112
The Office of Danger
a choose your own adventure story!
a choose your own adventure story!
By
By
Phil Eveleigh
Phil Eveleigh
@Yekki_1
@Yekki_1
Continue
The Office of Danger
a choose your own adventure story!
a choose your own adventure story!
By
By
Phil Eveleigh
Phil Eveleigh
@Yekki_1
@Yekki_1
Continue
The Target!
• Multi-Use office in Central London
• Client rents out Half of 7
th
Floor & Entire of 8
th
Floor
• Previous information and OSINT provide us with:
• Security guards on ground floor – up to main building reception on 1st
• Security guards on first floor reception area
• Security gates to get to lifts
• Security doors to gain access to offices
• Other users in the building include a wework/regus style shared office on 4th floor
• Names of Head of IT and IT staff within the target organisation
Continue
Scope
The following targets were agreed with the client prior to the job:
• Access to the 7
th
floor
• Access to the 8
th
floor
• Scan of the internal network
• Identify any low hanging fruit on the internal network
Continue
Day 1
Continue
The Set Up!
• OSINT discovered a shared office space within the building of the target organisation.
• Do you decide to use this, or is it out of scope?
In Scope
Out of Scope
Decisions, Decisions…
• You’ve decided that the 3
rd
party office is in scope.
• Do you try and book a legitimate viewing through their head office?
Book a
Viewing
Don’t book a
viewing
Let’s have a look!
You ring up head office to book a viewing – someone from the office will be in touch.
They do not ring back.
Continue
Show Time!
It’s time to go!
You bypass security on the ground floor – they point you to main reception.
Do you pretend you have a booking with the 3
rd
party to view the shared offices?
Yes
No
Will they / Won’t they…
Reception rings the reception of the 3
rd
party.
You are not confirmed as a visitor.
Continue
You explain that head office never rang back…
After a few minutes you are presented with a security pass and told to head to the 4
th
floor via the elevators.
Set Bearing to …
The pass works and you are now at the elevators.
Where do you go?
3
rd
Party
Client
This is a nice office…
You are greeted at 4
th
Floor reception with confusion
You talk to the receptionists and are provided a tour of the office. You ask
questions about the security of the building and gain any insights.
After the 25 minute tour, you ask to leave using the stairs. This is not permitted
without a security guard.
You are shuffled back towards the lifts.
Continue
Up or Down?
You are out of the 3
rd
party offices.
Do you head to:
Client
Main
reception
Back again…
You get back to the ground floor and exit the lifts. You realise the only way is up!
Which of the client’s floors do you want to visit?
7
th
8
th
Reception Time
You attempt to bypass reception but security guards escort you to the main desk.
You explain your back story: you are an IT contractor looking to check the WiFi in
the building. reception rings their head office and asks you to take a seat.
After 10 minutes, you are still waiting, do you:
Get up and
leave
Continue
waiting
And the Oscar goes too…
You continue to wait.
The receptionist comes overs and says no-one has any knowledge of you being there.
They request that you get someone on the phone they can speak to.
You try to calmly re-explain the situation, however you see the security guards taking
more of an interest.
Do you?
Leave the
building
Ring a
colleague as
a “contact”
Ring Ring!
Your colleague answers the phone, quickly explaining the situation you pass
them over to the receptionist.
The situation is re-explained, the receptionist looks up your colleague’s name
on the system and this is not found.
They ask you to explain, do you:
Make your
excuses and
leave
Continue
with your
story
SECURITY!!
The receptionist is no longer believing your story and asks you to come back with a
work order.
You persist with attempting to gain access.
Security is called over and escort you into a meeting room.
You decide before the situation escalates to use your letter and are escorted out of the
building.
Continue
Heading Up!
Which of the client’s floors do you want to visit?
7
th
8
th
End of Day 1
You exit the building without further incident.
You head to the pub over the road for a deserved pint.
Continue
Access Please…
You exit on the 8
th
Floor.
There are the elevators and an access card controlled door.
You try the door, it does not open without a key card.
The card from the 3
rd
party company does not work.
No-one enters or exits during the 10 minutes you have waited.
Do you:
Leave
Wait
Knock Knock?
You continue to stand in the vestibule for another 20 minutes.
A member of staff has noticed you through the window, they have not let
you in.
Do you:
Take the
elevator to
7
th
floor
Wait
Who’s there?
You continue to wait.
