Internal pentest for a pharmacy
January 22, 2025
Project Phases:
- Reconnaissance and Information Gathering
- Conducted external analysis and gathered information about the target system without prior knowledge of its internals.
- Vulnerability Analysis
- Used various methods and tools to uncover vulnerabilities in the company’s IT infrastructure, supply chain processes, and partner integrations.
- Exploitation of Vulnerabilities
- Tested the potential exploitation of identified vulnerabilities to evaluate their actual impact.
- Report and Recommendations
- Prepared a detailed report outlining all identified vulnerabilities, their criticality levels, and recommendations for remediation.
Results:
- Identified Critical Vulnerabilities
- Discovered several critical vulnerabilities that could result in severe exploitation consequences, including significant damage from an Advanced Persistent Threat (APT) attack, potentially leading to complete loss of know-how and company bankruptcy.
- Detailed Report and Recommendations Provided
- Delivered a comprehensive report with recommendations on how to remediate the vulnerabilities identified.
- Enhanced Security
- The penetration test significantly improved the security of the company’s IT infrastructure and developments.
Project Highlights:
- R&D Division Focus
- Focused efforts on analyzing the security of computers and employees within the research and development division, which holds critical know-how about the company’s products. The company’s management maintained full control over the testing process.
- Successful Exploitation
- Identified and exploited a vulnerability in the remote access service, allowing penetration of the company’s DMZ. Then, discovered and exploited a vulnerability in the file server and Active Directory, gaining access to the Jira server of the R&D department. Through privilege escalation, we installed rootkits on the company’s critical servers and covertly extracted sensitive information.
- Achieved Project Objectives
- Our actions remained undetected by the company’s technical staff until management ordered the privilege escalation to cease, acknowledging the complete success of the project’s objectives.
