Live PenTest: Physical Breach and Entry into Corporate Headquarters.
Jek Hyde@HydeNS33k
9 views
Apr 12, 2025
~7 min read
Advertisement
1
Live PenTest: Physical Breach and Entry into Corporate Headquarters.
2
Target: Large Building, Enterprise Headquarters. Occupied solely by Target Corporation.
3
Goal: Gain access to Sensitive Locations, Sensitive Physical Documents or Primitives, & access internal Corporate Network.
4
Team: 2x Penetration Testers
Specialties:
1x Network Intrusion & Hacker - "Coder"
1x Physical Device Bypass & Social Engineer - "Jek"
Specialties:
1x Network Intrusion & Hacker - "Coder"
1x Physical Device Bypass & Social Engineer - "Jek"
5
This Live PenTest Tweet brought to you by @TinkerSec. Connected via voice comms. "Backup" for if (when!) team gets caught. "May" post bail.
6
@TinkerSec Initial Passive Recon via Google Street View / Earth & Social Media. Active Recon via Dumpster Diving (see Moments: x.com/i/moments/8858…)
7
@TinkerSec We gained a lot of info from recon. It was announced on Social Media that all the branches were meeting at the HQ for an annual event.
8
@TinkerSec Social Media also gave us detailed pictures of their Badges. (Do a Twitter search for "Badge")
9
@TinkerSec The Dumpster dive gave us internal personnel, phone extensions, laptop types, daily calendars, usernames, passwords, etc.
10
@TinkerSec So... Pretext: We are employees from a branch location visiting for the annual event.
11
@TinkerSec Disguise: Dressy Business Casual w/ Forged Corporate Badges. Jek is wearing a "Pregnant Belly" prosthetic. Coder has Starbucks coffee.
12
@TinkerSec Rule of Engagement: Minimal. Abide laws. Don't place anyone in harm. No destructive means.
13
@TinkerSec Key Advisory: Target is known for their heightened physical security. They employ armed guards. Take care if confronted.
14
@TinkerSec Coder has a set of Rubber Duckies and Bash Bunnies. Jek has her lockpicks, compressed air can, and various other accoutrement.
15
@TinkerSec Our plan is to blend into the returning lunch crowd. Ideally there will be a larger crowd for today's corporate event. We'll see.
16
@TinkerSec We've gone by Starbucks and picked up our "coffees" - Two are real. The others are filled with water. Because @TinkerSec won't expense it.
17
@TinkerSec Right now, we're moving to a staging area near the target to observe the leaving lunch crowd and get a feel for size and timeline.
18
@TinkerSec Note: There is a high likelihood of us getting caught. In this event, we are to continue the test to see if Policy & Procedure are followed.
19
@TinkerSec We're starting to see some early goers leaving for lunch. Past recon says we'll see return traffic around 1pm to 1:30pm.
20
@TinkerSec With that. We're going radio silent for about an hour. I'll pick up again as we're about to move in.
21
@TinkerSec And we're back.
22
@TinkerSec We've approached the building. Not seeing a lot of activity right now. We're headed around back towards the smoke pit.
23
@TinkerSec We see a large group of people congregating around a back door. That may be our best bet.
24
@TinkerSec We've found a seat at the outdoor break area and are chatting with each other.
25
@TinkerSec Jek says "Oh! Thanks." and the sound has changed... not sure if they got in or not.
26
@TinkerSec Hearing voices around them. Something mentioned about "Badge Control."
27
@TinkerSec Small talk and blending in.
28
@TinkerSec Hanging out in the lobby inside. Guard was eyeballing us, so we decided to move and lay low for a moment.
29
@TinkerSec We're working as a two person team. This has pros and cons. I may have been able to smile and slip by, but I'm reacting to my partner.
30
@TinkerSec We have to read each other and follow each others lead without the benefit of talking or communicating beyond glances and body language.
31
@TinkerSec Ok. We've split up.
32
@TinkerSec I smiled at the guard and walked past. Approached a badge accessed door and a man asked "Want me to hold the door open for you?"
33
@TinkerSec I smiled, giggled, and said, "You're wonderful! Thank you!"
34
@TinkerSec I'm in.
35
@TinkerSec My hacker is still in the lobby. He's hacking into the wifi.
