GitHub
Page cover

Week 9. Cicada

TL;DR

This is a Windows Server 2022 machine sharing an SMB resource allowing guest sessions. There we find a password, and subsequently a list of usernames is obtained via RID bruteforce. Doing an LDAP password spray we find the correct username/password association and with them we dump more Active Directory information, including a secrets for another password-protected SMB share, where we finally find credentials for a low-priv WinRM session. Regarding escalation, we abuse SeBackupPrivilege, since the user is member of the Backup Operators group. We dump SAM and SYSTEM secrets and retrieve administrator's hash with Impacket.

KEYWORDS

SMB null sessions, RID bruteforce, LDAP enumeration, password spraying, ldapdomaindump, SeBackupPrivilege, SAM hive, SYSTEM hive, Impacket, reg.py, secretsdump.py.

REFERENCES

https://book.hacktricks.xyz/network-services-pentesting/pentesting-ldap

https://github.com/dirkjanm/ldapdomaindump

https://www.thehacker.recipes/ad/movement/credentials/dumping/sam-and-lsa-secrets

ENUMERATION

Port scan.

> nmap $target -p- --min-rate=5000 -Pn --open --reason
Starting Nmap 7.93 ( https://nmap.org ) at 2024-10-18 11:17 EDT
Nmap scan report for cicada.htb (10.10.11.35)
Host is up, received user-set (0.045s latency).
Not shown: 65523 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE          REASON
53/tcp    open  domain           syn-ack
88/tcp    open  kerberos-sec     syn-ack
135/tcp   open  msrpc            syn-ack
139/tcp   open  netbios-ssn      syn-ack
445/tcp   open  microsoft-ds     syn-ack
464/tcp   open  kpasswd5         syn-ack
593/tcp   open  http-rpc-epmap   syn-ack
636/tcp   open  ldapssl          syn-ack
3268/tcp  open  globalcatLDAP    syn-ack
3269/tcp  open  globalcatLDAPssl syn-ack
5985/tcp  open  wsman            syn-ack
49492/tcp open  unknown          syn-ack
 
Nmap done: 1 IP address (1 host up) scanned in 26.44 seconds

Looks like a domain controller, enumerate the open ports.

Enumerate the SMB share for null sessions.

We have guest access to HR resource, connect to the share and enumerate its contents.

Read the text note.

USER

We have disclosed a password, now we need a username to use it. Since there is an SMB share that accepts null sessions, we can try an RID bruteforce (see Week 4. Manager and Week 4. SolarLab).

We a retrieved a list of usernames so let's spray the password.

Didn't work for the SMB protocol, try with LDAP.

We found credentials work in LDAP for user michael.wrightson

Verify it with ldapsearch

We can leverage this to dump Active Directory information as pointed here: https://book.hacktricks.xyz/network-services-pentesting/pentesting-ldap

Download the tool here: https://github.com/dirkjanm/ldapdomaindump, and dump the domain information.

In the domain_users.html file we find credentials for user david.orelious

It seems they work for SMB.

So connect to the \\cicada.htb\dev share as david.orelious and download the Backup_script.ps1 file. Inside it there are credentials for user emily.oscars

Use them to open a WinRM shell and collect the user flag.

SYSTEM

Start from the low-priv shell as emily.oscars and enumerate the system and the user.

She belongs to the Backups Operators group, let's check her permissions.

She has the SeBackupPrivilege which basically allows her to backup the entire file system, including the SAM and SYSTEM registry hives.

We can make a backup of the local file locally with reg save or remotely with Impacket as explained here:https://www.thehacker.recipes/ad/movement/credentials/dumping/sam-and-lsa-secrets

First run a local SMB share.

Then dump the SAM, SYSTEM and SECURITY hives with Impacket's reg.py

Once you have exfiltrated the secrets, dump them with mimkatz, pypykatz or Impacket's secretsdump.py

And with the hashes you can just login in the machine as administrator.

You are root.

PreviousWeek 8. TricksterNextWeek 11. Instant

Last updated