When security teams picture an internal pentest, they often expect something dramatic — a sophisticated exploit, a zero-day, some custom-built malware. What actually happens, in the vast majority of engagements, is far more mundane: a handful of overlooked misconfigurations, each rated low or medium in isolation, that chain together with almost mechanical efficiency. The result is full domain compromise in under 48 hours.
This scenario plays out repeatedly across different organizations and sectors. Walking through it step by step isn't meant to be alarmist — it's meant to change how teams think about remediation priorities.
Step 1: Network poisoning as a silent initial foothold
The attack starts from a position on the internal network. This could be a compromised endpoint, a poorly segmented guest Wi-Fi, or even physical access to an open port. From there, the attacker runs an LLMNR/NBT-NS poisoning tool. Because SMB signing isn't enforced and DNS isn't strictly locked down, nearby workstations respond to spoofed name resolution requests, handing over Net-NTLMv2 hashes within minutes.
This vector has been publicly documented for years. The mitigations are well-known and straightforward. It still works in most environments because disabling LLMNR or enforcing SMB signing requires GPO changes that might break legacy services — so the fix keeps getting postponed.
Step 2: No SMB signing means NTLM relay is wide open
The captured hashes can be cracked offline if the password is weak. But even with a strong password, the absence of SMB signing opens a second path: NTLM relay. The attacker redirects an authentication attempt from one machine to another target on the network — a file server, an admin share, or sometimes a secondary domain controller where signing isn't enforced.
At this point, no exploit has been used. The attacker has simply taken advantage of two protocols behaving exactly as designed, in an environment where the corresponding safeguards were never configured.
Step 3: Default credentials on a forgotten device
With an authenticated foothold on one network segment, lateral scanning begins. This phase almost always turns up at least one device whose credentials were never changed: a network printer, an access switch, a monitoring appliance, or a test hypervisor that was never officially decommissioned but is still very much running.
Default credentials on such a device grant elevated access to a critical network segment. It's not glamorous, but it's enough to pivot. The attacker now has visibility into VLANs that should have been completely out of reach from the initial position.
Step 4: No NAC means lateral movement is unconstrained
The absence of network access control (NAC) is the final piece. With no identity or compliance verification at connection time, nothing stops the attacker from moving their session or connecting a pivot machine to an open port. The internal network is effectively flat — VLANs exist on paper, but the ACLs between them are permissive enough to be nearly useless.
From here, reaching the primary domain controller is a matter of minutes. Classic post-exploitation techniques — Pass-the-Hash, Kerberoasting, DCSync — can run freely. Within 48 hours of the engagement starting, the tester holds the keys to everything: the krbtgt hash, access to all servers, the ability to create persistent accounts that will survive a password reset cycle.
For teams who want to stress-test their environment against this kind of chained attack scenario, the internal attack simulation labs in the CyberAct catalog reproduce exactly these exploitation chains in a controlled environment.
Remediating by cumulative impact, not isolated severity
The core problem with traditional pentest reports is that each finding gets scored independently. LLMNR poisoning: medium. Missing SMB signing: medium. Default credentials on the printer: low. No NAC: informational. Teams then prioritize the highest CVSS score on the list, and all four of these items sit at the bottom of the backlog for months.
A remediation grid based on cumulative impact reverses this logic. It asks a different question: if this weakness is exploited in combination with the other weaknesses already present in this environment, what is the maximum blast radius? A practical three-tier approach looks like this:
- Critical — address within 72 hours: any weakness that, combined with at least one other existing weakness, enables lateral movement to an authority system (DC, PKI, central hypervisor). SMB relay in an environment without NAC belongs here, regardless of its individual CVSS score.
- High — address in the next sprint: any weakness that significantly expands the accessible attack surface even without reaching an authority system — default credentials on a device with cross-VLAN visibility fall into this tier.
- Standard — prioritized backlog: weaknesses whose impact remains contained even when chained, because they don't provide access to critical segments or because genuine compensating controls are actually in place.
This framework requires mapping dependencies between findings before building a remediation plan. It's more work upfront, but it's the only approach that avoids spending resources on cosmetic CVE patches while the simplest attack chain remains intact.
A good starting point before any full engagement is to assess your current cyber maturity — it surfaces the weak links that would appear in the first hours of an internal pentest.
Frequently asked questions
Why can low-severity findings lead to a full network compromise?
Because severity only makes sense in context. A misconfiguration that grants access to one network segment becomes critical if that segment is a stepping stone to a domain controller. It's the chain that creates the real risk, not any single finding in isolation.
How quickly can an attacker actually chain these steps together?
In a typical environment without active compensating controls, the full scenario described here can unfold in under 48 hours. Some phases — like network poisoning and hash capture — can succeed within minutes on a busy network.
How do you prioritize remediations when resources and time are limited?
By assessing each finding in combination with the others present in the environment, not on its own. The fixes to tackle first are those that break the shortest attack chain leading to an authority system, regardless of their individual CVSS score.
Does enforcing SMB signing and disabling LLMNR fully prevent this type of attack?
They neutralize the first two steps, which is meaningful progress. But full defense in depth is still required: NAC enforcement, effective network segmentation, regular audits of peripheral device credentials, and lateral movement detection at the EDR and SIEM level.