The engagement objective was specific: start with internal network access and determine whether an attacker could reach and extract data from the credit card database, which lived in an air-gapped network segment. The client's assumption was that the segmentation would hold even if everything else failed. They wanted to test that assumption.
The first phase was standard escalation. I used LLMNR/NBNS poisoning to capture credential hashes off the wire, cracked a local admin password from a compromised workstation, found a logged-in domain admin session on a machine I had access to, and dumped the domain controller's NTDS database from there. Domain admin in a large enterprise environment is not the end of a penetration test. It is the point where you start asking what the network can actually reach.
The air-gapped segment stopped direct approaches. Firewall rules blocked the obvious paths from the enterprise network to the segment hosting the database. The segmentation was real, not just logical separation on the same physical infrastructure. The direct route was not available.
Enumeration of the enterprise network turned up something useful: a third-party management system with privileged access to the database segment. The system existed to facilitate administrative access that the client's own team couldn't easily provide through the normal network boundary, one of those operational compromises that gets made to solve a practical problem without fully accounting for what it opens up from an attacker's perspective. I had access to a highly privileged account on it from earlier lateral movement. That account had the access I needed.
Through that management system I was able to pull a snapshot of the database. The database was encrypted, which is the right configuration for data at rest. But during the same lateral movement phase that had given me access to the management system, I had also found third-party credentials that included key material used for the encryption. I used those recovered credentials to decrypt the database locally.
Inside was the full credit card database. Every record was there. The cards themselves were tokenized: the actual card numbers had been replaced with tokens, and the mapping table that would let you reverse them back to real numbers was not present in this database. The sensitive data was not directly exposed. That one control, applied at the data layer rather than the network layer, was the only thing standing between a complete compromise and an actionable one.
Every other layer had failed. Domain admin gave me broad network access. Lateral movement gave me credentials I should never have been able to reach. A third-party system with privileged access to an air-gapped segment had not been adequately secured or scoped. Encryption key material was accessible from the same environment it was protecting. The architecture had accumulated these failures independently, and they combined into a path that should not have existed.
The lesson is not that segmentation is useless. Air-gapping the database segment was the right call. The problem was that the segmentation was treated as a perimeter (something that would stop attackers at the boundary) rather than one layer in a defense-in-depth model. The management system punched a hole in the perimeter because someone needed it for operations, and the hole was never given the scrutiny it deserved. Credentials that could decrypt the database were accessible from a network that an attacker with domain admin could enumerate freely. Each of these failures was individually correctable, but none of them had been corrected.
Tokenization held. The client confirmed that the card numbers themselves were not reconstructable from what I had retrieved. That was the last line of defense, and it was the one that was actually working.
The remediation conversation covered all of it: restricting third-party management system access to named systems and accounts with documented justification, rotating and vaulting encryption key material separately from the systems it protects, auditing all access paths into the air-gapped segment, and doing a full sweep of the lateral movement surface that let me accumulate so many privileged credentials before I ever touched the database segment.
The database was the objective. But the real finding was the distance between what the client believed their architecture provided and what it actually provided.