EternalBlue to Domain Admin
EternalBlue is seven years old. Every scanner flags it. And yet a single unpatched SMBv1 server became full Domain Admin in under thirty minutes — not because the exploit is sophisticated, but because environments that carry one unpatched host tend to carry the other misconfigurations that complete the chain.
The chain
Port and service enumeration surfaced a host with TCP 445 open and SMBv1 negotiated —
Windows Server 2008 R2 SP1, confirmed vulnerable to MS17-010. The exploit ran cleanly.
A Meterpreter session opened as NT AUTHORITY\SYSTEM. The SAM hive was
dumped from the registry; the local Administrator NTLM hash was extracted in seconds.
The environment used no LAPS. Machines were provisioned from a common image and the local Administrator password had never been rotated. CrackMapExec sprayed the hash across both internal subnets and returned hits on four additional hosts — all sharing the same credential. The lateral movement surface expanded from one host to five without needing to crack anything.
Hash spray to Domain Controller
LSASS was dumped on each newly reached host. Domain-joined machines cache credentials
for every account that has recently authenticated — a scheduled task, a remote management
session, a backup job. On one of the compromised member servers, LSASS memory contained
the hash of svc_backup, a service account in the Domain Admins group. The
pass-the-hash to the domain controller confirmed it:
# pass-the-hash with the DA service account hash (lab values)
crackmapexec smb 10.0.10.0/24 -u svc_backup -d corp.lab.test \
-H e19ccf75ee54e06b06a5907af13cef42
SMB 10.0.0.5 445 DC01 [+] corp.lab.test\svc_backup (Pwned!)
SMB 10.0.0.5 445 DC01 [*] Domain Controller
Domain Admin in twenty-eight minutes. Exploitation was stopped here.
The test timeline
Subnet enumeration. Nmap host discovery across in-scope ranges. SMBv1 banner on 10.0.10.17 flagged for follow-up.
MS17-010 confirmed. Nmap smb-vuln-ms17-010 script returned VULNERABLE. Manually verified the unpatched SMBv1 version string.
EternalBlue detonated. Meterpreter session as NT AUTHORITY\SYSTEM. SAM and LSASS dumped; local Administrator NTLM hash in hand.
Hash sprayed across subnets. Same local Administrator hash accepted on four additional hosts — shared provisioning image, no LAPS deployed.
LSASS on newly reached hosts. Service account in Domain Admins group had authenticated on a compromised member server. Hash present in LSASS cache.
Pass-the-hash to DC. svc_backup hash authenticated to the Domain Controller.
Exploitation stopped. Findings documented. Full attack path captured with request/response evidence and prioritised remediation set.
Closing the chain
- Deploy LAPS immediately. Microsoft LAPS rotates unique local Administrator passwords per machine on a defined schedule, breaking the hash-spray step entirely. This is the single highest-leverage fix in this chain.
- Remove Domain Admin from all service accounts. Audit Domain Admins membership — any service account, backup account, or monitoring agent in DA must be removed and replaced with a least-privilege alternative. Backup software documents the minimum required permissions; they are substantially less than DA.
- Patch or isolate all SMBv1 hosts. There is no legitimate reason to expose SMBv1 on a domain-joined server. If a legacy application requires it, network-segment the host and treat it as a perimeter risk until the application is migrated.
- Enable Credential Guard on all supported Windows hosts. Credential Guard isolates LSASS in a virtualization-based security enclave, blocking hash extraction even from a SYSTEM-level session.
The takeaway
The chain that starts with EternalBlue does not end with EternalBlue. The exploit is the door; the shared local admin password and the DA service account are the highway. Fix the chain, not just the entry point.