I see iSCSI — compromising DC backup

People aren’t kidding when they say “enumeration is key”. That’s actually how I was able to obtain access and download a company’s Domain Controller (DC) backups. Below is a quick diagram showing you the attack path:

First things first — nmap. Using the following nmap command, I was able to obtain information regarding the target server (which revealed iSCSI service on port 3260)