text: what's going on YouTube this is IPC M cicada from hack the box which is a relatively straightforward Windows box that doesn't have a web server it starts off with a numerating files on an open share to discover there's a file that contains the password new accounts are created with however without a user list we can't really use that password but we can do our rid brute force in order to build our own user list and then spray that password against it and that gives us credentials to the Box we can't log in just yet but we can use these credentials to dump more user information about the domain and discover one user has their password set in the description of their account and this user has access to a different file share that you download the script it's a backup script written in Powershell

title: HackTheBox - Cicada


text: has an embedded credential you get that and that provides you winrm access to the box and this user is a member of the backup operator since the power shell script was a backup script so you have the SE backup token and that allows you to either backup the registry or active directory database both of which will lead you to administrative credentials for this box so with that being said let's jump in as always we're going to start with an N map so- SC for default scripts SV enumerate versions dvv for double ver boost this gives us things like the TTL OA output off formats put the end map directory and call it cicada then the IP address of 1010 11.35 this can take some time to run so I've already ran it looking at the results we have 11 ports open the first one is DNS on Port 53 and the first

title: HackTheBox - Cicada


text: thing that sticks out to me is the default Banner simple DNS plus of a Windows domain controller whenever I see that I look at the other things we see ceros active directory ldap Etc so we know we're dealing with a domain controller ldap tells us the domain which is cicada hdb but also there is a certificate that leaks the fully qualified domain name which has the host name as well the cicada DDC so let's go ahead and add this to a host file so pseudo V ety host and then we can add 10 10 1135 and then I'm going to put all the variations so we have the fqdn first then I'll just do the machine name and then we'll just do the domain name you don't have to do this but it's always just good practice on htb machines to set up the DNS right so let's look through what we have we have cobos RPC RPC ldap let's skip through the

title: HackTheBox - Cicada


text: certificate SMB I think cobros um Windows RPC over HTTP ldap so we're not really getting any web services so the only place we can really start is looking at ldap or SMB SMB supports more like guest authentications so that's normally where I start in this case so I'm going to do um net exact S&B 1010 1135 and then let's just list all the shares and we get a error that um user session is deleted I'm going to just specify a account that does not exist I always like just using a period and this is going to make it fall back to guest authentication and we see we authenticate and can list the shares at least it's taking a little bit there we go and we have a couple shares uh this is a default share default share uh Dev and HR are the two unique shares and we have access to read HR so let's do an

title: HackTheBox - Cicada


text: SMB client - capital u and then specify a period just so we fall back to that guest authentication then 1010 11.35 SL HR put any password in and now we can do a dir and we get this notice from hr.

title: HackTheBox - Cicada


text: text now I'm going to do a get to download it and then we can do notice from hr. txt and with single quotes it actually um errors out for this you need to use double quotes Additionally you can use the multi- feature which supports wild card so we could just do like the beginning of it and then a star and then that will also download it right so let's go take a look at what this notices so if we C it we see welcome to C equp we're throw to have you part of the team you default password is this so we have the default password but we don't have a list of users but we can authenticate via SMB as guest which enables us to do the rid brute and this is going to um Brute Force the remote identifiers for all the users and it's a good way just to get a user listing when you have very minimal privileges if you're confused how this

title: HackTheBox - Cicada


text: works it uses the um I think it's a lookup name in um RPC we can do RPC client and we'll just do this manually really quick um we'll do - period and then 10 10 1135 and we get access denied in order for RPC client I think we have to specify the domain so cicada htb and then a slash because we want the password for and then just to show the domain I don't know exactly why that's the case but that's how you do it with RPC client right if we do help we can list all the like functions of this if we just do query user we don't have privilege to do this this will give us a lot of information about uh various users but since we're a guest we just get access denied we can do lookup name so I'm going to do look up names administrator and then what that gives us is the username the Sid and then the

title: HackTheBox - Cicada


text: account type right so 500 this is the default Sid for an administrator and we can also do look up Sid or is it SIDS I think it's SIDS and then give it the FID and there we go we have administrator here and then rid brute is just going to change that last digit and go through them all and whenever it's not unknown it displays it right so um I want to say it was like 160 something for the last user let's see right here we have it up um 161 so let's do 161 there and we see that is Emily Oscar so that's how the rid brute Works um this is just uh basic Sid stuff this is the unique domain identifier and then this is the object identifier I probably got those names wrong but hopefully um that starts to make sense I'm guessing eight is when the account doesn't exist um two will probably be a group uh let's

