Attacking Self-Hosted Skype for Business/Microsoft Lync Installations

**Executive summary:** This blog post provides a step-by-step offensive guide for attacking self-hosted Skype for Business (Lync) servers: locating Front-End servers via lyncdiscover subdomains, extracting internal NetBIOS/DNS information through NTLM-protected endpoints, performing timing-based user enumeration with a tool (lyncsmash), and conducting brute-force attacks against NTLM-protected directories or the WebTicket authentication service using Medusa or Burp Intruder, potentially exposing internal AD accounts and enabling access to the internal network.