Summary of Results

Initial reconnaissance of the MegaCorp One network resulted in the discovery of a misconfigured DNS
server that allowed a DNS zone transfer. The results provided us with a listing of specific hosts to target
for this assessment. An examination of these hosts revealed a password-protected administrative
webserver interface. After creating a custom wordlist using terms identified on the MegaCorp One’s
website we were able to gain access to this interface by uncovering the password via brute-force.

An examination of the administrative interface revealed that it was vulnerable to a remote code
injection vulnerability, which was used to obtain interactive access to the underlying operating system.
This initial compromise was escalated to administrative access due to a lack of appropriate system
updates on the webserver. After a closer examination, we discovered that the compromised webserver
utilizes a Java applet for administrative users. We added a malicious payload to this applet, which gave
us interactive access to workstations used by MegaCorp One’s administrators.

Using the compromised webserver as a pivot point along with passwords recovered from it, we were
able to target previously inaccessible internal resources. This resulted in Local Administrator access to
numerous internal Windows hosts, complete compromise of a Citrix server, and full administrative
control of the Windows Active Directory infrastructure. Existing network traffic controls were bypassed
through encapsulation of malicious traffic into allowed protocols.