Domain takeover
How a forgotten internal web service gave attackers a way into every enterprise in a corporation
How the attack unfolded
The attack started with a forgotten internal service. A few steps later the attackers controlled the enterprise’s domain and then reached other organisations in the corporation.
Attack on a forgotten service Entry point
An outdated internal web service with no maintenance or updates
Code execution
A flaw in the service lets attackers run commands on the server
Foothold in the network
The attackers gain a foothold and move across the enterprise network
Password theft
An attack on Active Directory extracts user passwords and domain credentials
Domain takeover
Full control of the domain and the enterprise’s infrastructure
Spread across the corporation Impact
Network links carry the attack to other enterprises
What we did
We reconstructed the attack chain, from the outdated web service to domain control, and identified where defences failed. We handed over recommendations for the measures that close this scenario.
Task
Attackers took full control of the domain at one of the corporation’s enterprises, and the attack then spread to other organisations within it. We had to work out how they got in, which path they took and what to close so it couldn’t happen again.
Solution
- Found the entry point: an outdated internal web service that nobody had maintained or updated for a long time.
- Reconstructed how the attackers used a flaw in the service to run code on the server, gain a foothold and move between servers.
- Examined the Active Directory infrastructure: how user passwords were extracted and full control of the domain was obtained.
- Analysed the network links between enterprises that let the attack spread to other organisations in the corporation.
- Prepared recommendations and a plan: what to close immediately and what to rebuild over the coming months.
Where the attack could have been stopped
Every step in the chain is a chance to break it. These are the measures we recommended to close this scenario:
- An inventory of internal services: update, isolate or switch off anything nobody maintains
- Regular vulnerability scanning of the internal network, not just the perimeter
- Active Directory hardening: separate admin accounts, unique strong passwords for service accounts, privilege control
- Monitoring for suspicious activity in the domain and on servers
- Network segmentation between enterprises: access only to the systems that are really needed
What shall we build together?
Tell us what you want to launch or improve. We’ll discuss the task and suggest the next step.