University of Melbourne

COMPUTER 5841

Table of Contents
STATEMENT OF CONFIDENTIALITY..........................................................................................3
ENGAGEMENT CONTACTS....................................................................................................... 4
EXECUTIVE SUMMARY........................................................................................................... 5
APPROACH..................................................................................................................................................... 5
SCOPE.......................................................................................................................................................... 6
ASSESSMENT OVERVIEW AND RECOMMENDATIONS................................................................................................. 6
NETWORK PENETRATION TEST ASSESSMENT SUMMARY..........................................................7
SUMMARY OF FINDINGS.................................................................................................................................... 7
INTERNAL NETWORK COMPROMISE WALKTHROUGH................................................................8
DETAILED WALKTHROUGH................................................................................................................................. 8
REMEDIATION SUMMARY.....................................................................................................10
SHORT TERM............................................................................................................................................... 10
MEDIUM TERM............................................................................................................................................. 10
LONG TERM................................................................................................................................................. 10
TECHNICAL FINDINGS DETAILS............................................................................................. 11
APPENDICES....................................................................................................................... 16
APPENDIX A – FINDING SEVERITIES.................................................................................................................. 16
APPENDIX B – HOST & SERVICE DISCOVERY...................................................................................................... 17
APPENDIX C – SUBDOMAIN DISCOVERY............................................................................................................. 18
APPENDIX D – EXPLOITED HOSTS..................................................................................................................... 19
APPENDIX E – COMPROMISED USERS................................................................................................................ 20
APPENDIX F – CHANGES/HOST CLEANUP........................................................................................................... 21
APPENDIX G – FLAGS DISCOVERED.................................................................................................................. 22
2
Statement of Confidentiality
The contents of this document have been developed by Hack The Box. Hack The Box considers
the contents of this document to be proprietary and business confidential information. This
information is to be used only in the performance of its intended use. This document may not be
released to another vendor, business partner or contractor without prior written consent from
Hack The Box. Additionally, no portion of this document may be communicated, reproduced,
copied or distributed without the prior consent of Hack The Box.
The contents of this document do not constitute legal advice. Hack The Box’s offer of services
that relate to compliance, litigation or other legal interests are not intended as legal counsel and
should not be taken as such. The assessment detailed herein is against a fictional company for
training and examination purposes, and the vulnerabilities in no way affect Hack The Box
external or internal infrastructure.
3
Engagement Contacts
Trilocor Contac