CISA shared the results of a red team assessment. They found the web shell that remained active after another security assessment.
the red team […] gained initial access through a web shell left from a third party’s previous security assessment
From there, the team reached a domain controller in about two weeks, helped by excessive sudo rights, an NFS share with no_root_squash and 61 collected SSH private keys.
CISA’s main lesson: the organization relied too heavily on host-based EDR and lacked network-layer protections.
Pro tip: when someone leaves a web shell on your server, remove it.
In July, CISA described a similar engagement against a federal agency, where an unpatched web server and a phishing email led to domain compromise.