Default credentials to domain admin

Enterprise IT

An internal test started from an ordinary desk network port, with no account. We were asked how far a visitor with a network cable could reach.

Internal network penetration test, Corporate network, severity CRITICAL, reported 2023

At a glance

• Challenge. Network appliances still carried published default passwords on a flat network, and one foothold trusted the next until it reached the directory.
• Approach. We mapped the flat network, tried published defaults on appliances that answered, and followed each foothold to the next reasonable trust.
• Result. Defaults were replaced, management interfaces segmented off the desk network and credential reuse broken, then the path was retested.
• Impact. A visitor with a network cable and no account could reach domain admin, and so control of every account in the directory.
• Classification. CWE-1392 Use of Default Credentials, MITRE ATT&CK: T1078.001 Valid Accounts: Default Accounts. Component: Network appliance management interfaces.

The challenge

A device shipped with a default password is not protected by that password, it is protected by the hope that nobody tries it. On an internal network, where the same appliance models recur and their defaults are published, that hope is not a control.

One appliance with its default left in place is rarely the destination. It is a foothold with a view: it can read traffic, hold credentials, or trust the management network. From a foothold, the path to wider access is a series of small, reasonable trust relationships followed in order, none of which was meant to be a chain.

The distance between a network port in a meeting room and control of the directory that governs every account is measured in these steps, not in the strength of any single wall.

Our approach

We mapped what the flat network exposed, tried published defaults on the appliances that answered, and followed each foothold only as far as the next reasonable trust would carry it, recording every step.

Around the central path we checked the surface that shared the assumption:

• Whether management interfaces still held default or shared credentials
• Whether the desk network was segmented from management and server networks
• Whether privileged credentials were reused across systems
• Whether a stale external name still pointed at infrastructure that could be claimed

Delivered as an ordered path from the network port to domain admin, with each step reproducible, so the fix could be prioritised by which link to cut first.

From finding to fix

1. Started from a desk network port
2. Used a published default on an appliance
3. Followed trust to domain admin
4. Segmented and rotated, retested

The outcome

Default and shared credentials were replaced, management interfaces were moved off the desk network and behind segmentation, and privileged credential reuse was broken so a single foothold no longer unlocks the next. The stale external name was reclaimed.

We retested the path from the desk network after the fix. Reported as CRITICAL in 2023. Retest included in the engagement.

Check your own system

• Change the default and shared credentials on every appliance before it goes into service.
• Segment management interfaces away from the desk network so a visitor port cannot reach them.
• Break privileged credential reuse across systems so one foothold does not reach the next.
• Reclaim stale external names that still point at infrastructure someone could take over.

Read more case studies, see Network Penetration Testing, or write to hello@yaamlabs.com.