================================================================================ RED TEAM ATTACK TIMELINE Engagement: MegaCorp Industries External Assessment Period: 2026-03-15 through 2026-03-28 Status: IN PROGRESS Classification: CONFIDENTIAL - Red Team Eyes Only ================================================================================ Instructions for Students: -------------------------- This timeline template documents a full red team attack chain against MegaCorp Industries. The RECON phase is complete. INITIAL ACCESS has partial entries with hints for you to complete. PRIVILEGE ESCALATION, LATERAL MOVEMENT, and ACTIONS ON OBJECTIVES are blank -- fill them in based on the recon data, vulnerability scan results, and your analysis. Use ATT&CK technique IDs where indicated. Reference: https://attack.mitre.org/techniques/enterprise/ ================================================================================ PHASE 1: RECONNAISSANCE (COMPLETE) ================================================================================ [2026-03-15 09:00] -- OSINT Collection Started Action: Passive reconnaissance using public sources Operator: Red Team Lead Technique: T1593 - Search Open Websites/Domains Details: Queried WHOIS, crt.sh, Shodan, LinkedIn, GitHub Result: Identified 10 subdomains, 9 employees, full tech stack Evidence: See recon-data.txt [2026-03-15 14:30] -- Subdomain Enumeration Action: Active DNS enumeration and brute forcing Operator: Red Team Lead Technique: T1590.002 - Gather Victim Network Information: DNS Details: Used subfinder + custom wordlist against megacorp-industries.com Result: Discovered dev, staging, jenkins, gitlab subdomains on AWS All in 18.220.134.x subnet -- flat dev/CI network segment Evidence: recon-data.txt, Section 2 [2026-03-15 16:00] -- Technology Profiling Action: Fingerprinting web services and identifying software versions Operator: Red Team Analyst Technique: T1592.002 - Gather Victim Host Information: Software Details: HTTP headers, Wappalyzer, public API docs analysis Result: Django 4.2 backend, React frontend, Jenkins CI, GitLab CE, WordPress blog, OpenVPN, PostgreSQL, Redis Evidence: recon-data.txt, Section 4 [2026-03-16 08:00] -- Vulnerability Scanning Action: Active scanning of identified hosts Operator: Red Team Analyst Technique: T1595.002 - Active Scanning: Vulnerability Scanning Details: Nmap service scan + Nikto web scan on all discovered hosts Result: Multiple critical findings including unauthenticated Jenkins, exposed debug modes, default credentials, outdated software Evidence: See vulnerability-scan.txt [2026-03-16 15:00] -- Attack Path Analysis Action: Prioritized attack paths based on effort/impact/detection risk Operator: Red Team Lead Technique: N/A (Planning) Details: Identified 5 viable attack paths; Jenkins script console is lowest effort with highest impact Result: Primary: Jenkins RCE; Secondary: Dev default creds; Tertiary: Staging credential harvesting Evidence: vulnerability-scan.txt, Section C PHASE 2: INITIAL ACCESS (PARTIALLY COMPLETE) ================================================================================ [2026-03-17 09:00] -- Jenkins Script Console Access Action: Accessed unauthenticated Jenkins Groovy script console Operator: Red Team Operator Technique: T1190 - Exploit Public-Facing Application Details: Navigated to jenkins.megacorp-industries.com:8080/script Console accessible without any authentication Result: Confirmed arbitrary Groovy script execution capability Evidence: Screenshot jenkins-console-001.png [2026-03-17 09:15] -- TODO: System Enumeration via Jenkins Action: ??? (What commands would you run first?) Operator: [YOUR NAME] Technique: T1059.004 - Command and Scripting Interpreter: Unix Shell Details: TODO -- Describe what system information you would gather using the Groovy console. Think: whoami, hostname, network interfaces, environment variables, file system exploration. Result: TODO -- What did you find? Evidence: TODO [2026-03-17 10:00] -- TODO: Establish Persistent Access Action: ??? (How would you maintain access if Jenkins is restarted?) Operator: [YOUR NAME] Technique: TODO -- Select appropriate ATT&CK technique ID Details: TODO -- Describe your persistence mechanism. Consider: - SSH key injection - Cron job - Jenkins job that callbacks - Web shell in Jenkins workspace Result: TODO Evidence: TODO [2026-03-17 11:00] -- ALTERNATIVE PATH: Dev Environment Access Action: Logged into Django admin with default credentials Operator: Red Team Operator Technique: T1078.001 - Valid Accounts: Default Accounts Details: Used admin:megacorp on