title: HackTheBox - Cicada


text: see I think 520 is a default there we go um we see Group Policy Creator earners is set for two and if we look up here where is that um 20 oh it didn't even display it so I don't know exactly what Sid type 2 is but you get the point of what we're doing with the rid brute force in N exac if you want to go above the default which I think is only 2,000 you can just specify a number here so we could specify 5,000 and that would Brute Force um R ID 500 to 5,000 right but let's just create a list of all the users because we have a default password for the domain and we want to do a password spray so I'm going to grab all the output and I'll do V users. text we will paste this and then I'm going to do a um I think it's G exclamation point so G is going to have say um Match multiple exclamation point is is not so we don't

title: HackTheBox - Cicada


text: want to match any let's do type user and then do/ D so any line that doesn't have a type user in it we're going to delete and there we go so now let's just get it so we only have the username so we can do percent s and Then star up to the domain and delete that and then let's delete everything after a space like that there we go and then these three accounts are default the DC is the machine account and ends in a dollar kbgt is the kerur account for signing keys and guest is well the guest account so we have a list of three users so what I want to do here is go back to that notice we're going to grab the password and then I'm going to do nxc SMB 10101 35- users. text- p and we're going to put this password in and now this is going to spray the password against all the accounts and we discover that one is

title: HackTheBox - Cicada


text: valid and that is going to be Michael riton so let's go ahead and switch to Michael Ritson and then we can list all the shares because there was that Dev share that we did not have access to maybe Michael dson has access to it and let's wait for it to authenticate and we don't we only have access to HR we can do the D- users and this is going to enumerate all the users in active directory and it will also um display like last password set time bad password descriptions and things like that so we have David orelus has the description of his password here so let's go ahead and switch to that user so we can do David orelus and then we put this password and let's look at shares and we could have also ran Blood Hound soon as we got a user credential to log into the domain and I'm guessing David Aurelius is going to be a member of like

title: HackTheBox - Cicada


text: the dev group that gives them access to the share there's probably something there that um indicates that right but now we have access to Dev so let's go ahead and use SMB client again we do- I'm going to specify the domain cada then the user and then we'll do percent and that's not the password let's get rid of that and then just make sure we copy the password here if we don't do percent it'll just prompt us for the password on standard in it doesn't really matter how you do it but let's do 10 10 11 35 and then the dev share okay we can do Dr and there is a script called backup script so let's go ahead and get this and then we can cat the backup script to see exactly what it does it's going to take the source directory of cant SMB the destination directory of Deco and backup it's going to give the username of Emily Oscars create her password to a secure

title: HackTheBox - Cicada


text: string and then um zip up SMB and copy it to the D drive so let's see if this password still works for Emily Oscars so let's do SMB client and then what was it Emily Oscars I think it was plural or had an s on the end and I don't know why I'm doing ANB client we should use net exec so let's do Emily Oscars and then the password of whatever she had right and then we can just do d d shares it's just going to make sure we authenticate and list anything out and most likely we won't see anything because we've already accessed all the non deault chaires however um only enough um it doesn't say pwn so she's not a local administrator but she has read right over the C drive which that is unique um we can look at the C drive and then we could just start looking at everything here uh we could probably get

title: HackTheBox - Cicada


text: the um user flag probably in the desktop of Emily I'm guessing right yep there's user. text uh we could also try other authentication methods so and that exact there's like Microsoft SQL um winner RM SMB all those things we didn't see a Microsoft SQL Port um so we try winrm and we get the pwn so um the user Emily Oscar does have winrm access so we can do Evo wi rm- I 1010 1135 U Emily Oscars DP put in the password there it is and this should give us a shell on the box and then the first thing I always do is who am i/ all just to see what groups we're a member of right and the first one is backup operators that kind of Mak sense because she was the user running the backup script we also have Remote Management users this is why we have winrm and then a bunch of defaults but we have the SE backup and

title: HackTheBox - Cicada


text: SE restore privilege and these two privileges allow us to um backup files and the quickest way is just do the Sam and system database I want to say so if we do reg save Sam I want to say that is um maybe it's not let's see let's open up Firefox real quick and look at exactly how to abuse this privilege um I know we can backup to let's see SE backup let's just Google exploit privileges hack tricks and this is going a little bit slow um Windows there we go abusing tokens there we go SC backup let's see is there a registry command see SE backup token um reg Sam does this give us anything try this user come on this is not it see can I just do oh reg save SL Mark let's see oh reg save hklm this is it reg save hklm Sam like this do we do backs slash there we go and then let's do system like this there we

