Pen tester used EternalBlue on a domain-joined Windows 7 server to recover an IT manager's insult-based admin password
A red-team engagement by Dahvid Schloss of Suzu Labs at a factory that had been breached six months earlier ended in full domain admin control. Most Windows 7 servers attached to CNC milling machines were off the domain, but one was domain-joined and vulnerable to EternalBlue. Dumping LSASS yielded WDigest credentials, including an admin account whose password was an insulting phrase in leet speak. Schloss assumed it was a decoy and waited a week, but the password was the real one for the IT senior manager's admin account and gave him control of the network. The article's lesson is that the unpatched legacy machine, not the password, was the root weakness.
Entenda a falha
A vulnerabilidade
The story involves EternalBlue, a remote flaw on unpatched Windows 7 servers. The articles give no CVE, no component name and no fixed version beyond saying the machines were unpatched and should be patched. The server was domain-joined and reachable on the factory network, and Schloss used EternalBlue to get onto it. From there he dumped LSASS and recovered WDigest credentials, including a domain admin account, which gave him full control of the network. The articles do not describe what exactly an attacker needs beyond network reach to the vulnerable host.
Como funciona
According to the articles, Schloss reached a Windows 7 server attached to a CNC milling machine and exploited it with EternalBlue. With access on the host, he dumped LSASS, the Windows Local Security Authority Subsystem Service, and found WDigest credentials held in it. One pair was a domain admin account, and it worked against the rest of the domain. Servers that were off the domain were far less useful, because their local admin passwords differed from those on workstations. The articles do not explain the internal mechanics of the EternalBlue flaw itself.
Por que é vulnerável
The articles put the root weakness on an unpatched, outdated operating system that was joined to the domain, not on the password. The legacy Windows 7 machines were kept because proprietary software tied to the CNC machines might break on a newer OS. Most of those servers were isolated from the domain, but one was not, and that exception exposed domain credentials. Credentials were also recoverable from LSASS through WDigest. The articles do not describe the underlying code defect, and the advised fixes are to patch, avoid insecure legacy operating systems and keep unpatched legacy machines off the domain.
Como foi descoberta
The flaw was not newly discovered. Dahvid Schloss of Suzu Labs found the exposed machine during a red-team engagement at a factory that had been breached six months earlier and wanted to confirm it was now secure. His goal was domain admin rights. He presented the findings to the IT team in a briefing, and the articles do not mention a vendor report or advisory.
Explicação gerada por IA a partir da matéria e dos artigos, em 29/10/2026 06:18.
Detalhes técnicos
- Legacy Windows 7 servers were connected to CNC milling machines. Most were disconnected from the domain, and their local admin credentials differed from those on workstations, which limited lateral movement.
- One domain-joined server was vulnerable to EternalBlue; Schloss dumped LSASS and extracted WDigest credentials.
- The recovered admin password was a long leet-speak phrase, which is strong in itself. Other recovered passwords were also insults aimed at hackers.
- The valid credentials gave complete network control.
Remediação
- Patch systems and avoid insecure legacy operating systems wherever possible.
- Do not join unpatched legacy machines to the domain.
Linha do tempo
-
Pen tester used EternalBlue on a domain-joined Windows 7 server to recover an IT manager's insult-based admin password
ler a análise desta fonte ocultar
A red-team engagement by Dahvid Schloss of Suzu Labs at a factory that had been breached six months earlier ended in full domain admin control. Most Windows 7 servers attached to CNC milling machines were off the domain, but one was domain-joined and vulnerable to EternalBlue. Dumping LSASS yielded WDigest credentials, including an admin account whose password was an insulting phrase in leet speak. Schloss assumed it was a decoy and waited a week, but the password was the real one for the IT senior manager's admin account and gave him control of the network. The article's lesson is that the unpatched legacy machine, not the password, was the root weakness.
Technical Details
- Legacy Windows 7 servers were connected to CNC milling machines. Most were disconnected from the domain, and their local admin credentials differed from those on workstations, which limited lateral movement.
- One domain-joined server was vulnerable to EternalBlue; Schloss dumped LSASS and extracted WDigest credentials.
- The recovered admin password was a long leet-speak phrase, which is strong in itself. Other recovered passwords were also insults aimed at hackers.
- The valid credentials gave complete network control.
Remediation
- Patch systems and avoid insecure legacy operating systems wherever possible.
- Do not join unpatched legacy machines to the domain.