Our assessment revealed that Confluence was still vulnerable to CVE-2022-26134, a widely exploited remote code execution flaw. Fortuna exploited the vulnerability to obtain a local account on the host. Even though the account did not have root privileges, we identified a previously unseen method for sniffing Confluence credentials in transit (using strace to monitor memory usage of the confluence process, and capture cleartext enterprise passwords in transit to the LDAP server). This technique enabled us to recover the domain administrator's password.

Using the compromised credentials, we escalated privileges and achieved full administrative access to the client's Active Directory domain controller, demonstrating complete compromise of identity infrastructure.