# Nmap 7.94SVN scan initiated Mon Apr 7 18:26:14 2025 as: nmap -sS -p- -A --open -T5 -Pn -n -oN ext_sweep_tcp_allports -vvv 10.10.122.166
53/tcp open domain syn-ack ttl 127 Simple DNS Plus
81/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
82/tcp open ssl/http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-04-07 22:30:43Z)
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sweep.vl0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds? syn-ack ttl 127
464/tcp open kpasswd5? syn-ack ttl 127
593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp open ldapssl? syn-ack ttl 127
3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sweep.vl0., Site: Default-First-Site-Name)
3269/tcp open globalcatLDAPssl? syn-ack ttl 127
3389/tcp open ms-wbt-server syn-ack ttl 127 Microsoft Terminal Services
5357/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing
9524/tcp open ssl/unknown syn-ack ttl 127
49664/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49669/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49675/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49683/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
❯ bloodhound-python -c all --zip -u intern -p intern -d sweep.vl -ns 10.10.122.166
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: sweep.vl
INFO: Getting TGT for user
INFO: Connecting to LDAP server: inventory.sweep.vl
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: inventory.sweep.vl
INFO: Found 17 users
INFO: Found 54 groups
INFO: Found 2 gpos
INFO: Found 3 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: inventory.sweep.vl
INFO: Done in 00M 31S
INFO: Compressing output into 20250407184605_bloodhound.zip
Possible users with privilege escalation
svc_inventory_lnx
JGRE808
svc_inventory_win
HTTP
LANSWEEPER v. 11.1.6.0
Lansweeper is an IT Asset Management (ITAM) platform that helps organizations discover, manage, and optimize their technology assets, providing visibility into IT, OT, and IoT assets, and enabling centralized IT inventory and management.
Valid Creeds: intern:intern
Exploitation
Capturing SSH credentials
Discovering SSH credentials stored in lansweeper
Lansweeper can scan more asset details with scanning credentials.
Mapping the SSH credentials to the Scan
The tester configured a Scanning Target and append the Linux credentials.
Setting up a Fake SSH service.
The tester run a fake ssh service to capture the svc_inventory_win plaintext credentials.
The tester utilized the new credentials to log into the application and configured a new set of credentials.
Creating a new package deployment to obtain reverse shell.
The tester accessed the Package deployment section and initiated the creation of a new package. Utilizing , the tester generated a reverse shell, which was then triggered and sent to compromise the server as NT Authority System.
