Credential Reuse Leading to Domain Controller Compromise in an Active Directory Environment

UpdatedJanuary 16, 2026

•2 min read•View as Markdown

Credential Reuse Leading to Domain Controller Compromise in an Active Directory Environment

Cyber Sekler

Comments

Join the discussion

No comments yet. Be the first to comment.

More from this blog

Password Reset Poisoning Leading to Account Takeover

Overview During a penetration test of a Web Applications API, I discovered a vulnerability in the password reset functionality that allowed an attacker to intercept reset tokens and take over user accounts. By manipulating a user-controllable field i...

Jan 16, 20262 min read

Password Reset Poisoning Leading to Account Takeover

Exposed .git Directory Leading to Source Code Disclosure and Hardcoded Credentials

During a web application assessment, I discovered an exposed .git directory that allowed me to download the application's entire source code. By extracting and analysing the git objects, I identified hardcoded credentials that granted admin-level acc...

Dec 16, 20252 min read

Exposed .git Directory Leading to Source Code Disclosure and Hardcoded Credentials

Broken Access Control Leading to Privilege Escalation

Overview During a web application penetration test, I identified a broken access control issue that allowed a low-privileged user to escalate their privileges to administrator. The issue was easy to identify and had a high impact, as it allowed full ...

May 20, 20252 min read

Broken Access Control Leading to Privilege Escalation

Unauthenticated SQL Injection Leading to Remote Command Execution in a Web Application

Overview During a black-box web application penetration test, I identified an unauthenticated SQL injection vulnerability that could be escalated to remote command execution. Although SQL injection vulnerabilities are less common today, this finding ...

Nov 16, 20242 min read

Unauthenticated SQL Injection Leading to Remote Command Execution in a Web Application

Web Application Account Compromise via 2FA Bypass

Overview During a penetration test of a web application, I identified a flawed two-factor authentication implementation that could be bypassed using brute-force techniques. This finding demonstrates that poorly implemented two-factor authentication (...

Jul 9, 20242 min read

Web Application Account Compromise via 2FA Bypass

Cyber Sekler

7 posts

Overview

During an internal Active Directory penetration test, I achieved Domain Controller compromise through credential abuse and lateral movement. The attack relied entirely on well-known tooling and common post-authentication techniques. This matters because it demonstrates how basic credential hygiene failures can lead directly to full domain compromise.

Discovery

After validating the provided credentials, I performed light enumeration to understand the level of access available and identify potential opportunities for further access. During this step, I identified the presence of a local administrator account on a system accessible with the supplied credentials.

Based on this observation, I attempted to extract local account password hashes. Using Impacket’s secretsdump.py, I dumped the local user password hashes from the system.

Example command used:

secretsdump.py domain/user@10.x.x.x

I initially attempted to crack the extracted hashes offline. This, however, was unsuccessful; I pivoted to testing whether the extracted hash could be reused across other systems in the environment.

After extracting the local administrator hash, I tested whether it could be reused to authenticate to other systems. Using a pass-the-hash attack, the same credential was accepted by multiple hosts, including the Domain Controller.

Example command used:

crackmapexec smb 10.x.x.x/24 -u admin -d domain -H <HASH>

This demonstrated that the local administrator password was reused across multiple machines. Most importantly, the hash successfully authenticated against the Domain Controller, resulting in administrative-level access.

With authentication established, I moved on to command execution. After evaluating available execution options, I obtained a semi-interactive shell on the Domain Controller using Impacket’s smbexec.py.

At this stage, command execution on the Domain Controller was confirmed, and the compromise was considered complete. The relevant stakeholders were notified so that remediation could begin.

Credential Reuse Leading to Domain Controller Compromise in an Active Directory Environment

Comments

More from this blog

Password Reset Poisoning Leading to Account Takeover

Exposed .git Directory Leading to Source Code Disclosure and Hardcoded Credentials

Broken Access Control Leading to Privilege Escalation

Unauthenticated SQL Injection Leading to Remote Command Execution in a Web Application

Web Application Account Compromise via 2FA Bypass

Overview

Objective

Discovery

Takeaway

Command Palette

Comments

More from this blog

Overview

Objective

Discovery

Takeaway