Recon to Shell Access: Nokia Hall of Fame
Hey Hackers, I am Parth Narula. A penetration tester, bug hunter, red teamer and overall a security researcher. I live for those moments where a bit of out-of-the-box thinking cracks open a critical vulnerability.
This time, it all started with a simple Google Dork. I was hunting on a private program and decided to look for exposed Apache Guacamole instances. A few search queries later, I found a live Guacamole login panel sitting on a Nokia subdomain https://sub.sub.nokia.com:port/guacamole
The page showed the classic Apache Guacamole login screen. A clean interface with just a username and password field. Nothing fancy, nothing that screamed vulnerable at first glance.
But here is the thing about default credentials. They are still everywhere. I decided to try the most obvious combination for Guacamole deployments.
Username: guacadmin. Password: guacadmin
I clicked Login.
And just like that, I was in. The dashboard loaded and I was sitting inside the admin panel as guacadmin. No MFA, no rate limiting, no custom credentials. Just plain default access on a production instance.
The first thing that caught my eye was the connections panel. Two folders were staring back at me: NonProd and PROD. I expanded them.
Inside, I found a full list of internal servers. SSH connections, RDP connections, backend systems, frontend systems, jumphosts. The entire infrastructure map was laid out in front of me. This was not just an admin panel. This was a gateway into the internal network.
I navigated to the Settings section and clicked on History.
The history tab was loaded with past connection records. Real usernames, real session durations, internal IP addresses, and timestamps. I could see who connected to what and when.
Then I checked the Users tab.
The user list was massive. Dozens of accounts, many with @nokia.com email addresses. I could see the guacadmin account I was using, plus regular users, plus what looked like service accounts. All of them managed from this single panel.
Next, I looked at Groups.
Three groups stood out. One for Dev, one for non_prod, and one for infra_access. The naming alone told me everything about how the environment was structured. I clicked into the group settings and saw the member users and their assigned connections.
The permissions were granular. Checkboxes for every connection. Read access, update access, delete access. I had full control over who could access what. But more importantly, I had access to everything myself.
I went back to the connections list and clicked on one of the PROD jumphost.
A terminal opened directly in the browser. I was logged into a production server. I ran a quick ls command and saw the filesystem.
I login into Ubuntu SSH.
I navigated to /etc and ran cat passwd. The full passwd file of a production jumphost dumped right into my browser. Root accounts, service accounts, user accounts. Everything was exposed.
That was the interesting part. This was not just an admin panel takeover. This was full remote shell access to internal production infrastructure, all because of a single default credential pair that nobody bothered to change.
The root problem here is simple. Organizations deploy tools like Apache Guacamole to make remote access easier, but they forget to harden the front door. Default credentials should be changed during deployment. Exposing an admin panel to the internet without even basic authentication hardening is an open invitation.
That’s how I got listed in Nokia Hall of Fame :)
Lesson Learned
- Google, Github & Shodan Dorking is still one of the most underrated recon techniques. A single query can expose admin panels that nobody bothered to hide.
- Always test default credentials. guacadmin/guacadmin, admin/admin, root/root, these still work in 2026. Do not skip the obvious stuff.
- When you land on a remote access gateway, explore every tab. Users, groups, history, connections as each one adds weight to your report and shows the full blast radius.
- Port scanning can be also beneficial as the this panel was exposed on specific port.
I hope you learn something new. Follow for more amazing articles and give claps if you like this one :)
Need expert pentesting services?
visit https://scriptjacker.in or let’s collaborate on your next project! 🤝
Want to learn from my experiences? Check out my articles on https://blogs.scriptjacker.in