dev.megacorp-industries.com:8000/admin/ Result: Full Django admin access on development environment Evidence: Screenshot dev-admin-001.png [2026-03-17 11:30] -- TODO: Dev Environment Data Harvesting Action: ??? (What would you look for in the Django admin?) Operator: [YOUR NAME] Technique: TODO -- Select appropriate ATT&CK technique ID Details: TODO -- What data would you extract from the dev environment? Consider: user tables, API keys, database connection strings, source code paths, configuration files. Result: TODO Evidence: TODO PHASE 3: PRIVILEGE ESCALATION ================================================================================ INSTRUCTIONS: This phase is entirely blank. Based on the access obtained in Phase 2, describe how you would escalate privileges. Consider: - Jenkins runs as which user? Can you access /etc/shadow? - Are there sudo privileges or SUID binaries? - Can you harvest credentials from Jenkins credential store? - Staging debug toolbar exposed AWS credentials -- can you use them? - Redis on staging has no auth -- can you write SSH keys? Fill in timeline entries following the format above. Include: - Timestamp (continue from 2026-03-17) - Action description - Operator name - ATT&CK technique ID - Detailed description - Expected result - Evidence reference [2026-03-17 13:00] -- TODO: [Title] Action: TODO Operator: [YOUR NAME] Technique: TODO Details: TODO Result: TODO Evidence: TODO [2026-03-17 __:__] -- TODO: [Title] Action: TODO Operator: [YOUR NAME] Technique: TODO Details: TODO Result: TODO Evidence: TODO (Add as many entries as needed) PHASE 4: LATERAL MOVEMENT ================================================================================ INSTRUCTIONS: Describe how you would move from the compromised system(s) to other systems in the environment. Consider: - All dev/CI hosts are in the same subnet (18.220.134.x) - Jenkins likely has SSH keys or credentials for deployment targets - GitLab may contain credentials in repository code or CI/CD variables - Staging database credentials were exposed via debug toolbar - Redis can potentially be used for SSH key injection Relevant ATT&CK tactics to consider: - T1021 - Remote Services (SSH, RDP, etc.) - T1550 - Use Alternate Authentication Material - T1563 - Remote Service Session Hijacking - T1534 - Internal Spearphishing [2026-03-18 09:00] -- TODO: [Title] Action: TODO Operator: [YOUR NAME] Technique: TODO Details: TODO Result: TODO Evidence: TODO [2026-03-18 __:__] -- TODO: [Title] Action: TODO Operator: [YOUR NAME] Technique: TODO Details: TODO Result: TODO Evidence: TODO (Add as many entries as needed) PHASE 5: ACTIONS ON OBJECTIVES ================================================================================ INSTRUCTIONS: Define and execute actions that demonstrate impact to the client. Remember: in a real engagement, you would NOT actually exfiltrate real data or cause damage. You would demonstrate ACCESS to objectives. Common red team objectives: - Access to source code repositories - Access to production database (prove access, do not dump data) - Access to cloud infrastructure (AWS console or CLI) - Domain admin or equivalent privileges - Ability to deploy code to production - Access to customer/financial data (prove access only) Document what you would demonstrate to the client and how. [2026-03-19 09:00] -- TODO: [Title - Objective Demonstration] Action: TODO Operator: [YOUR NAME] Technique: TODO Details: TODO Result: TODO Evidence: TODO (Add as many entries as needed) PHASE 6: CLEANUP & REPORTING ================================================================================ INSTRUCTIONS: Document the cleanup steps and reporting approach. Cleanup considerations: - Remove any persistence mechanisms installed - Delete uploaded files, web shells, or tools - Remove injected SSH keys or modified configurations - Clear command history where appropriate - Restore any modified files to original state Reporting approach: - Compile all evidence (screenshots, logs, command output) - Map every action to ATT&CK technique IDs - Write executive summary for non-technical leadership - Write detailed technical narrative for engineering team - Prepare remediation recommendations prioritized by risk [2026-03-20 09:00] -- TODO: [Cleanup Steps] Action: TODO Details: TODO [2026-03-20 14:00] -- TODO: [Report Preparation] Action: TODO Details: TODO ================================================================================ END OF ATTACK TIMELINE Compile findings into final report using the template from theory.html ================================================================================