Case study 02 · Internal · Assumed-breach · Network

    One workstation foothold reaches cloud administrator, the hypervisor cluster and live internal data

    The internal corporate network of a mid-sized technology company: an engineer workstation, a physical LAN of roughly two dozen hosts, a virtualization cluster, and a connected cloud tenant.

    Client profile

    The internal corporate network of a mid-sized technology company: an engineer workstation, a physical LAN of roughly two dozen hosts, a virtualization cluster, and a connected cloud tenant.

    Challenge

    Assume an attacker already has code execution on one workstation, by any route. The engagement tests what that single foothold can actually reach across the internal estate, and whether the secrets protecting the cloud and the infrastructure are within reach of a single compromised process.

    Scope

    • Assumed-breach foothold on one workstation
    • The physical LAN confirmed during recon (roughly two dozen hosts)
    • The virtualization-management cluster on that LAN
    • The connected cloud tenant reachable from credentials found on the host
    • Read-only enumeration and non-destructive proof-of-concept only; no destructive payloads

    Authorized internal red team, assumed-breach start position, PTES-aligned across seven phases.

    ApproachAI-accelerated, human-validated

    A structured assumed-breach engagement run through TitanDef's agent pipeline and powered by frontier models, mapped to PTES and MITRE ATT&CK: plan, recon, hunt, validate, chain, detect, report. Candidate findings were consolidated into a single validated ledger, proven with non-destructive proof-of-concept, and reviewed by a senior human. Two findings that needed an interactive confirmation step from the LAN were marked deferred rather than claimed.

    Key findingsby severity

    27 validated findings

    Critical 6High 10Medium 10Low 1

    Critical

    • A plaintext password left in shell history let the engagement step across the network boundary onto the physical LAN as a full administrator, in one move, with no exploit.
    • A live cloud administrator token sat in a local credential cache on the workstation and could be read silently, with no entry generated in the cloud audit log.
    • An internal management dashboard answered to any unauthenticated host on the LAN, serving live operational data.
    • The virtualization-management server was running a build below the fixed version for a known pre-authentication remote code execution issue, reachable over the LAN with no credentials; hypervisor nodes were likewise unpatched.

    High

    • Ten High findings covering reused local-administrator credentials, plaintext secrets in configuration, management interfaces exposed to the LAN, and default credentials on a hardware console.

    Seven attack chains were mapped from the single foothold. The headline conclusion: multi-tenant cloud administrator, full control of the virtualization cluster, and disclosure of live internal data were all reachable with no further exploitation beyond the initial access.

    Outcomefixed / retested

    Each Critical was given a concrete, time-boxed fix: rotate and revoke the cached cloud token, bind and authenticate the internal dashboard, apply the virtualization vendor patch, rotate reused local-admin passwords and deploy per-host password management, and change the hardware-console default. The three highest chains are closable within hours by configuration change; the roadmap is prioritized by time-to-impact, and fifteen detection rules were handed to the blue team. No independent re-test round is recorded for this engagement.

    1. Hours 0-24

      Rotate the cached cloud token and revoke the service credential; apply the virtualization patch.

    2. Hours 0-24

      Bind the internal dashboard to loopback and add authentication; rotate reused local-admin passwords.

    3. Follow-up

      A second round is planned to verify remediation; not yet performed in this engagement.

    In the report

    “One foothold · three crown jewels reachable today”Section heading, internal red team report

    Engage

    Find out what an adversary already sees.

    Focused engagements of 5 to 7 business days, with first findings in 72 hours. Powered by frontier models; every finding validated by a senior human.

    Scope a pen test →