Cicada
Easy Windows Active Directory Box
Reconnaissance
As always we start off by performing a port scan to enumerate services and versions running on the target using Nmap
We can notice we're facing a DC (Domain Controller) Because of the simultaneously open ports like TCP 88 (Kerberos) | TCP 389 (LDAP) | TCP 5985 (WinRM) ... which is common for DCs, we can also see the virtual host which is cicada.htb and CICADA-DC.cicada.htb so let's add them to our /etc/hosts file
We already know that following a good methodology is the most important on a pentest therefore we will need to enumerate every single thing that may contain useful information
so let's start by enumerating the open TCP Pport 53 (DNS) using dig
This time the records didn't contain anything useful so let's move on to enumerate the TCP Port 88 (Kerberos) using the Kerbrute tool to try and enumerate possible users:
We see that the user Guest is available so it will help us with further enumeration using NULL sessions
Now let's enumerate the TCP Port 135 (RPC) using the tool rpcclient with the use of a NULL session
We also didn't extract any information there so let's continue our reconnaissance
Let's try and enumerate TCP Port 445 (SMB) with the use of Netexec (Newer version of CrackMapExec)
The HR (Human Resources?) share seems interesting, so let's check it using smbcient
And we see it contains a file called Notice from HR.txt with this information:
And we finally found a password! — Cicada$M6Corpb*@Lp#nZp!8
After prforming a password spray with Kerbrute we see it doesnt work with any user
RID Brute-Force
As we didn't get any username let's try to enumerate usernames using a RID Brute-Force with netexec
And finally, we found valid usernames, so let's add them into a user.txt file to further attacks
Further Enumeration
Some AD users don’t have Kerberos pre-authentication enabled. That means we can request a TGT for them without a password, and the KDC will send back a hash we can crack offline.
So we already have valid usernames — now we’re checking which ones are AS-REP Roastable
But we see none of them are AS-REP Roastable either
Let's See if we can access through SMB trying the found password with every user using Netexec again
And we see it works for the user michael.wrightson and we found something interesting too, what seems to be the password for the user david.orelious — aRt$Lp#7t*VQ!3
Let's try and enumerate the shares too using both of these credentials we found
We can see david.orelious has access to a new interesting share called DEV so let's enumerate it using smbclient as we did before
And we found a script called Backup_Script.ps1 so let's see what's inside it
And we found the password for emily.oscars — Q!3@Lp#M6b*7t*Vt!!
Logging into the WinRM Service
Using these credentials we can successfully login into the WinRM service using evil-winrm
And we're in!!
Using whoami /priv we find some misconfigurations:
The one we're going to approach is the SeBackupPrivilege
Dumping SAM and System
It lets us read sensitive system files, even ones protected by the OS, so let's create a Temp directory under C:\
We can use this to dump the SAM and SYSTEM hives, which contain password hashes.
Then we can download these files into our attacker system with the Evil-WinRM download function, and finally dump them using impacket-secretsdump
And then we can just do a Pass-The-Hash using Evil-WinRM with the obtained Administrator LM hash
And there's the root flag, overall one of my favourite Active Directory HackTheBox boxes because of how much you need to enumerate and how it tests your recon skills.
Hope this helped you, thank you for reading and see you next time!!
Last updated