An unpatched Windows 7 server connected to industrial machinery gave a penetration tester a route to full domain-administrator control, despite the factory’s efforts to recover from an earlier breach. The incident, described by Dahvid Schloss of Suzu Labs, shows how legacy operational technology can turn a well-intentioned security overhaul into an easy path across the corporate network.
Schloss found several Windows 7 systems supporting CNC milling equipment. Most had been removed from the Windows domain, limiting the value of attacks against them, but one server remained both network-connected and domain-joined. It was vulnerable to EternalBlue, the exploit commonly associated with CVE-2017-0144, a flaw in the Windows SMBv1 server that permits remote code execution through specially crafted packets.
The National Vulnerability Database rates CVE-2017-0144 8.8 High under CVSS 3.1. NVD lists Windows 7 SP1 among the affected products, while the U.S. Cybersecurity and Infrastructure Security Agency has included the vulnerability in its Known Exploited Vulnerabilities catalog, requiring federal agencies to apply vendor updates. Microsoft addressed the issue in its critical MS17-010 bulletin on March 14, 2017.
After exploiting the server, Schloss dumped credentials from Windows’ Local Security Authority subsystem and found an administrator account using the leetspeak password heyhackergof***yourself. He initially assumed the hostile message was a decoy, but later confirmed it belonged to the senior IT manager. Testing the credentials subsequently delivered control of the network and exposed additional passwords containing insults aimed at a presumed attacker.
The password was embarrassing and poorly chosen for an administrator account, but it was not the decisive weakness: the legacy server’s exposure and missing security update were. Defenders operating old systems for manufacturing or other specialized software should inventory domain connections, remove SMBv1 where possible, apply Microsoft’s MS17-010 fixes or an approved compensating control, segment industrial equipment from enterprise authentication systems, and replace unsupported platforms on a defined schedule. CISA’s catalog entry and Microsoft’s bulletin provide the appropriate starting points for remediation; the incident itself does not establish any threat-actor attribution or evidence of exploitation in the wild at that factory.
