Penetration Test Data Shows Risk to Domain Admin Credentials

A new analysis of data from 180 real-world penetration tests in enterprise organizations suggests that cybercriminals who manage to get a foothold on an internal network have an opportunity to then gain domain administrator access in more than three in four cases.

But attacks on Internet-facing assets actually result in some kind of internal access only about 20% of the time because of the security controls that many organizations have implemented at the network perimeter. Attacks on Web applications are likely to result in site-wide compromise even more rarely (3%) of the time, the study by security vendor Rapid7 showed.

"Organizations are already doing an okay job of shoring up that porous border between internal and external networks," says Tod Beardsley, research director at Rapid7. Many companies have moved out their external infrastructure to cloud-hosting providers - creating a gap of sorts between their internal and external assets, he says.

"Companies are spending less on their own rack space, so this separation is creating a pretty good boundary," Beardsley notes. "It's unlikely, now, that an external Web application compromise will lead directly to an internal LAN compromise."

Rapid7's report is based on an analysis of data from internal and external penetration tests the company conducted at client sites between Sept 2018 and May 2019.  

For the external tests, Rapid7's researchers probed an organization's Internet-exposed assets including Web applications, VPN concentrators, and file transfer systems. Internal tests were focused on finding vulnerabilities in things like Active Directory domains, printers, and IoT integrations. The analysis included data from electronic and physical social engineering exercises aimed at gaining access to an organization's IT assets.

Rapid7's research showed that penetration testers are almost always (96%) able to find at least one major vulnerability that impacts data confidentiality or data integrity. Seventy-two percent of the tests resulted in at least one password being compromised—often because the passwords were known defaults or easily guessed ones.

Most of the flaws on the internal LAN tend to be Microsoft-centered and have an impact on data integrity. The biggest problems here have to do with SMB relaying: a failure to apply critical patches and credentials being stored in cleartext. In 11% of the client sites, Rapid7 found organizations had not deployed patches even for very old vulnerabilities and for extremely critical flaws like EternalBlue, which was exploited in the WannaCry ransomware attacks of 2017.

Unlike prior years, penetration testers were able to use SMB relaying as a viable attack only about 15% of the time, suggesting organizations are much more aware of the need for SMB signing and are getting rid of SMB clients that don't support signing, Beardsley says.

Rapid7's penetration testers discovered that certain Windows remote administration technologies like Windows Management Instrumentation (WMI) and PsExec continue to provide attackers with avenues for lateral movement. PowerShell restrictions are becoming increasingly common in enterprises, however, making it harder for attackers to misuse the long-abused feature.

"There's a lot of incident management around PowerShell and a lot of endpoint security solutions are optimized to spot suspicious PowerShell usage," Beardsley says.

External Vulnerabilities

Meanwhile, the most common external network vulnerabilities the 

[Continued on Next Page]

[Continued from previous page]

penetration testers encountered was weak transport-layer security resulting from old or absent encryption standards. Many organizations had websites that did not offer any encryption at all, and instead had HTTP-only resources or used authentication mechanisms that exposed credentials. When they did use encryption, the cipher suites were often weaker than those currently recommended.

Other common external vulnerabilities included weak passwords and outdated or unpatched software. Most of the vulnerabilities that exist on Internet-facing assests tend be those that impact data confidentiality.

Web application vulnerabilities are another class of flaws that fall within this category. The most common vulnerabilities here include user name enumeration issues that allow an attacker to guess or confirm valid users on a system; weaknesses that lead to encryption failures for data in transit; and SQL injection and cross-site scripting flaws.

However, cloud adoption is making it harder for attackers to use Web application flaws and other external flaws to break into the internal LAN. Enterprise organizations are increasingly embracing external hosting services from providers such as Amazon, Microsoft, and Google. 

"As such, there is often no clear path from an external compromise of a networked software component to the client's internal network," Beardsley notes.

In situations where an attacker is able to gain internal access via an externally facing vulnerability, outdated software and weak passwords are often the main cause. "Attackers can often test a lot of passwords against something like an externally-accessible mail server, and then turn those around and use those same credentials to hit internal assets," Beardsley says.

Related Content:

Black Hat USA returns to Las Vegas with hands-on technical Trinings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.