36
@TinkerSec Trying to reestablish contact with him and sneak him past the guards.
37
@TinkerSec Got him. He's got a stoic look on his face, as hackers are. I'm joking and talking to my partner. Getting him to smile. Always smile.
38
@TinkerSec "Yeah! You're here! It's Friday! Can't wait to go out tonight! Yes, Frank said to grab a cubicle and get some work done."
39
@TinkerSec We've grabbed a cubicle. Coder is seeing if the ethernet jack is hot.
40
@TinkerSec I've left Coder where he's at to try to gain access to the internal network. Let's see where I can get into.
41
@TinkerSec Found a picture of the floorplan (fire escape). Use that for further attacks and get a feel for where I'm at now.
42
@TinkerSec I'm looking around at desks. They're pretty good at keeping their desks clean.
43
@TinkerSec Family portraits. Love note from a daughter...
I need passwords. Unlocked computers.
I need passwords. Unlocked computers.
44
@TinkerSec We have access to the network. A quick "ifconfig" and nmap scan of the local subnet. That's proof of access.
45
@TinkerSec Coder is walking around with a bash bunny and rubber ducky. Lets see who's computers we can get into.
46
@TinkerSec We don't need to go further on the network. Another tester, separate from us, conducted an "Internal" pentest earlier at the same location.
47
@TinkerSec He got domain.
48
@TinkerSec So we proved that attack vector. Now to see if we can get individual computers. Get into sensitive locations. And get sensitive documents.
49
@TinkerSec I grabbed more coffee from the break room. "It's just so nice not to have to pay for your coffee... ya know?" ;)
50
@TinkerSec Jek is building rapport: "You look SOOO cute! I love your outfit!"
51
@TinkerSec Oooh! Some whiteboards. Get some pics of that.
52
@TinkerSec File cabinets are unlocked. There's a business manual with internal policy and procedure.
53
@TinkerSec Got into a dev center. Got footage of that.
54
@TinkerSec Got into that and another sensitive offlimits area. Pictures and video to prove access.
55
@TinkerSec And with that. I think we have enough. Network access was the main thing. Got some sensitive documents and into sensitive areas.
56
@TinkerSec Let's see if we can get out without getting caught.
57
@TinkerSec Some employees appear to be looking at our badges intently, but no one has stopped us yet. The guard glanced at it. Seemed content.
58
@TinkerSec More small talk. Smiling. Giggling. Not trying to hide or slink around. Appear normal. Appear as if you belong.
59
@TinkerSec In the lobby headed out.
60
@TinkerSec Out the door.
61
@TinkerSec Parking lot.
62
@TinkerSec And into our car. We're home free.
63
@TinkerSec Good run to Jek and Team! Got in, gained internal network access, access to sensitive docs and areas, got out. Did not get caught.
64
@TinkerSec I'll (@TinkerSec) conclude for now. Jek will be back once she completes debrief and tear down. I'll let her update from there. Cheers all!
65
@TinkerSec Hey everyone! It's Jek here! That was awesomesauce. We had a blast and got load of good internal info.
66
@TinkerSec I had never worked with this guy before and it was his first physical. He did a fantastic job ❤️
67
@TinkerSec There was a learning curve as we figured how how to coordinate and communicate without being able to speak openly. But we did great 🙌
68
@TinkerSec Thank you all so much for the support and interest. I love sharing these experiences with you all. I want to provide a realistic view of...
69
@TinkerSec ... what a real pentest looks like. When people are looking for Mission Impossible levels of sneak, that's all they protect against.
70
@TinkerSec But when you realize that attackers take the path of least resistance (i.e.: walk in the front door) you can begin really defending yourself
71
@TinkerSec Just in case you were wondering: here is me before the belly.
72
@TinkerSec 2 minutes later 😉😈❤️👶
73
@TinkerSec I can't remember who said it first, but "Coffee carriers fill hands and open doors." The four in the carrier are filled with water 😋
74
@TinkerSec Between the belly and a bunch of coffee, I had people jumping to open doors for me.
75
@TinkerSec I am very proud to say that @M3chSec was my partner-in-crime for the adventures this week. He's an amazing hacker, colleague and friend 🤓 TY
76
@TinkerSec @M3chSec @threadreaderapp unroll
