Default Credentials

§ Where this technique fits

§ Dossiers chaining this technique

• Reconfigure MFP LDAP → harvest service-account credentials

  Walk up to / network-into the MFP admin web panel (default creds), change the LDAP address-book server to attacker IP — printer immediately re-binds and sends its service-account creds in cleartext.

  step 2 / 7

• ArgoCD weak RBAC → cluster admin via custom Application

  ArgoCD installed with the default admin user and broad RBAC. Attacker creates an Application pointing at attacker manifests — ArgoCD syncs them with cluster-admin.

  step 2 / 6

• Jenkins /script Groovy console → RCE → AD

  Jenkins script console exposed unauth on the corporate intranet — Groovy 'execute()' = RCE as the Jenkins service account, often a domain user with broad agent access.

  step 2 / 6

• DNS rebinding → access internal router admin from a browser

  Victim visits attacker page. JS opens a connection to attacker.com, which after the first request flips its DNS A record to 192.168.1.1 — subsequent requests now go to the victim's router under the attacker's origin.

  step 5 / 6

§ What commonly comes next

1. 01
   ArgoCD Misconfigured RBAC

   CI-ARGOCD-TAKEOVER · Privilege Escalation
   seen 1×
2. 02
   Jenkins Script Console RCE

   CI-PIPELINE-RCE · Execution
   seen 1×
3. 03
   MFP LDAP Address-Book Credential Theft

   PRT-LDAP-CRED-STEAL · Credential Access
   seen 1×
4. 04
   OTA Update MITM

   IOT-OTA-MITM · Initial Access
   seen 1×