Strictly Confidential — TLP:AMBER

Internal Infrastructure & Active Directory Penetration Testing Report

Technical Security Assessment & Attack Path Demonstration

Lead Security Assessor: Aleksei Zharkou

Assessment Standard: PTES / NIST SP 800-115

Target Environment: CORP.LOCAL Active Directory Forest

Overall Risk Rating: HIGH RISK / CRITICAL

Date of Assessment: September 2026

Contact: lyosha.zharkov.98@mail.ru | @Voobrazhenie_20

1. Executive Summary

In September 2026, a comprehensive internal security assessment was performed against the CORP.LOCAL Active Directory network. The testing simulated an attacker who has secured unprivileged physical or network access to an internal corporate VLAN.

Core Assessment Finding: Assessors achieved complete Domain Administrator takeover within four hours by chaining anonymous network share exposure, Kerberoasting on privileged service accounts, and exploiting Active Directory Access Control List (ACL) misconfigurations.

Severity Level	CVSS v3.1 Range	Count	Primary Risk Vectors
CRITICAL	9.0 – 10.0	1	Exposed SSH Private Keys & Database Passwords in Network Share
HIGH	7.0 – 8.9	4	RC4 Kerberoasting, SMB Relay, BloodHound ACL Escalation to Domain Admins
MEDIUM	4.0 – 6.9	2	Broadcast Protocols (LLMNR / NetBIOS), Unencrypted DB Backups

2. Key Technical Findings & Proof of Concept

SEC-VULN-001: Exposed Private Keys & Database Passwords in Network Share

CRITICAL — CVSS 9.8

CWE: CWE-798 | MITRE ATT&CK: T1552.001 (Credentials in Files)

Finding: An unauthenticated user could access the SMB share \\FILESRV01\DevOps_Shared\ containing unencrypted SSH private keys (id_rsa) and production database credentials.

smbclient //192.168.10.15/DevOps_Shared -N
smb: \> get deploy_scripts/id_rsa
# Result: Immediate unauthorized root SSH access to Linux DB server (192.168.10.50)

Remediation: Revoke exposed SSH keys immediately; enforce least-privilege ACLs on all file shares; deploy automated pre-commit secret scanners (e.g., PipeShield).

SEC-VULN-002: Active Directory Service Accounts Vulnerable to Kerberoasting

HIGH — CVSS 8.8

CWE: CWE-522 | MITRE ATT&CK: T1558.003 (Steal Kerberos Tickets: Kerberoasting)

Finding: Privileged service accounts (svc_sql) utilized weak passwords with legacy RC4-HMAC encryption (etype 0x17), allowing unprivileged domain users to request and crack TGS tickets offline.

python3 GetUserSPNs.py corp.local/jdoe:Welcome123! -dc-ip 192.168.10.10 -request
hashcat -m 13100 kerberoast.hashes rockyou.txt
# Result: Password "Summer2024!SqlAdmin" cracked in 2 minutes 14 seconds.

Remediation: Migrate eligible service accounts to Group Managed Service Accounts (gMSA); enforce 25+ character passwords; enforce AES-128/256 encryption; monitor Windows Event 4769.

SEC-VULN-003: Active Directory ACL Misconfiguration Enabling Domain Escalation

HIGH — CVSS 8.8

CWE: CWE-732 | MITRE ATT&CK: T1078.002 (Domain Accounts)

Finding: Telemetry mapped via BloodHound CE revealed that Helpdesk_Tier1 had GenericAll rights over Tier2_Admins, which held WriteDacl over the built-in Domain Admins group.

Add-DomainGroupMember -Identity "Tier2_Admins" -Members "jdoe"
Add-DomainObjectAcl -TargetIdentity "Domain Admins" -PrincipalIdentity "jdoe" -Rights All
# Result: Immediate privilege escalation from Tier-1 Helpdesk user to full Domain Admin.

Remediation: Implement an Active Directory Tiering Model (Tier 0 / Tier 1 / Tier 2); isolate administrative groups; eliminate cross-tier object delegation.

3. Strategic Remediation Roadmap

Phase	Timeline	Key Action Items
Priority 1: Immediate	0 – 7 Days	• Invalidate exposed SSH keys & rotate database credentials. • Disable LLMNR & NetBIOS-NS broadcast protocols via GPO.
Priority 2: Short-Term	8 – 30 Days	• Enforce mandatory SMB Signing on all servers and workstations. • Migrate service accounts with SPNs to gMSA with AES encryption. • Deploy Wazuh SIEM detection rules for Event 4769 (RC4 Kerberoasting).
Priority 3: Strategic	31 – 90 Days	• Architect Active Directory Tiered Administration (Tier 0 isolation). • Deploy Microsoft LAPS to eliminate local administrator password reuse. • Embed PipeShield into CI/CD pipelines to block secret leaks.

Assessor: Aleksei Zharkou (Junior Penetration Tester)

Report Standard: PTES / NIST SP 800-115