Cicada

Cicada

Challenge URL: https://app.hackthebox.com/machines/Cicada

Cicada is rated easy on difficulty wise in HackTheBox Platform. Let’s started with nmap scan

nmap -sC -sV -oA Scan 10.10.11.35

· -sC: means run default script

· -sV: means detect service version

· -oA: output all format and save in file Scan

nmap scan

Nmap scan shows our target is window machine and active directory services are running on it.

Let’s add cicada.htb to /etc/hosts file

Let’s conduct one more nmap scan to check if something new service or port we found

nmap scan

Port 64494 is unknown. Let’s check what service are running on it.

nmap scan

Let’s perform smb enumeration

smb enumeration

There are number of other ways to perform smb enumeration like we can use smbmap and crackmapexec also.

smbmap

As smbmap enumeration shows nothing and smbclient does not show which shares are accessible by anonymous users, so let’s try random way to check if shares one by one

smbclient

Let’s check what is in txt file

Notice from HR.txt

We got password there but there are no users. Let’s bruteforce users

Let’s save these names in file named as user.txt

nxc scan

We find valid user for password.

michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8

Let’s check if we have further users with above credentials

We find more creds, Let’s save them and use them further.

smb shares

I used new creds to check any new smb shared assign there and we find DEV smb share interesting. We have read permission on it, Let’s read it.

smbclient

We find Backup script. Let’s read it.

We find new creds, let’s save them and use these creds

Let’s check our new user what new shares it access.

Let’s check emily.oscars have winrm access or not.

Our user has winrm access. Let’s login to winrm

winrm

Privilege Escalation:

Privilege escalation is the process of gaining higher level of access or permission on a system than originally granted, often to exploit vulnerabilities and increase control over the system.

There is SeBackupPrivilege enabled. Let’s exploit it.

I am using pypkatz to extract hashes, we can use other tools like impacket-secretsdump also.

We are Administrator now. That’s it from my side. I hope that walkthrough is useful for you.

Thank you for reading!