A Factory IT Manager's Admin Password Was a Leet-Speak Insult for Hackers, and an Unpatched Windows 7 Server Handed It to Red Teamer Dahvid Schloss
Suzu Labs red teamer Dahvid Schloss told The Register he took over a factory's whole network after EternalBlue on a domain-joined Windows 7 server gave up the senior IT manager's password, which told hackers off in leet speak.
The client, which isn’t named, had been hacked six months before, made changes, and wanted to know it was “bulletproof now,” as The Register’s Avram Piltch puts it. Schloss’s job was domain admin rights.
On the shop floor he found Windows 7 servers running the CNC milling machines. Most of them had already been pulled off the domain, which Schloss called “the right move.” He could have thrown EternalBlue at them, he said, but dumping LSASS on those boxes only turned up local admin credentials that didn’t match the ones on most workstations. Dead ends.
One server wasn’t. It sat on the network, joined to the domain, and was still vulnerable to EternalBlue. Schloss got in, dumped LSASS again, and this time found two sets of credentials cached by WDigest. One looked like an admin account. Its password was “heyhackergof***yourself,” spelled in leet speak.
He figured it was bait. Schloss assumed the admins had planted it as a joke for him to find, so he sat on it for a week. At a briefing with the IT staff he asked who had set up the account with the funny password. “You could see everyone kind of looking at the senior manager of IT like ‘that was you, wasn’t it,’” he told The Register. It was the manager’s real admin password. The next Monday Schloss logged in with it and had complete control of the network, along with access to more passwords, many of them insults aimed at hackers too.
Windows 7 stopped getting security fixes on January 14, 2020, and Microsoft’s end-of-support page says that “without continued software and security updates your PC is at greater risk for viruses and malware.” Factories keep it anyway, because the CNC vendor’s software runs there and nobody wants to be the one who breaks production. That team did the hard part, pulling most of those machines off the domain after a breach. One server they missed undid all of it, and the password meant as a middle finger to the next intruder became the thing that let him in.
