Initial Enumeration
Let’s begin with basic reconnaissance.
When we scan real-world targets with tools like network scanners and web crawlers,
it’s generally considered good practice to execute them in as limited a scope
as possible to avoid overloading any systems.
Since we are only dealing with three systems,
we’ll scan the top 1000 ports with nmap.
The output indicates that we are dealing with a Windows environment,
and specifically an Active Directory infrastructure
containing an “evil.com” domain,
and a DC02 host acting as the domain controller.
In addition, the scan reveals two servers named file01,
and web01.
Remote Desktop is running on all three targets and although we could brute-force
them, this is not a common find during an external penetration test.
However, web01 exposes access to an IIS web server on TCP port 80,
which is a more appropriate first vector for our case study.
Let’s begin by browsing the web server.
This application allows file uploads.
If configured incorrectly, this could provide the initial foothold we need.
Since we are targeting so few machines,
we will pause our enumeration to focus on this potential vulnerability.