A Tour of the Network

Tuesday, 10:12am

While Nordvik Polymers got on with its Tuesday, the visitors began theirs like well-behaved new employees and read the documentation.

They browsed file shares, collecting account names and group memberships. In one folder belonging to the IT department, they found several network diagrams named network-draft, network-final, and network-final-v2. The last one was called network-final-v3-USE-THIS-ONE-revised.pdf. Documentation of this quality is rare. The visitors were grateful.

Then they did the simplest thing that always works and searched the file shares for the word password.

On an old utility server, they found fix-printer-DO-NOT-DELETE.ps1. It turned out to be a script written to fix a printer that always seemed to drop the connection at the wrong moment. It solved the problem by easily and quickly forcing it off and on the network as the domain administrator. Line 12 in the script contained a password, which was convenient.

The visitors’ movement within the network went from trial and error to a stroll in the park. They noted anything of interest, from who seemed to be local administrators on their own machines, names of servers, switches, and routers, to the IP addresses of each connected printer. Everything was neatly filed away for later.

No vicious tools were needed. They used the same remote administration tools that IT used and kept up with the pace of routine maintenance. To the network and to anyone watching, of whom there was nobody, it looked exactly like administration.

On Wednesday afternoon, they found a server called BACKUP_01.