After another 5 minutes, the elevator behind you opens.
Two security guards exit the lift and ask you to follow them.
You decide before the situation escalates to use your letter and are
escorted out of the building.
Continue
Welcome!
You exit the elevator and are buzzed through the door by the client’s receptionist.
Looking around, there is no way to avoid a direct interaction with the receptionists.
You walk as slowly as possible to provide time to think of a plan!
Continue
whoami
You decide to pretend to be a new starter during COVID. Working from home and
this is your first time in the office.
Which name do you provide:
Fake name –
existing
employee
Real Name
Hello, Is it me you are looking for?
You provide a staff member’s name.
The receptionist looks you up on the system and notices you are in a call
You act confused and suggest maybe it’s someone else
They continue to investigate while you stand there….
Continue
Hello, Is it me you are looking for?
You provide your name
The receptionist looks you up on the system and is unable to locate you
You act confused and offer vague explanations.
They continue to investigate while you stand there….
Continue
A grown up?
The receptionist starts to look more suspicious and asks for your line manager’s
name.
As part of the OSINT you located the Head of IT’s name, do you:
Change the
conversation
Provide a
name
My Precious
During the confusion of attempting to locate you, the receptionist asks if
you have received your mug yet.
You stare blankly, thrown by the question and reply with a firm no.
A branded mug is passed to you, do you take it?
Yes No
What, no cup?
You turn down the offer (like a mug)
The receptionist looks at you oddly, and rings down to security.
Security arrive at reception. You decide before the situation escalates to
use your letter and are escorted out of the building.
Continue
You sure you work here?
The receptionist looks unsure at you, while you admire your new mug.
They ask how you got to the floor and if you had a key card.
Do you:
Say someone
let you up
Show them
your 4
th
floor
key card
Something fishy
The receptionist takes your key card and states that it isn’t one of theirs.
You get the impression they are starting to see through your story.
They can’t get through to any managers and ask for other contact details.
Do you:
Provide
name of
contact
Show get out
of jail letter
Rumbled!
You show your get out of jail free letter and explain the situation to the receptionist.
They ring your contact and confirm everything.
They also ring security and you are escorted out of the building.
Continue
Something fishy
The receptionist rings reception to check they didn’t let anyone up, they confirm you
should be on the 4
th
floor.
You get the impression they are starting to see through your story.
They can’t get through to any managers and ask for other contact details.
Do you:
Provide
name of
contact
Show get out
of jail letter
Saved!
The receptionist rings your client contact who appears behind you in reception.
They escort you to a meeting room for an initial debrief.
Together you make a plan, do you:
Call it a day
Ask to be
taken past
reception
Headin’ in!
Your contact agrees to confidently walk you past reception into the office area.
Do you request to be left:
8
th
Floor7
th
Floor
Is this seat taken?
You let yourself into the HR office through the open door.
You sit at a desk without being challenged, partly thanks to
your mug on show.
After an hour, people start leaving for the day, do you:
Leave with
them
Stay and scan
the network
Where is everyone?
You stay in the office and scan the network for a few hours.
Deciding you are done for the day, you head back to the lifts and go down to reception.
There are security gates to get out, in all the confusion the pass you had has been
disabled.
Jump the
gate
Wait for help
Olympics here I come…
You start to climb over the gate.
A security guard sees you and rushes over.
You explain that the pass you had doesn’t work and show it to them.
They escort you to a meeting room.
You decide before the situation escalates to use your letter and are
escorted out of the building.
Continue
ANYONE?
You wait for 15 minutes and the elevator opens.
You explain your situation and show them the card not working.
The person lets you through the gate. You leave your card in a returns box.
Continue
Where am I?
The client decides that it is unfair to provide you access to the 8
th
floor.
They leave you on the stairs between the 7
th
& 8
th
floor. Both floors are protected by
access controlled doors.
Luckily for you, the toilets are on the unsecured side and after 5 minutes someone goes
through the door. You grab the door and let yourself into the 8
th
floor.
Continue
Is this seat taken?
You sit at a spare desk without being challenged, partly
thanks to your mug on show.
