On-network to full directory compromise, one relay at a time

The challenge

A manufacturer with a flat-ish network mixing modern Windows AD, end-of-life midrange systems and operational-technology devices wanted to know the blast radius from an on-network foothold.

How it unfolded

1. Poisoned name resolution (LLMNR/NBT-NS/mDNS) and captured cleartext credentials from a legacy HTTP-Basic service.
2. Found SMB signing disabled broadly and proved NTLM relay end-to-end — a relayed machine account authenticated to around ten hosts.
3. Found LDAP signing and channel binding not enforced on the domain controllers; relayed to LDAP for a full authenticated directory dump.
4. Enumerated the domain anonymously via null session — hundreds of users and the password policy — and mapped grossly excessive privileged-group membership.
5. Catalogued EOL and OT exposure (an unauthenticated AJP file read on an EOL server, cleartext protocols and SMBv1 on a legacy midrange OS, and a vulnerable OT controller line).

Impact

A chain from an unauthenticated on-network foothold to a path to full Active Directory compromise — with OT systems reachable on the same network.

Outcome

A layered hardening plan: enforce SMB/LDAP signing and channel binding, disable LLMNR/NBT-NS, clean up privileged groups, decommission EOL systems and segment IT from OT — with a scoped second window for delegation and AD-CS paths.