It really doesn&#x27;t.<p>The attacker can pull credentials that any user uses on any webpage or other TLS-based connection. It&#x27;s not the domain admin password or the database password, it&#x27;s both, and the other ones too. Like the one the accountants type into the company&#x27;s banking website.<p>TLS MITM is essentially the holy grail because there are so many overlapping ways to break into everything. If there is some password nobody has ever typed into a web admin portal then get their email credentials and do a password reset. Or use one of the apps that uses TLS to authenticate updates to push out a key logger. Or wait for a new attack to be published and block delivery of the patch. Or take advantage of being able to display anything you want on the company&#x27;s internal website and start social engineering. On and on.<p>TLS under non-self-compromise circumstances provides reasonable security and is allowed through corporate firewalls, which means that everything uses it one way or another. Which means if you can compromise TLS then you can essentially compromise everything.