Pen test: domain-joined Windows 7 server yielded domain admin via EternalBlue
Original title: Admin dropped the F-bomb in a password to show hackers who was really 1337
A leetspeak insult password was a real domain admin credential; the outdated domain-joined machine, not a weak password, was the entry point.
The Register recounts a Suzu Labs factory assessment by Dahvid Schloss after a client was hacked six months earlier. Most Windows 7 CNC servers were off the domain, so EternalBlue led nowhere useful. One domain-joined server was vulnerable; dumping LSASS exposed WDigest credentials, including a senior IT manager’s insult-themed admin password that worked and gave full network control. Other recovered passwords were also insults aimed at hackers.
Unconfirmed: The factory and client are not named; the account is Schloss’s retelling via The Register.
- Schloss sat on the credential for about a week before it worked on a Monday.
- Local admin passwords on disconnected servers differed from those on most workstations.
- The engagement goal was domain admin after the company believed prior fixes were sufficient.
- The published lesson is to patch and avoid insecure legacy operating systems.
Impact: Domain admin and full network control in a paid test
| Product | Affected |
|---|---|
| Microsoft Windows 7 | domain-joined servers described as unpatched |
- 1.Patch systems and avoid leaving insecure legacy operating systems domain-joined.
From the original article
3 min read at theregister.comCursing in login credentials can help keep the bad guys out, but not when the rest of your security is BS
By Avram Piltch · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.