Better than tell you - just watch the video:
List as Bart recounts a real-world penetration test conducted for a large asset management firm participating in an SEC governance program. While waiting in the lobby before the scheduled test, a penetration tester connected to the firm’s guest Wi-Fi using publicly displayed credentials. A basic network scan revealed only the tester’s laptop and an outdated, seven-year-old multifunction printer.
The tester exploited a buffer overflow vulnerability on the printer, gaining command-line access within seconds. Cached administrator credentials from a prior login were discovered on the device. Although the printer’s Wi-Fi interface was connected to the guest network, its physical Ethernet port was connected to the firm’s production network, effectively creating a bridge between the two environments.
Using the compromised printer and recovered admin credentials, the tester was able to move laterally into the production network and ultimately access the firm’s production database. The entire compromise—from sitting in the lobby to capturing the production database “flag”—took approximately eight minutes, before the meeting even began.
The story highlights how overlooked devices like printers, poor network segmentation, and credential hygiene failures can lead to rapid, full-scale compromise—even during routine security exercises.