Taking down the power grid!

This red team war story follows an engagement against a large power company, where anything was allowed except harming people or property. The goal was to reach a shielded server room in a basement and leave a dummy device simulating a bomb that could disable the grid's control systems. The team started with online and physical reconnaissance, then phished for domain credentials.

Next, the team found the cards used an older MIFARE Classic format and used a Flipper Zero near a reader to pull the data needed to recover keys. Lacking a commercial skimmer, they improvised one from a Raspberry Pi, a Proxmark, a power bank and a 4G modem, hidden in an electrical enclosure taped beneath a reader. A telescope from a rented van captured PIN entries, and a few cards were read. Cloned cards opened the outer door but not the server room. During office hours the team waited in a restroom, then reached the internal network from an office socket after 802.1x blocked other ports. The access control server accepted RDP with a default-style administrator login, which let them change their card's access rights and enter the room.

The team left the dummy device, removed their card permissions and walked out. The client was surprised the room was reachable and later changed its access control technology, while staff were told to shield PIN entry. Recommendations included stronger card technology such as DESFire, no default passwords, and limiting remote desktop access to users who need it. The speaker noted the cameras had been turned off.