Your Security Tools Can Be Used Against You

On the first night of a remote internal penetration test, a bank’s own vulnerability scanner tried to log in to our computer, using a highly privileged account. That was all it took. We had started with nothing: a foothold on the internal network, no credentials, no domain access. A day later we had domain admin and the password hashes of every user in the bank, a complete takeover built out of the bank’s own security tooling.

Sherri Davidoff and Tom Pohl walk through the whole chain: why we relayed the scanner’s login instead of cracking it, the “low severity” SMB signing finding the entire compromise turned on, and the misconfigured certificate template that handed over domain admin. Then they widen the lens: the breach-simulation platform that had a domain admin account of its own, the backup server with administrative rights nearly everywhere, and why the tools you bought to watch your network are the ones most worth attacking. Plus what to actually change: not just what your scanner finds, but how and to what it authenticates.

 

Key Takeaways:

1. Your security tools are among the most attractive targets on your network, because you gave them the keys. Scanners, backup, EDR, and breach-simulation platforms routinely hold domain admin and reach every host. Inventory those privileged service accounts and know exactly what each one can reach.
2. Check how your scanner authenticates — not just what it finds. Credentialed scanning that will authenticate to an untrusted or unknown host, without signed/mutual authentication, hands out privileged credentials to whatever answers. Ask your vendor how to enforce this and verify the setting.
3. “Low / informational” findings are the pivot. Missing SMB signing is the classic example: it barely rates in a report, and it’s the hinge the whole bank compromise turned on. Enforce SMB signing.
4. 4. Audit your Active Directory Certificate Services templates. A single over-permissive template turns into “issue myself a certificate as any user in the company,” which turns into domain admin. Most organizations have never looked.
5. Least privilege applies to tooling, and it’s usually where least privilege gets skipped. Scoped accounts, tiered admin, no single account with admin everywhere, no shared credential across host classes.

 

Resources:

1. Microsoft — Control SMB signing behavior (how to require signing) — https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-signing
2. Tenable — Plugin 57608, “SMB Signing not required” (rated Medium — the finding this compromise turned on) — https://www.tenable.com/plugins/nessus/57608
3. Microsoft MSRC — Mitigating NTLM Relay Attacks by Default — https://www.microsoft.com/en-us/msrc/blog/2024/12/mitigating-ntlm-relay-attacks-by-default
4. Microsoft — KB5005413: Mitigating NTLM Relay Attacks on Active Directory Certificate Services — https://support.microsoft.com/en-us/topic/kb5005413-mitigating-ntlm-relay-attacks-on-active-directory-certificate-services-ad-cs-3612b773-4043-4aa9-b23d-b87910cd3429
5. SpecterOps — Certified Pre-Owned: Abusing Active Directory Certificate Services (Will Schroeder & Lee Christensen) — https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf
6. Rapid7 — Authentication on Windows: best practices (vendor guidance recommending administrator-level scan accounts) — https://docs.rapid7.com/insightvm/authentication-on-windows-best-practices/
7.