# Validating the SolarWinds N-central 'Dumpster Diver' Vuln

Unauthenticated attacker registers a fake agent against a guessed Customer ID in SolarWinds N-central and dumps stored cleartext AD domain admin credentials.

- Payout: Research
- Severity: critical
- Program: SolarWinds N-central
- Credited: Huntress
- Disclosed: 2020-01-24
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/validating-the-solarwinds-n-central-dumpster-diver-vulnerability-5e3a045982e5
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-validating-the-solarwinds-n-central-dumpster-diver-vulnerability-5e3a045982e5
- Tags: domain:infra impact:data-leak impact:internal-access impact:privesc kind:research platform:threat-intel sev:critical technique:recon vuln:auth-bypass vuln:info-disclosure

**Target:** N-central RMM agent registration / Agent & Probe settings endpoint
**Root cause:** The device auto-import/agent registration feature accepts unauthenticated agent registrations keyed only by a guessable Customer ID, and the resulting configuration dump exposes cleartext Active Directory credentials stored in Agent & Probe settings.
**Steps:**
1. Enumerate internet-exposed N-central servers via Shodan (4000+ results).
2. Brute-force or surgically guess a valid Customer ID.
3. Register a fake Windows agent against that Customer ID via the unauthenticated registration endpoint.
4. Agent appears in the customer dashboard; dump customer configuration from Agent & Probe settings.
5. Extract cleartext domain admin credentials stored there.
**How found:** Notified via a Packet Storm zero-day post by Justin Oberdorf after a 90-day disclosure lapse; Huntress reviewed the PoC source, understood the trigger, and validated by surgically targeting a single Customer ID instead of brute-forcing.
**Exploitation:** Attacker registers a fake agent for a targeted Customer ID without authentication; the agent shows up in the victim's dashboard and the attacker retrieves the stored configuration containing cleartext AD credentials, yielding domain admin access.
**Escalation:** Stored domain admin credentials escalate from unauthenticated RMM access to full Active Directory compromise across the MSP's customers.
**Insight:** RMM agent auto-import/registration endpoints that key trust on a guessable tenant/Customer ID are a direct path to stored credential theft; check whether registration requires any per-tenant secret.