Follow along as we document a comprehensive penetration by threat actors, from initial access to data exfiltration. This walkthrough demonstrates common security vulnerabilities and how they can be exploited.
Phase 1: Initial Access
Identify Current Privileges
Like checking your visitor badge at a new office, we first determine we have www-data access.
Upgrade Shell
Upgrade from basic shell ("flip phone") to interactive shell ("smartphone") using Python.
Reconnaissance
Begin exploring the environment to understand what's accessible with current privileges.
Phase 2: Tool Discovery
Locate Nmap
Found the "Swiss Army knife" of network scanning tools already installed on the system.
Verify Version
Confirmed Nmap version 7.80 is available for use.
Check Components
All necessary Nmap components are installed, providing full functionality for network discovery.
Phase 5: Service Discovery
Port Scanning
Initiated comprehensive scan of network services to identify potential entry points.
Network Mapping
Created map of available hosts and services across the internal network.
Vulnerability Assessment
Identified potential security weaknesses in discovered services.
Phase 6: Database Exploration
Discovered an interesting database named "phl" during lateral movement to 10.10.1.3, which had both SSH (port 22) and Telnet (port 23) services running.
Credential Testing
admin:admin
"Bzzzzt!" Access denied.
administrator:password
"Nope!" Access denied.
phl:phl
"So close!" Access denied.
phl:ph1123
"DING DING DING!" Access granted!
Privilege Escalation
Network Analysis
Listed network connections using netstat -atunp
Permission Check
Checked sudo privileges with sudo -l
Database Access
Discovered unrestricted MySQL access
Expanded Access
Gained elevated privileges on database server
Data Exfiltration
Database Dump
Used mysqldump to extract database contents to a file