search

Cicada (Easy)

Easy difficulty Linux box.....

hashtag
Enumeration

As usual let's start with a simple nmap scan:

Not shown: 989 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-02-14 01:15:03Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CICADA-DC.cicada.htb
| Not valid before: 2024-08-22T20:24:16
|_Not valid after:  2025-08-22T20:24:16
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CICADA-DC.cicada.htb
| Not valid before: 2024-08-22T20:24:16
|_Not valid after:  2025-08-22T20:24:16
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CICADA-DC.cicada.htb
| Not valid before: 2024-08-22T20:24:16
|_Not valid after:  2025-08-22T20:24:16
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CICADA-DC.cicada.htb
| Not valid before: 2024-08-22T20:24:16
|_Not valid after:  2025-08-22T20:24:16
|_ssl-date: TLS randomness does not represent time
Service Info: Host: CICADA-DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required
|_clock-skew: 6h59m59s
| smb2-time:
|   date: 2025-02-14T01:15:47
|_  start_date: N/A

We see a lot of Active Directory related ports that are open (like LDAP and Kerberos) so we know this is a Domain Controller, the domain name being cicada.htb.

Let's check for guest access with nxc.

We see the "guest" account is enabled and we can see what shares are there. Let's start checking the HR one using "smbclient".

Connecting to it and listing files we see only one and we download it:

Reading the file we see there's a default password for new employees:

Let's try another thing with the guest account, which is RID brute forcing to identify users and groups:

Let's filter everything for the "SidTypeUser" and then spray the password we found.

Making a list of users we have:

Let's now start spraying!

hashtag
Password Spraying

Testing with winrm with these credentials, we can't login remotely, let's enumerate for users with their description using nxc.

We see the user David left his password in his description! We still can't login, but we can now read the DEV share, and reading it:

Let's get this script and read it.

And we can finally remote login!

hashtag
Shell as emily

doing "whoami /all", we see our user has the SeBackupPrivilege, we can either backup the disk and read "ntds.dit" or just backup the flag using robocopy! :D.

hashtag
Root

Done! Happy Hacking :) 🧛

PreviousSightless (Easy)NextYummy (Hard)

Last updated