Go Ahead, Make Our Day

This blog post recounts a penetration test where the author retrieved password hashes (including LANMAN and NTLM) from a domain controller and uses the experience to emphasize the prevalence and importance of fixing low-hanging fruit—default or guessable passwords, crackable/hard-coded credentials, cleartext sensitive data, and unpatched systems. It is an educational advisory aimed at encouraging remediation of obvious weaknesses rather than a technical incident report or indicator-of-compromise disclosure.