sudo.fl
← BACK TO OPERATIONS
CLASSIFIED

[ DEBRIEF · PENTEST ]

GHOST PROTOCOL

External + AD-focused red team against a fintech perimeter. Achieved domain admin via phishing → Kerberoast → GPO abuse.

// ENGAGEMENT_TIMELINE

  1. [T+0d] OSINT + phishing lures staged against finance shared mailbox.
  2. [T+3d] Initial foothold via macro-less HTML smuggling payload.
  3. [T+7d] Kerberoasted service accounts; lateral to file server.
  4. [T+11d] GPO modification for persistence; domain admin achieved.

// VULNERABILITIES

  • [CRITICAL]FIND-01Unconstrained delegation on staging host
  • [HIGH]FIND-02Weak service account passwords
  • [HIGH]FIND-03Missing MFA on VPN portal

// TOOLS_USED

BloodHoundRubeusImpacketCobalt Strike

// OUTCOME

> Full domain compromise demonstrated. Remediations: enforce MFA, constrain delegation, rotate SPNs, harden GPO ACLs.