SpecterOps: iSCSI Target Server without CHAP lets a host that knows the target and initiator names read…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
2
2 hosts
Action items (1)
Do-now tasks recorded on the entries about Microsoft iSCSI Target Server, newest first. Check the date before acting on an older one.
List the computers in Active Directory that carry the service principal name the iSCSI Target Server registers and every host that listens on TCP 3260, then enable CHAP on each target and restrict TCP 3260 to the addresses of the cluster nodes, starting with targets whose volumes hold Hyper-V disks of domain controllers.
4 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)
Credential AccessOS Credential Dumping: Security Account Manager · OS Credential Dumping: NTDS · OS Credential Dumping: LSA Secrets
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the <code>net user</code> command. Enumerating the SAM database requires SYSTEM level access.
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts. LSA secrets are stored in the registry at <code>HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets</code>. LSA secrets can also be dumped from memory.
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping, <code>net view</code> using Net, or, on ESXi servers, `esxcli network diag ping`.
SpecterOps shows that the Windows iSCSI Target Server role, set up as a community cluster guide describes it with the optional CHAP step skipped, accepts a login from any host that knows the target host, the target name and an authorised initiator name (SpecterOps, 2026-11-04). The post says the role registers a service principal name on its computer account, so a directory query lists the target hosts, that initiator names are built from the host's DNS name and are therefore predictable, and that in the author's experience the service has no rate limiting or brute-force protection (SpecterOps, 2026-11-04). Access is below the file system, so NTFS permissions do not apply, and volume encryption such as BitLocker defeats it (SpecterOps, 2026-11-04). The worst case the post shows is a volume that holds a Hyper-V domain controller's virtual disk, from which the local credential stores and the directory database can be taken (SpecterOps, 2026-11-04). The author has not tested the technique in production and warns that it can cause outages, and the post cites no Microsoft response.
Without CHAP authentication configured, all that’s required to “login” is to know what host has the iSCSI target service installed along with its iSCSI target IQN and its client initiator IQNs.
Arguably the most effective thing you can do is have proper network segmentation and host-based firewall configurations to isolate the drive