Embed Notice

I'm writing a sample report of an internal network pen test, but to keep it short and anonymous, I'm using a TryHackMe box as the target of the report. It's an easy box since I don't want to go crazy, but it is relatively realistic in terms of showing how some poor choices can add up to a complete machine compromise. This is the "Startup" machine for those interested.

I'm struggling as I am only showing one machine on the network, but I can cover the main points: unintended services being exposed, outdated software (not relevant to the challenge, but a fact nonetheless), security mis-configurations, poor file management, "hidden" directories, and some sweet privilege escalation. The point of these reports is to show how the reports I write look like, and what the customer can expect. I have one for web applications (think SaaS) that is based off of OWASP's Juice Box, but only a few vulnerabilities there.

People may hate on CTF-style machines, but I find them very helpful, not just in training for a particular attack technique, but also for projects like this one that helps me not having to setup a whole new network environment to create a sample report.