Internal Penetration Testing: What Can an Attacker Do With a Standard Employee Account?

Engagement Overview

Client: Large enterprise

Environment: Approximately 1,000 Active Directory users

Assessment: Assumed-breach internal penetration test

Starting point: Standard low-privilege employee account and a controlled testing workstation

Objective: Assess how far an attacker could progress after gaining ordinary employee-level access

The client’s identity and identifying infrastructure details have been withheld.

The Challenge

Organizations often focus on preventing unauthorized access from outside their networks. However, an attacker may already have a foothold through a compromised employee account, a phishing attack, or another initial-access scenario.

G-2 assessed what an attacker could reach and accomplish within the agreed scope, starting with the access available to an ordinary employee.

What G-2 Uncovered

1. Excessive Access to Internal Resources

Misconfigured internal scripts allowed standard users to enumerate and map parts of the Active Directory environment.

More significantly, a shared network drive exposed confidential material without adequate separation between ordinary employees and senior personnel.

The assessment demonstrated that an account with low privileges could potentially access and exfiltrate approximately 3 TB of confidential documents, databases, reports, and internal communications.

2. Weak Internal Authentication Controls

The assessment identified insufficient message-signing protections across most tested hosts. This created opportunities for authentication interception and relay attacks within the internal environment.

The team demonstrated how these weaknesses could be used to capture authentication material and move further into the network.

3. Escalation to Domain Administrator

By combining weaknesses in internal authentication, account privileges, and credential handling, the team demonstrated a path from ordinary employee access to domain-administrator privileges.

The engagement also included an agreed, controlled test of a high-impact persistence technique to assess whether the activity would be detected by the client’s monitoring and administrative teams.

4. Exposure Through a Third-Party Application

A separate web-based assessment identified a vulnerability in the building’s desk-reservation system. The issue exposed floor plans and seating maps covering all 17 floors of the client-owned building.

The vulnerability was in a deployed third-party product, rather than in the client’s own application code.

Business Impact

The assessment demonstrated two significant attack outcomes from a standard employee account:

Potential access to a substantial volume of confidential corporate data.

Escalation to domain-administrator privileges, creating a path to broad control of the corporate environment.

The third-party application finding also highlighted a separate physical-security concern: information exposed through a business application can reveal details about the organization’s premises.

Together, the findings showed that internal access controls, authentication hardening, and third-party application security must be assessed as parts of the same risk environment.

What Would Have Reduced the Risk?

The assessment highlighted several priority areas for remediation:

Apply least-privilege access controls to shared drives and confidential data.

Remove unnecessary scripting capabilities and correct misconfigured internal scripts.

Enforce appropriate message-signing and network protections across relevant hosts.

Strengthen controls against authentication interception and relay attacks.

Eliminate plaintext storage of passwords, especially for privileged accounts.

Include third-party applications in vulnerability assessment, patch management, and security reviews.

Evaluate whether monitoring and incident-response processes can detect high-impact activity within the environment.

Key Takeaway

A standard employee account should not provide a path to large-scale data exposure or domain-administrator privileges.

Assumed-breach testing helps organizations understand what an attacker could do after initial access, identify weaknesses in internal security boundaries, and prioritize improvements based on demonstrated attack paths.

How Far Could an Attacker Get Inside Your Network?

G-2 conducts internal penetration testing to assess access controls, authentication protections, privilege boundaries, and the potential impact of an assumed-breach scenario.

➛Discuss an Internal Penetration Test

This case study summarizes a real penetration-testing engagement conducted under written authorization. Client identities and identifying details have been removed. Findings describe the tested environment at the time of the engagement.