Enterprise Vulnerability Assessment
17 vulnerabilities across a Windows Active Directory domain and a Linux server, ahead of a live instructor-run attack
CS 373 Defense Against the Dark Arts: Enterprise Defense · Oregon State University · Winter 2026
My contribution
I led the vulnerability assessment: I identified and documented the 17 vulnerabilities below, each with affected systems, exploitation impact, and specific remediation, which fed the team's board-level remediation proposal.
An assessment of a deliberately misconfigured enterprise environment — a Windows Active Directory domain and a Linux server — carried out ahead of a live exercise in which instructors attacked the environment. I identified and documented 17 vulnerabilities, each with affected systems, exploitation impact, and specific remediation, feeding a board-level remediation proposal. The most serious finding was a single misdirected line in a configuration file.
Scope
Assessment of a deliberately misconfigured enterprise environment — a Windows Active Directory domain and a Linux server — ahead of a live exercise in which instructors attacked the environment. I identified and documented 17 vulnerabilities, each with affected systems, exploitation impact, and specific remediation, feeding a board-level remediation proposal.
Environment & tooling
A deliberately misconfigured enterprise environment: a Windows Active Directory domain and a Linux server.
Method
Configuration review rather than exploitation testing. Each of the 17 findings records the affected systems, the impact if the condition were exploited, and a specific remediation.
Findings
Ten of the seventeen findings are reproduced here — the seven Windows Group Policy findings and the three Linux findings. The remainder are not published.
Windows / Active Directory Group Policy
- Passwords stored using reversible encryption, making stored credentials recoverable in plaintext
- Minimum password length set to zero characters, complexity requirements disabled
- NTLM minimum session security set to None
- SMB signing disabled, permitting relay and tampering attacks
- Software restriction policy set to allow all, providing no application control
- Insecure guest logons enabled
- RDP exposed with Network Level Authentication disabled
Linux
The SSH daemon was configured to serve /etc/shadow as its pre-authentication login banner. Any host that merely opened a connection received the system's password hashes before authenticating. Pre-authentication disclosure is categorically worse than a weak password policy, because no credential and no access is required to exploit it.
- Password authentication permitted over SSH, with no limit on concurrent sessions
- vsftpd configured to permit anonymous login, anonymous upload, and anonymous directory creation, rooted at /, over an unencrypted channel
Limits & what would confirm
What the available evidence did not establish, and what it would take to settle each open question.
This was configuration review, not exploitation. Each finding identifies a condition that permits an attack; it does not establish that the attack succeeded in that environment.
Would confirm: Confirming exploitability would require controlled testing against each specific misconfiguration.
Takeaway
Severity does not track with complexity. The most serious finding was a single line in a configuration file pointing a banner at the wrong path — trivially fixed, and worse than every password policy weakness in the environment combined.
Tools & techniques
This page describes my own methodology, reasoning, and analysis. Course materials — assignment prompts, instructor- supplied evidence, lab handouts, and graded reports — are not reproduced here, and case-scenario names, hostnames, usernames, and device identifiers have been removed.