArk%20magic%20you%20didn%E2%80%99t%20know%20about

SO-CON: https://specterops.io/so-con/

Видео 4 Get requests = 3 Domain admins: CyberArk magic you didn’t know about | SO-CON 26 канала SpecterOps