Cicada
Enumeration
nmap -v -A -O -p- -T4 -Pn -sC permx.htb -oN nmapPort 445 - SMB
Connecting to a SMB share using anonymous user we will find 2 interesting shares:
Share DEV unfortunately is not readable, but we see that HR and IPC$ are readable:
so we can try to RID Cycling attack the SMB protocol using "guest" account:
And we will obtain users valid list:
Foothold (michael.wrightson)
We can try to access the readable HR share using "guest" account:
And we will finally obtain a foothold, a valid password for new hire user:
Cicada$M6Corpb*@Lp#nZp!8
Let's see if there are any new employees among those drawn through RID Cycling attack using a Spray Password attack against SMB share with CrackMapExec:
cicada.htb\michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8
Privilege Escalation (david.orelious)
With these pair vaild credentials we can enumerate more infos about domain using LDAP protocol:
cicada.htb\david.orelious:aRt$Lp#7t*VQ!3
Privilege Escalation (emily.oscars)
The DEV share is accessible and readable by david.orelious user. Inside it we will find a Backup_script.ps1 Powershell script containing another pair of credentials:
Trying to connect using Win-RM we will obtain a shell on Domain Controller and get the user flag:
Privilege Escalation (Administrator)
Inside Documents directory there is a Powershell Script:
When we run the whoami /priv command we see that the Emily user has SeBackupPrivileges that we can use to escalate privileges.
This privilege allows the user to read all the files in the system, we will use this to our advantage. We can use this to copy the SAM and SYSTEM file from Windows using the commands:
then send this to our attack device using the Evil-WinRM download command, we transfer the file from the Temp directory on the target machine to our Kali Linux Machine:
and use secretsdump or pypykatz to extract the hive secrets from the SAM and SYSTEM file.
Finally use evil-winrm with Hash parameter of Administrator to login on DC and obtain root flag 🎉
Last updated