Seven Critical Vulnerabilities and a Credential Reuse Chain

Seven critical vulnerabilities in one internal network — BlueKeep, EternalBlue, Schannel RCE, two legacy RCE CVEs in a third-party component, an EOL database, and a SQL Server instance without cumulative updates for several years. None were novel. Each had a public CVE, a vendor patch, and a documented remediation. They existed because the fix had never arrived. But the finding that ended the engagement was not a CVE. It was a backup service account in Domain Admins whose reused local password cracked in two minutes from a SAM dump.

The seven vulnerabilities

A vulnerability scanner sweep across the internal range surfaced the complete list within the first sweep: an EOL Windows Server host carrying BlueKeep (CVE-2019-0708) and EternalBlue (MS17-010), a separate host with Schannel RCE, two hosts running a third-party licence management component with legacy unauthenticated RCE, an EOL database, and SSLv2/v3 negotiable on several hosts. Each path produces SYSTEM-level code execution independently. EternalBlue ran first.

The credential reuse path to Domain Admin

EternalBlue opened a SYSTEM session on the EOL Windows Server host. SAM was dumped from the registry hive; the local Administrator hash was extracted. The hash cracked in under two minutes — a common word-with-number pattern set at provisioning time and never rotated. The same password, tested against the domain service account svc_backup, authenticated directly to the domain controller:

# SAM dump and offline crack (lab values)
secretsdump.py -sam sam.hive -system sys.hive LOCAL
[*] Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

hashcat -m 1000 31d6cfe0d16ae931b73c59d7e0c089c0 rockyou.txt
# cracked in < 2 minutes — word-with-number construction

# same password against the domain service account
crackmapexec smb 10.0.0.5 -u svc_backup -d corp.lab.test -p '<lab-password>'

SMB  10.0.0.5  445  DC01  [+] corp.lab.test\svc_backup:<lab-password> (Pwned!)
SMB  10.0.0.5  445  DC01  [*] Domain Controller


      
Domain Admin obtained via one plaintext password — not via an active session, not
      via relay, not via Kerberoasting. A backup service account in DA with a static password
      set at installation time, never reviewed in years of production use.

      
The test timeline
      

        
T+0:00 — SCAN
Vulnerability scan across internal range. Seven critical vulnerabilities flagged in the first sweep. Manual verification of each follows.
        
T+0:45 — FIRST SHELL
EternalBlue detonated. Meterpreter session as NT AUTHORITY\SYSTEM. SAM and SYSTEM hives dumped. Local Administrator hash extracted.
        
T+1:00 — HASH CRACKED
Local Administrator password recovered offline. rockyou.txt hit in under two minutes. Common word-with-number construction, consistent with a shared provisioning default.
        
T+1:10 — CREDENTIAL REUSE
svc_backup accepts the same password. Service account in Domain Admins authenticated to the Domain Controller with the locally-recovered credential.
        
T+4:00 — REPORT
All seven critical findings manually verified. Full attack chain documented. Credential reuse path, NULL session shares, and persistent DA sessions captured with evidence.
      

      
Breaking the chain
      

        
Isolate EOL systems immediately and schedule migration. All end-of-life platforms and unpatched legacy systems must be placed on an isolated VLAN with no path to domain controllers while migration is planned. Continued flat-LAN adjacency with the rest of the domain is not acceptable.
        
Remove Domain Admin from all service accounts. Audit every DA member and remove any account that does not require that access. For backup software specifically, the vendor documents minimum required permissions that are substantially less than DA. Treat any DA member count above three as requiring justification.
        
Rotate all service account passwords and migrate to gMSA where possible. Any service account password set at initial deployment and never changed is a credential-reuse candidate. Group Managed Service Accounts rotate automatically and are not exposed to offline cracking.
        
Deploy LAPS across all workstations and member servers. LAPS eliminates shared local Administrator passwords across provisioned systems, removing the hash-spray path that would have extended lateral movement even without the credential reuse chain.
      

      
The takeaway
      
The credential reuse chain here required four steps — EternalBlue shell, SAM dump,
      two-minute password crack, one domain service account test. Each individually
      preventable. Together: Domain Admin in seventy-five minutes from first packet.