Illustration of the attack and remediation

In the cybersecurity world, experts are often split into two camps: the Red Team, which attacks, and the Blue Team, which defends. Recently, I got to experience both sides through two intensive hands-on exercises. Here's the technical account of that adventure, from compromising an LDAP directory to a large-scale remediation via Ansible.

Part 1: Infiltration

The flaw: a door left ajar

The attack began with the discovery of a major weakness: the server's configuration database (cn=config) was protected by a default password. Using tools like ldapsearch and the Python ldap3 library, I was able to extract the server's structure and quickly understand how exposed the service was.

LDAP analysis

Privilege escalation

Once inside the configuration, the move was to inject an LDIF file to change the root administrator's password (olcRootPW). This step made it possible to seize control of the service and access the directory's sensitive data.

LDAP privilege escalation

This full takeover let me exfiltrate every employee's credentials and uncover a flag hidden in the backup services. Lesson learned: a misconfigured directory service can compromise an entire network in minutes.

Part 2: the automated response

Large-scale auditing

Rather than connecting to each server individually, I built an Ansible detection playbook. In a matter of seconds, it scanned the whole fleet looking for suspicious users, malicious scripts in /tmp, and SSH configuration flaws allowing root access.

Ansible audit

Remediation: cleaning up in one click

Once the targets were identified, a second correction playbook was deployed. Ansible's power lies in its specialized modules:

  • user to remove intruder accounts.
  • find and file to purge malicious scripts.
  • lineinfile to harden sshd_config and forbid insecure access.
Ansible remediation

This second part showed me that by automating incident response, you're no longer dealing with a single server but an entire fleet. Remediation becomes reproducible, fast, and above all consistent.

Conclusion: why automation is the key

These two exercises reminded me of a harsh reality: the attacker only needs to find one flaw, but the defender has to protect every square inch of their infrastructure.

Thanks to tools like Ansible, the defender takes back the advantage. It's no longer about fixing one server, but managing a whole fleet. Automation lets you apply security patches idempotently and instantly, turning a major crisis into a routine maintenance task.

*NotebookLM Summary