---
title: "Airstrike Attack: breaking into a locked domain-joined laptop (CVE-2021-28316)"
description: On Wednesday 14th of April, Matthew Johnson, one of our senior security consultants released details of a new wireless-based attack dubbed 'Airstrike'.
image: https://www.themissinglink.com.au/hubfs/shutterstock_1794130912.jpg
---

[Cyber Security.](https://www.themissinglink.com.au/news/tag/cyber-security) 19.04.21

# Airstrike Attack: breaking into a locked domain-joined laptop (CVE-2021-28316)

On Wednesday 14th of April, [Matthew Johnson](https://www.linkedin.com/in/matthew-johnson-84918a191/), one of our senior security consultants released details of a new wireless-based attack dubbed "Airstrike".

The attack allows an attacker with physical access to a locked domain-joined workstation to abuse default functionality to capture credential material and ultimately break into the device. By default, domain-joined Windows workstations allow access to the network selection UI from the lock screen.

An attacker with physical access to a locked device with WiFI capabilities (such as a laptop or a workstation) can abuse this functionality to force the laptop to authenticate against a rogue access point and capture credential material for the domain computer account.

This captured data can then be submitted to the online cracking service "crack.sh" to recover the hash of the computer account in less than 24 hours.

Once recovered, this hash combined with the domain SID can be used to forge Kerberos silver tickets to impersonate a privileged user and compromise the host.

The example provided in the attack involves the creation of a Kerberos "silver ticket" that is used to access the CIFS service of the laptop. This can then be used to authenticate the laptop using SMB and gain unrestricted access to the hard disk.

As the attack can be performed from a locked device, it can be utilised to bypass BitLocker full disk encryption and gain access to the devices file system.

In addition, as "silver tickets" can be forged for privileged users, this attack can also be leveraged to elevate privileges to that of the local administrator on the device, resulting in local privilege escalation.

The attack was responsibly disclosed to Microsoft and fixed as part of the April "patch Tuesday" security update release. The vulnerability has been assigned "CVE-2021-28316".

 

[Read more about the new wireless-based attack here. ](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-28316)

 

If you liked this article, you may also like:

[The Missing Link conquers another CTF competition](https://www.themissinglink.com.au/news/the-missing-link-conquers-another-ctf-competition)

[Red Teaming and the origins of anonymous hacking](https://www.themissinglink.com.au/news/red-teaming-and-the-origins-of-anonymous-hacking)

[On the hunt: finding 8 vulnerabilities in 8 weeks ](https://www.themissinglink.com.au/news/on-the-hunt-finding-8-vulnerabilities-in-8-weeks)

**Author**

[The Missing Link](https://www.themissinglink.com.au/news/author/the-missing-link)

share

[**](http://www.linkedin.com/shareArticle?mini=true&url=https://www.themissinglink.com.au/news/airstrike-attack-breaking-into-a-locked-domain-joined-laptop) [**](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.themissinglink.com.au%2Fnews%2Fairstrike-attack-breaking-into-a-locked-domain-joined-laptop) [**](https://www.twitter.com/share?url=https%3A%2F%2Fwww.themissinglink.com.au%2Fnews%2Fairstrike-attack-breaking-into-a-locked-domain-joined-laptop)

![The Missing Link](https://www.themissinglink.com.au/hubfs/TML-Infy-Core-Logo-RGB-Org%20-%20Edited.png)

- Featured Services
- [SmartCLOUD](https://www.themissinglink.com.au/smartcloud)
- [SmartPROTECT](https://www.themissinglink.com.au/smartprotect)
- [Application Security ](https://www.themissinglink.com.au/application-security)
- [RPA](https://www.themissinglink.com.au/ai-automation-services/ai-powered-automation/rpa-as-a-service)
- [Managed Detection ](https://www.themissinglink.com.au/managed-detection-and-response)
- [Managed IT ](https://www.themissinglink.com.au/managed-it-services)
- [Cloud Security Services](https://www.themissinglink.com.au/cloud-security-services)
- [Managed IT Security](https://www.themissinglink.com.au/managed-security-services)
- [Managed IT Sydney](https://www.themissinglink.com.au/managed-it-services-sydney)
- [Managed IT Melbourne](https://www.themissinglink.com.au/managed-it-services-melbourne)

- Legal
- [Terms & Conditions​](https://www.themissinglink.com.au/terms-and-conditions)
- [Fair Use Policy](https://www.themissinglink.com.au/fair-use-policy)
- [Terms of Use](https://www.themissinglink.com.au/terms-of-use)
- [Privacy Policy](https://www.themissinglink.com.au/privacy-policy)
- [Acceptable Usage Policy](https://www.themissinglink.com.au/acceptable-usage-policy)
- [Cookie Policy](https://www.themissinglink.com.au/cookie-policy)
- [Vulnerability Disclosure Policy](https://www.themissinglink.com.au/vulnerability-disclosure-policy)

- More
- [Contact Us ​](https://www.themissinglink.com.au/contact-us)
- [Careers](https://www.themissinglink.com.au/careers)
- [Government ​](https://www.themissinglink.com.au/government)
- [Sitemap ](https://www.themissinglink.com.au/our-sitemap)

##### Acknowledgement of Country

The Missing Link acknowledges the Traditional Owners of the land where we work and live. We pay our respects to Elders past, present and emerging. We celebrate the stories, culture and traditions of Aboriginal and Torres Strait Islanders of all communities who also work and live on this land.

**

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "The Missing Link",
    "url" : "https://www.themissinglink.com.au/news/author/the-missing-link"
  },
  "dateModified" : "2023-06-02T01:28:49.083Z",
  "datePublished" : "2021-04-19T00:37:41.000Z",
  "headline" : "Airstrike Attack: breaking into a locked domain-joined laptop (CVE-2021-28316)",
  "image" : [ "https://www.themissinglink.com.au/hubfs/shutterstock_1794130912.jpg" ],
  "mainEntityOfPage" : {
    "@id" : "https://www.themissinglink.com.au/news/airstrike-attack-breaking-into-a-locked-domain-joined-laptop",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://www.themissinglink.com.au/hubfs/TML-Infy-Core-Logo-RGB-Org%20-%20Edited.png"
    },
    "name" : "The Missing Link"
  }
}
```

```json
{
  "@context" : "https://schema.org/",
  "@type" : "WebSite",
  "name" : "The Missing Link",
  "potentialAction" : {
    "@type" : "SearchAction",
    "query-input" : "required name=search_term_string",
    "target" : "https://www.themissinglink.com.au/results{search_term_string}"
  },
  "url" : "https://www.themissinglink.com.au/"
}
```

```json
{
  "@context" : "https://schema.org",
  "@type" : "Organization",
  "logo" : "https://www.themissinglink.com.au/hubfs/svgs/TML_Logo-Aust-UK.svg",
  "name" : "The Missing Link",
  "sameAs" : "https://www.linkedin.com/company/the-missing-link-pty-ltd/",
  "url" : "https://www.themissinglink.com.au/"
}
```