Admin dropped the F-bomb in a password to show hackers who was really 1337
Cursing in login credentials can help keep the bad guys out, but not when the rest of your security is BS
In this week's episode of PWNED, red teamer Dahvid Schloss of Suzu Labs was tasked with assessing a factory's security measures. He was informed that the company had been hacked six months prior and had taken steps to improve their defenses. Schloss's goal was to obtain domain admin rights. Upon arrival, he noticed several Windows 7 servers linked to CNC milling machines, which were still running an outdated Windows 7 OS.
These servers were not connected to the domain, making it difficult for Schloss to exploit the EternalBlue zero-day vulnerability.
However, he discovered one server that was connected to the network and domain, vulnerable to EternalBlue. Upon successful exploitation, he obtained local admin credentials but found they differed from those of other workstations. Among the credentials was one written in leet speak, "heyhackergof***yourself," which Schloss initially believed to be a joke.
After a week, he presented his findings to the IT team and inquired about the admin account with this peculiar password. The senior IT manager admitted to setting up the account with the bizarre password. Schloss confirmed his suspicion and gained full control of the network using the credentials, including other passwords with insulting remarks towards potential hackers.
This incident highlights the importance of patching systems and avoiding insecure legacy OSes, as the breach was primarily due to the outdated machine's vulnerability, not the weak password.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