After an hour, people start leaving for the day, do you:
Leave with
them
Stay and scan
the network
My Day 1 Timeline
• Decided 3
rd
party was in scope
• Rang up head office to book an appointment
• They did not ring back
• At main reception pretended I had an appointment with 3
rd
party
• Provided with pass. Took elevators up to 4
th
floor
• Did a 25 minute tour of the shared office space
• Requested to access stairs to exit – not permitted
• Went up to the 7
th
floor via the lifts
• Spoke to reception and provided my real name
• Provided the Head of IT name as my line manager
• They tried ringing him – he was on holiday
• Was provided with a mug
• Ended up getting them to call the client – who was behind me!
• He left me on the stairs between the floors
• Tailgated into the 8
th
floor
• Sat at a desk and did some scans
• Got stuck between the elevators and the exit due to my card being disabled
• Waited and got someone to help me exit
Continue
Day 2
Continue
A big entrance!
The client decided that you don’t need to bypass main reception for Day 2.
However, the client is WFH due to illness. You explain the situation to main reception
and they ring client reception.
After 20 minutes you are provided with a pass.
Where do you head?
ElevatorStairs
Excuse Me!
As you head to the stairs, the receptionist informs you that you need to be escorted.
A security guard comes over to escort you up the stairs to the client reception.
Do you:
Head to the
elevators
alone
Continue to the
stairs with
security guard
A bit chatty…
You meet the security guard and they are overly chatty.
Your heart rate can’t deal with this level of small talk and you explain
that you don’t want to waste their time walking up all the stairs.
You awkwardly walk off and head back to the elevators…
Continue
How High?
You pass the security gates into the elevator waiting area.
Which floor do you go to?
8
th
7
th
Up We Go…
You wait until someone presses floor 7.
You follow them in, and as you exit you walk into the reception area of the client.
You try to confidently walk past reception, but are stopped by the receptionist.
Continue
Up We Go…
You wait until someone presses floor 8.
You follow them into the lift and let them exit first.
As you exit the lift they are struggling to find their pass to get through the
access controlled door.
Do you:
Wait
Get back in
the lift
Down, Down, Down!
You head back into the lift and press the button for the ground floor.
You exit the elevator and wait for another person heading up to the 8
th
floor.
After 10 minutes, you follow someone else into the lift.
Continue
Straight In!
This person has their pass around their neck and head straight towards to the doors.
You follow and hold the door before it closes.
Now in the 8
th
floor, where do you go?
Do a lapTake a seat
WHERE IS IT?
You take your backpack off and pretend to look through it for your non-existent pass.
Eventually the staff member finds their pass and opens the door.
Grabbing the door, you follow them in.
Now in the 8
th
floor, where do you go?
Do a lapTake a seat
Getting my steps in…
You do a lap of the office, noting the view out of the window.
No-one pays any attention to you.
Where next?
Take a seat
Head to 7
th
floor
Is anyone sat here?
You find an empty seat and connect into the network.
You start your scans and look around the network. No-one notices you.
After 10 minutes, you overhear a team discussing a person who didn’t
arrive at reception. Security have started a search of the building, looking
for you!
Do you:
Find a meeting
room to hide in
Stay where
you are
No Worries!
Staying where you are, your scans finish and after some more enumeration
you decide you have done all you can here.
Do you?
Head to the 7
th
floor
De-brief the
client
Heard of personalisation?
You search the floor and find an empty meeting room.
You sit in it and unplug the VOIP phone to test that network.
This meeting room turns out to be an Executive’s office.
They return from a meeting and enquire why you are there. You make polite conversation,
during that do you:
Leave quickly
Plug phone
back in
Head Down!
While leaving the office, the Executive informs you that there are empty meeting rooms
on the 7
th
floor.
You decide it’s time to head down to the 7
th
floor.
Continue
What exactly are you doing….
You fumble with the cable and the phone, taking longer than anticipated to plug the
cable back in.
The Executive starts looking at you with a suspicious look, once you have finished
they invite you to follow them.
The Executive escorts you down to main reception to check your identity.
Continue
Let me in…
You exit the 8
th
floor onto the stairs and head down to the 7
th
floor.
There are 2 access controlled doors to access this floor, as another company owns the
other half of the floor.
After 15 minutes, no-one has gone in or out of the first door to the 7
th
floor.
Do you:
Wait
Head back to
8
th
floor
Let’s call it a day
You head back up to the 8
th
floor and quickly someone exits the floor allowing you back in.
It’s getting late in the day and you decide that you can’t gain access to the 7
th
floor.
It’s time to debrief the client.
Continue
Does anyone even use this floor?
After another 10 minutes someone finally enters the 7
th
floor.
