Introduction 

In this blog, we focus on a well-known attack vector: authentication, and specifically passwords. For many red team operators, as well as cybercriminals, weak passwords are an easy vector for initial access to an organisation. Even with a password policy, there is still the possibility of weak passwords being assigned to user accounts in the environment. One such vulnerable type of “password”, which has often been neglected to date, is an empty password. That's right, an account that is basically accessible to anyone. It can inadvertently give a threat actor the ability to move horizontally through the Active Directory environment, or worse, to the organisation's crown jewels. 

Background story 

During one of our adversary simulations, we exfiltrated the NTDS file on one of the domain controllers, as our final objective was to perform password usage analysis on all domain user accounts. During the analysis of the NT hashes in this adversary simulation, it turned out that there were more than 100 users who used the same NT hash: “31D6CFE0D16AE931B73C59D7E0C089C0”. 

This string is the well-known NT hash for an empty password. Usually, this concerns disabled accounts, such as the Guest account. As red team operators, we never looked much further into it, because with disabled accounts you can't progress any further. Or can you? 

On a recent assignment, we encountered a mature environment: full segmentation and filtering, fully patched, in short: no low-hanging fruit. My colleague looks at me and casually says: “What if there are empty passwords set on active accounts”? At first, we didn't take this idea seriously. But a few commands later we had a PowerShell prompt open as domain admin. How did this even happen!? 

Why do accounts with empty passwords exist? 

Let's investigate why empty passwords (may) exist in Active Directory. And how do you configure them? Usually, it is not possible to configure an empty password for an account. If the default password policy is active, a minimum number of 7 characters, as well as password complexity are required for every domain user account. Configuring an empty password would result in the following error message: 

# ActiveDirectory module 
Get-ADUser -Filter {PasswordNotRequired -eq $true -and Enabled -eq $true} | Select SamAccountName 

# WMI 
Get-WmiObject -Query "SELECT * FROM Win32_UserAccount WHERE PasswordRequired=False AND Disabled=False" | select Name 
 
# Ldapsearch 
ldapsearch (&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=32)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) cn 

# BloodHound 
MATCH (n:User {enabled: True, passwordnotreqd: True}) RETURN n