Five Minutes and an Empty Port Part 6: A Full Walkthrough, From Empty Port to Persistent Access

Parts 2 through 5 covered each tool family on its own. This part chains them into a single narrative, a hypothetical engagement against a fictional client I’ll call Aldergate Partners, to show how they actually combine rather than sit as a list of isolated product reviews. Nothing here describes a real engagement or a real target. The mechanics it draws on are real where Part 5 tested them directly, the Pi 4 build and the Cloudflare Tunnel call-home path, and documented from vendor material everywhere else, exactly as flagged in each of those parts.

Five minutes at reception

The engagement opens the way most physical assessments do: a visit under a plausible pretext, a few minutes unsupervised near an empty meeting room while waiting to be signed in. A Shark Jack goes into an unused wall port under the meeting room table, armed with a payload that grabs DHCP lease info, CDP/LLDP neighbor data, and a quick subnet sweep. Ten minutes later, meeting concluded, the Shark Jack comes back out in a pocket. No cable ever needed to be visible, no laptop ever needed to be opened in the room.

What that ten minutes buys: the VLAN the port lands on, the DHCP scope and gateway, and usually enough CDP/LLDP output to name the switch model and a handful of neighboring device types. Small information, but it’s the difference between the next step being a guess and being a plan.

The persistent channel

A five-minute drop is reconnaissance. Persistence needs something left behind, and this is where Part 5’s real build earns its place in the narrative rather than staying a standalone lab exercise. A Packet Squirrel or LAN Turtle goes inline behind a VoIP phone or a printer, a spot nobody unplugs to check, running the same autossh-over-a-relay call-home pattern built and proven end to end on a Raspberry Pi 4 in Part 5. The device never accepts an inbound connection, so it doesn’t need a static IP, a port forward, or anything an egress-filtering-only firewall would flag as unusual. It just looks like one more device making an outbound SSH connection, indistinguishable at a glance from a hundred other legitimate ones.

This is also the part of the chain most worth being honest about the limits of. Part 5’s build proved the mechanism works, not that it’s invisible. A wired device sitting behind a phone or printer is still a physical object on the network that someone could eventually notice, unplug, or trip over, which is exactly the gap Part 9 covers when this series turns to defense.

A second, opportunistic vector

Physical access rarely offers only one opening. While the reception visit is underway, an O.MG Cable sitting in a charging bowl near the breakroom, or a Bash Bunny left plugged into a briefly unattended desk, works an entirely separate angle: the USB HID trust model covered in Part 3, where the operating system trusts any keyboard unconditionally regardless of what the network layer thinks. Neither vector depends on the other succeeding. If the wired dropbox gets found and pulled the next morning, a payload that already ran from a USB drop days earlier has nothing to do with it.

If wireless is in scope

Where the engagement’s rules of engagement include the wireless estate, the car park outside becomes a third vantage point. A Flipper Zero with the ESP32 Marauder, or a WiFi Pineapple left running from a parked car, profiles the guest SSID and any client devices in range, with the honest caveat from Part 4 already baked in: a modern client isn’t going to walk up and hand over a session through Karma the way it might have a decade ago. What still works regardless of MAC randomization is deauthentication, a real, currently-associated client can still be knocked off its network on demand, useful for testing how a target’s wireless IDS actually responds to that specific pattern rather than a passive survey.

What the whole chain actually costs

Add it up: a Shark Jack for the initial recon, a Packet Squirrel or LAN Turtle for persistence, an O.MG Cable for the parallel USB vector, optionally a Flipper Zero and ESP32 Marauder for the wireless angle. Commercial pricing across that set lands somewhere in the low thousands at the high end, and the equivalent coverage using a Raspberry Pi and a handful of ESP32 boards, per Parts 2 through 5’s cost comparisons, comes in under two hundred pounds. Dwell time for the wired channel is indefinite until someone physically finds and removes the hardware, which, per the defensive chapters starting next, is exactly the assumption worth removing.

Part 7 starts the defensive half of this series with the layer that would have stopped the persistent dropbox outright: port security and the rest of the Layer 2 hygiene most networks already have the hardware to do and simply haven’t turned on.