You manage to grab the door and tailgate them in.
As you follow them in, they slow down and look back at you.
Do you:
Go to the other
office door
Continue to
follow them
Can I help you?
You continue to follow in an attempt to gain access to the client.
The staff member stops before scanning their badge and questions who you are.
They do not believe your story and escort you to reception.
Continue
I’m not following you…
You turn and head towards to the other office door.
The person lets themselves into the client’s office, but you cannot catch the door
before it closes.
You wait 5 minutes until a member of building staff comes through and heads
towards the client’s door. You manage to grab the door and let yourself in.
There are multiple empty offices, you sit in one for the rest of the day finishing all
network tests. No-one notices your presence.
Continue
You Shall Not Pass!
You speak to the reception staff in an attempt to provide explanation.
They will not let you go anywhere without a staff member being present to collect you.
Your client contact is WFH due to illness and is not able to physically collect you.
Do you:
Produce your
get out of jail
letter
Head back to
the lifts
The rollercoaster continues…
That was a close one!
Heading back to lifts you need to quickly decide where to go next.
Do you head:
Down
(ground floor)
Up
(8
th
floor)
Knock Knock..
You head up to the 8
th
floor.
Luckily someone immediately steps out of the other lift and heads towards the door.
As they approach the door, they stop and ask if they can help you…
Do you:
Act familiar and
ask them about
their weekend
Tell them you
have lost your
pass and ask to
be let in
Chatting for Success
You talk to them about their weekend and what they have planned during the week.
Whilst chatting you both naturally move towards the door and they use their pass.
You hold the door for them.
Continue
Being polite pays off!
They go through the door and you say your goodbyes. They head off towards their desk.
Now in the 8
th
floor, where do you go?
Do a lapTake a seat
You know the rules
They politely tell you that they can’t let you in without having a pass.
They offer to escort you to reception, do you:
Decline the offerAccept the offer
Does a window open?
You tell them you will head down to reception.
You push the button and wait for the lift, while they enter the office.
Do you:
Wait for them to
leave (allowing
the door to shut)
Try to grab the
door as it is
closing
Sneak Mode Not Activated
As you try to grab the door, the staff member sees you and escorts you down to
reception.
Do you:
Show your Get
Out of Jail letter
Follow down to
reception
Welcome Back!
The receptionist immediately recognises you.
They ask you to take a seat. Do you:
Show your Get
Out of Jail Letter
Sit Down
When a door closes…
The door closes, and you wait for 5 minutes before the elevator doors open and a staff
members heads towards the door.
You pretend to be on the phone and follow, grabbing the door before it closes.
Now in the 8
th
floor, where do you go?
Do a lapTake a seat
No Chance!
You show your get out of jail free letter and explain the situation to the receptionist.
They ring your contact and confirm everything.
They also ring security.
Continue
999 this is an emergency…
The receptionist gets off the phone and informs you someone is on their way to help
you.
After a few minutes, three security guards exit from the lifts and walk over to you.
You have been caught and have no choice but to show the get out of jail free letter.
Continue
Where do you think you are going?
While in the lifts, reception ring security.
As you exit the lift, security guards meet you and escort you to a meeting room.
Continue
I’m too pretty for jail…
You have been caught!
It’s time to use your get out of jail free letter and debrief the client.
Continue
All Done!
You ring the client and provide a debrief of your findings throughout the 2
day assessment.
The client asks if you can debrief both the client reception and the building
reception to ensure everyone is aware of the engagement.
You debrief both receptionists with no issue.
Continue
Job Done
You exit the building after debriefing all parties.
You head to the pub over the road for a deserved pint.
Continue
My Day 2 Timeline
• Got provided with a pass to bypass reception
• Asked to use the stairs – but would require an escort
• Got the elevator to 8
th
floor. Tailgated someone who struggled to find their card
• Sat down next to commercial services team – overheard them discussing me
• Got a coffee and sat in their breakout area
• Packed up and sat in a meeting room. Unplugged phone
• Turned out to be the Global Head of Finance’s office. Left quickly! (did not plug the phone back in)
• Headed to the 7
th
floor
• Spent 20 minutes waiting to tailgate someone. After following through the first door, turned to the
other office
• Waited another 10 minutes in the vestibule area until a caterer let me through to the 7
th
floor
• Sat in a meeting room for the rest of the day without being questioned
• De-briefed the client & both reception teams
• Went for a beer!
Restart