http://localhost:8080/illumio_basic/2.compromise/index.html Your team is responsible for providing a web portal used by stakeholders in the field to access publicly available information such as weather and local news. Your website is considered low risk since it provides access to open source data is protected by standard perimeter security including: an advanced stateful firewall network address translation load balancer with DDOS protection An minor update to the website was deployed prior to a long weekend. Unfortunately a debug flag was set and the server was deployed with the developer portal enabled. As the site is considered low risk, the portal is password protected, and the site is behind a firewall support is only available during business hours. Hugo en-us Tue, 05 May 2020 13:15:09 -0400 http://localhost:8080/illumio_basic/2.compromise/connect/index.html Tue, 05 May 2020 13:15:09 -0400 http://localhost:8080/illumio_basic/2.compromise/connect/index.html Let’s start by connecting to our web page. Browse to https://webserver-workshops.fdlabs.dev and you should see the developer portal This portal is meant to be used by developers to debug internal services before they were published to the internet. As you can see this portal is protected by simple username/password authentication - there is no 2 factor or certificate based authentication. Let’s try logging in with a typical default username/password combination of admin and hunter2. http://localhost:8080/illumio_basic/2.compromise/expand/index.html Tue, 05 May 2020 13:15:09 -0400 http://localhost:8080/illumio_basic/2.compromise/expand/index.html In many cases an attack starts with compromising a single asset then using that asset as a jump point to access more sensitive resources. Note This action of branching out from one resource to other resources on your network is called lateral movement. Cyberattackers use lateral movement as a core tactic, moving today’s advanced persistent threats (APTs) far beyond yesterday’s more simplistic cyberattacks. Internal network security teams must work overtime to detect lateral movement and stop it in its tracks. http://localhost:8080/illumio_basic/2.compromise/exploit/index.html Tue, 05 May 2020 13:15:09 -0400 http://localhost:8080/illumio_basic/2.compromise/exploit/index.html Now we’ll go a step deeper and review the full results of our port scan. One particularly interesting finding is what appears to be a fileserver hosted on nfs.fdlabs.dev Run showmount -e nfs.fdlabs.dev to list out all the shares hosted on that fileserver The share named sensitive_employee_records looks interesting, lets mount it by running sudo mkdir /mnt/data && sudo mount nfs.fdlabs.dev:/sensitive_employee_records /mnt/data