LAPS Client-Side: The Overlooked Attack Surface

▶ Watch (2:00)

Previous LAPS research focused on the server side—abusing authorized accounts to read passwords. Goichot turned to the client side, where Microsoft’s DLLs run with SYSTEM privileges. LAPS V2 uses three main DLLs; the core logic lives in laps.dll. Microsoft ships PDB files, making internal function names visible. Goichot’s earlier work with Max Clement showed you could swap admpwd.dll on V1. For V2, the closed-source DLL required hooking rather than replacement. His lab used two clients: one domain-joined (Active Directory) and one Entra ID-joined. He assumed local admin access and bypassed PPL for research.

Capturing LAPS Passwords via Function Hooking

▶ Watch (6:55)

Goichot used Frida to hook NetUserSetInfo from samsrv.dll, which LAPS calls to change the local admin password. The function receives a pointer to a UNICODE_STRING structure. Applying the correct offset reveals the plaintext password. He demonstrated this on both AD and Entra ID setups: after expiring the password and running gpupdate, the hook captured the new password. He also hooked an internal function, ResetLocalAdminAccountPassword, by finding its offset from PDB symbols. Both methods worked without modifying registry or directory data. The password was written to a file in real time.

Desynchronizing Passwords Between Client and Directory

▶ Watch (11:06)

Goichot showed two desynchronization options: change the local password without updating the directory, or change the directory value without touching the local one. In the demo, he modified the password sent to the directory via hooking, so an admin reading from Active Directory saw a random string while the actual local password remained the original. The impact alone is limited—the real password stays random. But combined with other techniques it enables denial-of-service: LAPS cannot reset the admin account because the directory copy does not match the local state. He confirmed this works on both AD and Entra ID.

Forcing Password Changes on Demand

▶ Watch (12:34)

The third objective was triggering a password rotation regardless of expiration. Goichot hooked the password expiration check functions for both AD and Entra ID. He forced the return value to indicate “expired” even when the password was fresh. After hooking, each gpupdate cycle changed the password. For Entra ID, an easier approach existed: modifying the registry key AzurePasswordExpiryTime. Changing that Windows file time value to a past date tricked LAPS into considering the password expired. A subsequent gpupdate rotated the password. Setting the value to the future could break LAPS entirely.

Notable Quotes

so all the box that I showed and additional are available on this gitub repository Antoine Goichot · ▶ 20:56

watch for unexpected laps reset because if you are not using laps the reset of the laps password should more or less match the rotation period Antoine Goichot · ▶ 20:25

Key Takeaways

  • Client-side LAPS attacks bypass server-side access controls by hooking laps.dll functions.
  • Two hooking frameworks, Frida and Microsoft Detours, can capture plaintext passwords.
  • Desynchronizing the local and directory copies of the LAPS password enables denial-of-service.
  • Forcing password rotation on demand works by modifying registry values on Entra ID clients.
  • Blue teams should monitor for password resets that occur outside the configured rotation period.
  • Attackers need local admin access and must bypass PPL to use these techniques.

About the Speaker(s)

Antoine Goichot is a French cybersecurity professional and Ethical Hacker working in Luxembourg. With ten years of hands-on experience and certifications including CRTO/CRTL, GPEN/GXPN, and GDAT, he has been hacking since junior high school. He studied computer science and networks at TELECOM Nancy and now serves as Senior Manager at PwC Luxembourg, leading projects for major corporations, banks, European institutions, and insurance companies. He has uncovered several vulnerabilities in Windows VPN clients, Cisco AnyConnect (CVE-2020-3433/3434/3435, CVE-2020-27123, CVE-2021-1427) and Ivanti Secure Access (CVE-2023-38042). He co-presented at Hack.lu in October 2017 on “Malicious use of ‘Local Administrator Password Solution’”.