This penetration testing engagement, conducted on the specified network assets within the campus environment, successfully identified a range of security vulnerabilities and exploitable weaknesses. The primary objective of simulating real-world attack scenarios was achieved, providing critical insights into the current security posture of the in-scope systems.

Key findings across the targeted systems underscore common security deficiencies, primarily related to outdated software, weak default configurations, and the prevalence of guessable or easily discoverable credentials:

• 142.232.197.67 (Ubuntu Web Server): This system was identified running a Linux Ubuntu Server with an Apache HTTP Server hosting the Damn Vulnerable Web Application (DVWA). Critical vulnerabilities in the Apache HTTPD version (2.4.x < 2.4.60/59/62) were noted, including potential for SSRF, DoS, and code execution. A direct SQL Injection exploit was successfully performed against DVWA, demonstrating the ability to extract sensitive user credentials, such as Pablo:letmein, confirming the practical impact of web application flaws. The specific DVWA version was not identified.
• 142.232.197.73 (Mail Server): Identified as a Debian Linux Mail Server, this system presented an extensive attack surface with numerous open ports and outdated services. Critical vulnerabilities such as vsftpd 2.3.4 (UnrealIRCd Backdoor), and easily exploitable services like VNC with a weak password, and a direct root bindshell on Port 1524, were discovered. Successful VNC remote access was gained using the default password “password”. A direct root shell was established via netcat to Port 1524, confirming the presence of a severe backdoor. This post-exploitation access further led to the discovery of critical credentials (BCIT:112233) from the mywindows7.txt file, enabling access to other network segments.
• 142.232.197.72 (Windows PC – KFSensor Honeypot): This system, identified as a Microsoft Windows 7 Professional PC, was confirmed to be operating as a KFSensor Honeypot. Despite its nature, it presented an exploitable Remote Desktop Protocol (RDP) service on Port 3389. Utilizing the BCIT:112233 credentials obtained from the Mail Server, and overcoming TLS version incompatibility issues with Remmina on Kali Linux (by configuring TLS 1.2), successful RDP access was achieved, demonstrating that even honeypots designed for deception can be compromised through credential reuse.
• 142.232.197.39 (Honeypot – T-Pot): As a T-Pot honeypot, this system simulated multiple environments. Four distinct methods of unauthorized access were successfully demonstrated through the exploitation of weak or default credentials:
  1. SSH Access: Root access to a simulated Linux (Ubuntu) environment was gained using the default password “toor”.
  2. Telnet Access (Method 1): Shell access to a simulated Linux (Ubuntu) environment was achieved via PuTTY using the simple password “password”. A directory named “JAHIN” was successfully created as proof.
  3. Telnet Access (Method 2): After decrypting the shadow file to obtain the password “admin123” for user “Phil”, a successful Telnet login was performed with these credentials.
  4. Port 4444 Shell Connection: A direct netcat connection to Port 4444 provided a direct shell to a simulated Windows XP environment. These multiple compromises highlight the critical risk posed by guessable or default credentials, regardless of the underlying system’s purpose.

The findings collectively indicate a significant attack surface across the tested environment, largely attributable to unpatched software, weak default configurations, and poor password hygiene. These vulnerabilities present considerable risks to the confidentiality, integrity, and availability of the systems.

It is imperative that the identified vulnerabilities are addressed promptly and systematically. The detailed recommendations provided throughout this report outline actionable steps for remediation. A commitment to implementing these recommendations, coupled with ongoing security monitoring, regular patching cycles, and robust password policies, will significantly enhance the overall security posture and resilience against future cyber threats.