Credential Reuse Leading to Domain Controller Compromise in an Active Directory Environment

Overview

During an internal Active Directory penetration test, I achieved Domain Controller compromise through credential abuse and lateral movement. The attack relied entirely on well-known tooling and common post-authentication techniques. This matters because it demonstrates how basic credential hygiene failures can lead directly to full domain compromise.

Objective

The objective of the engagement was to assess the security posture of a corporate Active Directory environment. Testing was conducted in an authenticated, black-box context using a single set of domain credentials. No administrative privileges were assumed at the start of testing.

Discovery

After validating the provided credentials, I performed light enumeration to understand the level of access available and identify potential opportunities for further access. During this step, I identified the presence of a local administrator account on a system accessible with the supplied credentials.

Based on this observation, I attempted to extract local account password hashes. Using Impacket’s secretsdump.py, I dumped the local user password hashes from the system.

Example command used:

secretsdump.py domain/user@10.x.x.x

I initially attempted to crack the extracted hashes offline. This, however, was unsuccessful; I pivoted to testing whether the extracted hash could be reused across other systems in the environment.

After extracting the local administrator hash, I tested whether it could be reused to authenticate to other systems. Using a pass-the-hash attack, the same credential was accepted by multiple hosts, including the Domain Controller.

Example command used:

crackmapexec smb 10.x.x.x/24 -u admin -d domain -H <HASH>

This demonstrated that the local administrator password was reused across multiple machines. Most importantly, the hash successfully authenticated against the Domain Controller, resulting in administrative-level access.

With authentication established, I moved on to command execution. After evaluating available execution options, I obtained a semi-interactive shell on the Domain Controller using Impacket’s smbexec.py.

At this stage, command execution on the Domain Controller was confirmed, and the compromise was considered complete. The relevant stakeholders were notified so that remediation could begin.

Takeaway

Reusing local administrator passwords can turn a single compromised host into full domain compromise. Defenders should enforce unique local administrator credentials, for example, through LAPS, and continuously monitor for lateral authentication activity.