DOMAIN ADMIN Compromise in 3 HOURS

Hi everyone; I hope you enjoyed my previous blog post on “How I obtained Admin access in 30 seconds” — so today I am bringing you another CRITICAL finding I discovered recently; which sheds some lights on the importance of changing default credentials and password reuse.

— THREE HOURS OF ENUMERATION and EXPLOITATION —

First we all love some enumeration. With a simple nmap scan on the target(s), I identified one interesting application server called Sun GlassFish Enterprise Server. After some investigation and research, I found out that this…