Anatomy of an Attack Chain: From a Single CVE to Full Domain Compromise

Real-world breaches are rarely a single dramatic exploit. They are chains: a modest foothold, a credential picked up in passing, a quiet misconfiguration in the identity layer, and finally the keys to the entire domain. Each link looks survivable in isolation. Together they end with an attacker holding domain administrator rights and no obvious alarm having gone off.

The chain below is reconstructed from a published intrusion analysis. It starts with a publicly exposed PHP service and ends at the domain controller. What makes it worth studying is not any one zero-day, but how ordinary the ingredients are: a known CVE, a classic NTLM interception, a forgotten credential file, and an Active Directory Certificate Services (AD CS) template that was never locked down. We walk through every stage, map it to MITRE ATT&CK, and note where a defender could have broken the chain.

Stage 1 — Initial Access via CVE-2024-4577

The entry point was an externally reachable development stack (an Apache/PHP bundle) listening on a non-standard port. A quick scan showed the same host also exposed Kerberos, LDAP, SMB, RDP, and WinRM — a strong signal that the web server was running directly on a domain controller, which is a serious architectural mistake in its own right.

The actual exploit was CVE-2024-4577, a PHP CGI argument-injection flaw affecting PHP versions before 8.1.29, 8.2.20, and 8.3.8. By smuggling interpreter flags through the URL, the attacker forced PHP to set allow_url_include=1 and auto_prepend_file=php://input, turning a request body into executed PHP and yielding remote code execution. A PowerShell reverse shell followed, running in the context of the web server process.

• ATT&CK: T1190 Exploit Public-Facing Application; T1059.001 PowerShell.
• Break the chain: Patch PHP and switch CGI mode to FPM. Never co-locate internet-facing web services on a domain controller. Check vulnerable software against the CISA KEV catalog — this CVE was added shortly after disclosure.

Stage 2 — Credential Capture via NTLM Interception

With code execution but only service-level rights, the attacker coerced the host into authenticating outbound to attacker-controlled infrastructure and captured the resulting NTLMv2 exchange using a responder/relay tool. The captured hash for a service account was then cracked offline against a common wordlist, producing a valid domain password.

This is the textbook weakness of NTLM: authentication material can be intercepted and either relayed or cracked at leisure.

• ATT&CK: T1557 Adversary-in-the-Middle; T1110.002 Password Cracking.
• Break the chain: Disable LLMNR and NetBIOS name resolution, enforce SMB signing, and enable Extended Protection for Authentication. Service accounts should use long, random, machine-generated passwords that resist offline cracking.

Stage 3 — Lateral Movement and a Plaintext-Adjacent Credential

The cracked domain credential allowed interactive access to the host. There the attacker found a PowerShell CLIXML file containing an exported PSCredential object — credentials “protected” by DPAPI but decryptable in the original user’s context. Decrypting it surrendered a second, higher-value domain account.

Exported credential files are a recurring gift to attackers because DPAPI protection is only as strong as the account context, which the attacker now controlled.

• ATT&CK: T1078 Valid Accounts; T1555 Credentials from Password Stores.
• Break the chain: Eliminate exported credential files from scripts and scheduled tasks. Store secrets in a dedicated vault (HashiCorp Vault, Azure Key Vault, or equivalent) with scoped, audited retrieval.

Stage 4 — Reconnaissance of the Identity Layer

Now operating as a legitimate domain user, the attacker mapped the environment: an attack-path graphing tool enumerated relationships and privileges across the domain, while certificate-focused tooling enumerated the certificate authorities and templates exposed by AD CS. The enumeration surfaced the decisive flaw — an ESC7 condition.

• ATT&CK: T1482 Domain Trust Discovery; T1087 Account Discovery.
• Break the chain: Treat AD CS as Tier-0 infrastructure. Audit it regularly with certificate-assessment tooling and review who holds CA management rights.

Stage 5 — Privilege Escalation via AD CS ESC7

ESC7 is a misconfiguration in which non-administrative principals hold powerful CA permissions — here, ManageCA. That single excessive right let the attacker:

1. Grant their own account the CA Officer role.
2. Enable the built-in SubCA certificate template.
3. Request a certificate while specifying Administrator as the subject (UPN), producing a pending request.
4. Use the Officer role to approve their own request and issue the certificate.

The result was a certificate that authenticates as a domain administrator.

• ATT&CK: T1649 Steal or Forge Authentication Certificates; T1548 Abuse Elevation Control Mechanism.
• Break the chain: Strictly limit ManageCA and ManageCertificates rights, disable unneeded templates such as SubCA, and alert on certificate issuance and approval events in the CA logs.

Stage 6 — Domain Compromise via PKINIT

The forged certificate was used for Kerberos PKINIT authentication. This not only produced a domain-admin Kerberos ticket but also recovered the Administrator account’s NT hash, after which a remote-execution utility opened a SYSTEM-level shell on the domain controller.

The notable detection gap: certificate-based authentication leaves few of the indicators teams watch for in password compromise. No failed logons, no obvious lateral spray — just a valid certificate doing exactly what certificates do.

• ATT&CK: T1550 Use Alternate Authentication Material; T1003 OS Credential Dumping.

Defensive Synthesis

No single control here is exotic; the failure was the absence of layered control. Patch management would have closed the front door. NTLM hardening would have starved the second stage. Secret hygiene would have removed the pivot. And — most importantly — treating the certificate authority as critical infrastructure would have neutralized the escalation that actually delivered the domain.

Two capabilities matter for catching a chain like this in progress. First, configuration assessment that flags ESC-class AD CS issues, unpatched KEV-listed software, and dangerous co-location before an attacker finds them. Second, behavioral detection (UEBA) and automated response that can correlate a web-process spawning PowerShell, an outbound NTLM coercion, and an anomalous certificate issuance as one story rather than three unrelated events.

Key Takeaways

• Breaches are chains; defenders only need to break one link, but attackers only need one link to hold.
• CVE-2024-4577 turns an exposed PHP CGI service into RCE — patch to 8.1.29 / 8.2.20 / 8.3.8 or move to FPM, and never run web services on a domain controller.
• NTLM interception plus offline cracking remains a reliable credential source; disable LLMNR/NetBIOS, enforce SMB signing, and enable EPA.
• Exported credential files (CLIXML/DPAPI) are decryptable in-context — move secrets into a managed vault.
• AD CS is Tier-0. ESC7 (excessive ManageCA) leads straight to forged admin certificates and PKINIT domain takeover with minimal classic indicators.
• Layer configuration assessment with behavioral detection so the individual steps are seen as a single attack narrative.