Background
A Planned Assessment. An Unplanned Discovery.
A large multinational manufacturing organization spanning multiple global regions with a large multinational workforce, was entering a period of significant infrastructure consolidation. Before merging network segments and extending their identity estate, their security leadership made a sensible decision: test the environment first.
They engaged QuasarCyberTech to conduct a grey-box internal network penetration test against their enterprise Active Directory environment. The goal was to evaluate resilience against real-world adversarial tactics. No safe assumptions, no over-reliance on automated scanning. The team was given a single standard domain user account as a starting point and nothing more.
The brief was straightforward. Find out what a malicious insider, or a threat actor who had compromised one employee account, could actually do inside this network. The answer the team came back with was not what anyone expected.
Within the early hours of the engagement, QCT's offensive security team had identified a path to complete enterprise domain compromise. Every domain account. Every trust relationship. Every connected system. Reachable from a single unprivileged starting point.
Assessment Scope
What the Team Was Testing
The engagement covered the full identity and authentication attack surface of the enterprise Active Directory environment. The test was designed to simulate what a sophisticated threat actor with internal network access would realistically attempt.
Active Directory SYSVOL and NETLOGON Enumeration
Group Policy Preferences (GPP) Credential Analysis
Kerberos and NTLM Authentication Attack Surface
DCSync and Domain Replication Abuse
Privileged and Service Account Auditing
EDR and AV Bypass Resistance Evaluation
Lateral Movement Path Mapping
Trust Relationship Enumeration across Domains
Found by people, not machines. This 13-year-old vulnerability was not identified or remediated by any automated scanner, monitoring control or compliance audit during all the years it existed in production. It was uncovered through manual, human-led analysis: methodical enumeration of the Active Directory environment, pattern recognition developed from years of offensive security experience, and the investigative persistence to follow the full attack chain through to confirmed domain compromise. The environment had been running, audited, and updated for over a decade and the exposure remained invisible until a human looked for it.
The Attack Chain
From One Account to Full Domain Control
The following is the exact sequence of steps the QCT team executed during the authorized testing window. Every step was performed using only the single standard employee account provided at the start. No additional credentials were provided, assumed, or brute-forced to reach domain compromise.
Starting Point
Standard Domain User Access
The engagement begins with a single unprivileged domain user account, the equivalent of any employee on the network. No elevated rights. No admin access. This is the starting condition for every scenario in the test.
Enumeration
SYSVOL Share Reconnaissance
Any authenticated domain user can read the SYSVOL share. The QCT team enumerated its contents and found Group Policy Preference (GPP) files that had been deployed over a decade earlier. GPP files can contain encrypted credentials, and Microsoft publicly disclosed the AES encryption key used in 2014. Any GPP-stored password is trivially decryptable by anyone who knows where to look.
\\DOMAIN\SYSVOL\...\Groups.xml
Credential Recovery
GPP Password Decryption
The cpassword field in the GPP XML was decrypted using Microsoft's own published AES key. The recovered credential was a Domain Admin-equivalent account, a GLOBALAccountAdmin password that had been sitting in a world-readable file for over 13 years, accessible to every authenticated user on the network. A second encrypted credential was found in a NETLOGON logon script in plaintext. A third was recoverable via the same decryption method.
Get-GPPPassword / gpp-decrypt [cpassword]
Privilege Escalation
Authentication as Builtin\Administrators
Using the decrypted credential, the team authenticated as a Builtin\Administrators group member on the domain. At this point, escalation to full domain control was a matter of technique, not of further discovery. The path was clear.
Domain Compromise
DCSync Attack: Full Credential Extraction
A DCSync attack was executed, impersonating a domain controller to replicate credential data. The complete Active Directory credential database was extracted: the complete domain account password database, the Azure AD Connect service account hashes, trust relationship keys for all connected domains, and the master Kerberos key.
secretsdump.py / Invoke-DCSync
Domain Controller Access
SYSTEM-Level Shell on Primary DC
An interactive SYSTEM-level shell was obtained on the primary Domain Controller. Full administrative control over the organization's core identity infrastructure was demonstrated and documented during the authorized testing window.
Persistent Access Capability
Golden Ticket Forgery Potential
With the krbtgt hash in hand, the team confirmed the ability to forge Golden Tickets. These are Kerberos authentication tokens valid for any account, at any privilege level, without needing the actual account password. Golden Ticket access survives individual password resets. The only way to close this is a double-rotation of the krbtgt, which was subsequently carried out.
Remediation
What Was Fixed, and Why It Matters
All findings were remediated in coordination with the client's Active Directory and infrastructure teams. Each remediation was matched to the specific risk it addressed, not just the vulnerability it closed.
| Remediation Action | Business Impact |
|---|
| SYSVOL GPP Credential Removal and Policy Hardening | The primary attack vector was eliminated. Any authenticated domain user was previously able to recover plaintext administrator credentials from Group Policy files. A 13-year exposure window was closed. |
| Double Rotation of the Kerberos Master Key (krbtgt) | All forged Golden Tickets that could have been created using the extracted key material were invalidated. Kerberos authentication infrastructure integrity was fully restored. A single rotation is not enough. The double rotation is what closes the forgery window completely. |
| Privileged Account Restructuring and Least-Privilege Enforcement | Service account privileges were reduced from Domain Controller administrative rights to operationally scoped permissions. Any future single-account compromise can no longer result in full domain takeover through the same chain. |
| DCSync Detection and Identity Monitoring Deployment | Real-time alerting was configured for credential extraction activity via Event ID 4662. Future attempts to replicate domain credentials from non-DC sources will be detected and actioned within minutes, not discovered weeks later. |
Outcomes
From 13-Year Exposure to Verified Clean
The infrastructure consolidation the organization was preparing for went ahead on schedule, with the confidence that the identity foundation it was building on had been independently validated. The engagement surfaced a risk that no automated tool and no compliance audit had ever flagged.
Attack Vector Eliminated
The 13-year-old SYSVOL exposure was removed and GPP credential storage policies were hardened. The primary path to domain compromise no longer exists.
Golden Ticket Risk Closed
The krbtgt double-rotation invalidated any forged tickets that may have been in use. Kerberos authentication integrity was fully restored.
Privilege Scope Reduced
Service accounts now operate at the minimum privilege required for their function. No single account compromise can produce the same chain of escalation again.
Detection Capability Built
DCSync-based credential extraction is now monitored in real time via Event ID 4662 alerting. The same attack would be caught within minutes today.
The organization proceeded with its infrastructure consolidation on a verified, hardened Active Directory foundation. What began as a pre-consolidation health check uncovered a risk with a 13-year runway. Finding it during an authorized engagement, rather than during an actual breach, changed the outcome entirely.
