Penetration Test Data Shows Risk to Domain Admin Credentials

But gaining a foothold on the LAN via vulnerabilities on Internet-facing assets is becoming harder, Rapid7 found in its real-world pen tests.

A new analysis of data from 180 real-world penetration tests in enterprise organizations suggests that cybercriminals who manage to get a foothold on an internal network have an opportunity to then gain domain administrator access in more than three in four cases.
But attacks on Internet-facing assets actually result in some kind of internal access only about 20% of the time because of the security controls that many organizations have implemented at the network perimeter. Attacks on Web applications are likely to result in site-wide compromise even more rarely (3%) of the time, the study by security vendor Rapid7 showed.
Organizations are already doing an okay job of shoring up that porous border between internal and external networks, says Tod Beardsley, research director at Rapid7. Many companies have moved out their external infrastructure to cloud-hosting providers - creating a gap of sorts between their internal and external assets, he says.
Companies are spending less on their own rack space, so this separation is creating a pretty good boundary, Beardsley notes. Its unlikely, now, that an external Web application compromise will lead directly to an internal LAN compromise.
Rapid7s report is based on an analysis of data from internal and external penetration tests the company conducted at client sites between Sept 2018 and May 2019.
For the external tests, Rapid7s researchers probed an organizations Internet-exposed assets including Web applications, VPN concentrators, and file transfer systems. Internal tests were focused on finding vulnerabilities in things like Active Directory domains, printers, and IoT integrations. The analysis included data from electronic and physical social engineering exercises aimed at gaining access to an organizations IT assets.
Rapid7s
research
showed that penetration testers are almost always (96%) able to find at least one major vulnerability that impacts data confidentiality or data integrity. Seventy-two percent of the tests resulted in at least one password being compromised—often because the passwords were known defaults or easily guessed ones.
Most of the flaws on the internal LAN tend to be Microsoft-centered and have an impact on data integrity. The biggest problems here have to do with SMB relaying: a failure to apply critical patches and credentials being stored in cleartext. In 11% of the client sites, Rapid7 found organizations had not deployed patches even for very old vulnerabilities and for extremely critical flaws like EternalBlue, which was exploited in the WannaCry ransomware attacks of 2017.
Unlike prior years, penetration testers were able to use SMB relaying as a viable attack only about 15% of the time, suggesting organizations are much more aware of the need for SMB signing and are getting rid of SMB clients that dont support signing, Beardsley says.
Rapid7s penetration testers discovered that certain Windows remote administration technologies like Windows Management Instrumentation (WMI) and PsExec continue to provide attackers with avenues for lateral movement. PowerShell restrictions are becoming increasingly common in enterprises, however, making it harder for attackers to misuse the long-abused feature.
Theres a lot of incident management around PowerShell and a lot of endpoint security solutions are optimized to spot suspicious PowerShell usage, Beardsley says.
External Vulnerabilities
Meanwhile, the most common external network vulnerabilities the
[Continued on Next Page]

[Continued from previous page]
penetration testers encountered was weak transport-layer security resulting from old or absent encryption standards. Many organizations had websites that did not offer any encryption at all, and instead had HTTP-only resources or used authentication mechanisms that exposed credentials. When they did use encryption, the cipher suites were often weaker than those currently recommended.
Other common external vulnerabilities included weak passwords and outdated or unpatched software. Most of the vulnerabilities that exist on Internet-facing assests tend be those that impact data confidentiality.
Web application vulnerabilities are another class of flaws that fall within this category. The most common vulnerabilities here include user name enumeration issues that allow an attacker to
guess or confirm
valid users on a system; weaknesses that lead to encryption failures for data in transit; and SQL injection and cross-site scripting flaws.
However, cloud adoption is making it harder for attackers to use Web application flaws and other external flaws to break into the internal LAN. Enterprise organizations are increasingly embracing external hosting services from providers such as Amazon, Microsoft, and Google.
As such, there is often no clear path from an external compromise of a networked software component to the clients internal network, Beardsley notes.
In situations where an attacker is able to gain internal access via an externally facing vulnerability, outdated software and weak passwords are often the main cause. Attackers can often test a lot of passwords against something like an externally-accessible mail server, and then turn those around and use those same credentials to hit internal assets, Beardsley says.
Related Content:
Web App Vulnerabilities Flying Under Your Radar
8 Legit Tools and Utilities That Cybercriminals Commonly Misuse
Persistent Threats Can Last Inside SMB Networks for Years
The State of IT Operations and Cybersecurity Operations
Black Hat USA returns to Las Vegas with hands-on technical Trinings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the
conference
and
to register.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Penetration Test Data Shows Risk to Domain Admin Credentials