title: HackTheBox - Cicada


text: go and we can download both these files so we'll download the Sam and then we'll download system and having these files this is going to be where Windows stores the local accounts and this won't always work on a domain controller because once you promote a to be a domain controller it no longer uses the um Sam registry Hive to store credentials it uses the ntds.dit file that's a little bit harder to back up we'll do that right after this um but before you promote it to a domain it'll have the old password there so if they don't really change the password of administrator after they make it a domain controller then you can just get it um quickly this way right and this system file is going to take a little while to copy so I'm going to Google SE backup token I want to say it's robocopy is the U program we

title: HackTheBox - Cicada


text: abuse um let's see infos SEC writeups maybe this I know it's like robocopy SLB and there's also going to be um an annoying dis Shadow command we have to run I say it's annoying because it really cares about um the encoding of the file we did this in registry too um so if you want to see it done another way or see it done with me struggling a bit more I'd go to registry to but we're going to copy the script and we're still waiting for that to finish so I'm going to do V I'll call this dis shadow. text and it's just a list of commands so we're just setting the reverse mode on setting metadata and all this does is essentially creates a Shadow Drive at Eon that Maps C and that's going to allow us to access um protected files so right now I'm still waiting on that system command to finish uh we I guess we can do Secrets dump uh local

title: HackTheBox - Cicada


text: Sam Sam system system and whenever we get the system Hive this command will um work hopefully so I'm going to pause the video and just wait for this copy to finish okay the copy has finished I'm going to run Secrets dump and we can see we got the administrator hash so let's go back to net exec so we can test this out I'll do nxc SMB 1010 1135 then- administrator Capital H so I can use the hash and let's see if it authenticates us waiting on it and there we go ped so we should be able to just do like PS exac dashes specify the hash and then administrator at 101 1135 uh is it PS exact. there we go requesting shares uploading and it's starting the service and there we go so let's go ahead and back up the ntds.dit directory right so let's see uh what we want to do is upload the file we had just created so I'm going to

title: HackTheBox - Cicada


text: do it um first without converting the file so you can see the error that happens so I'm just going to do upload dis shadow. text and that's going to upload the file I had just created and let's go and run the next command so it's talking about what each of those things does and here we go dis Shadow and then the file we call it dis shadow. txt and we see set veros and then it just kind of um crashes out you can see it's 240 bytes and that's just going to be the encoding the file is I'm going to do um Unix to Doss on the file normally people run Doss to Unix but there's also one in the reverse to convert it and before we do that let's just do xxd dis Shadow you can see how it's encoded there um let's do Unix to Doss dis shadow xxd and let's see what it do exactly I believe it changed all the line breaks which were just 0 a to 0 d0

title: HackTheBox - Cicada


text: a that's back SLR back/ N I believe so that's all that changed it really cares about the line breaks so let's upload the file again and we'll see it's now 252 byes instead of 240 we'll run this command and it starts working it doesn't know uh stop at the set verse o it just runs through them all because it can identify all the line breaks and then the next command we'll do is a robo copy and by default the ntds is in the ntds directory of Windows and again we set up the shadow copy of C to be at the e Drive so that's why we're doing it at of e not C so if we do the robo copy and now do a DI we see ntds.dit is here so we can just do download ntds.dit and then this is also going to take some time to download because you know how long the system took and TDs dodit is around the same size so I'm going to

title: HackTheBox - Cicada


text: pause the video and then we will dump the active directory database okay the ntds.dit has been downloaded so we should have it right here let's see there it is so I'm going to go run my secrets dump command again we no longer need Sam but we do need the system because that contains I want to say it's called the boot key that encrypts things and it's just a key that encrypts the ntds um and then I think it's just ntds as the argument right there we go and it's going to dump everything so we can see administrators um hashes right here and is that the same as what we got before hold on a second exit administrator 2B 2B that is the same hash so um let's try something real quick so what I'm going to do is well evil winm as administrator I think we do DH right does that work I guess we can use PS exac let's do PS exac

title: HackTheBox - Cicada


text: again did I not have my history BS exact.

title: HackTheBox - Cicada


text: hashes then administrator at 101 1135 I'm going to change the password and then I want to download the registry file again the same so let's do um net user administrator and we'll just change it to password one we'll exit out because I want to see if the Sam Actually does change it I was kind of just um making things up as I go when I said that before so let's just see let's go back to evil 1rm there's Emily log in do a I'm going to delete Sam then we'll do reg save hklm Sam Sam and then let's delete Sam here download Sam and rerun this command and we see the administrator hash is still this to be so now if I went to net exec again nxc SMB 10 10 1135 administrator and then specify that hash it's going to fail right and that's because the did what I thought I change that password net user I bet there's a cleanup script reverting the password back there's got

title: HackTheBox - Cicada


text: to be right that is bizarre um let's see PS exact. piy administrator it's a percent at 10 10 1135 so we can't access it let's rerun this command real quick net user administrator password one I don't know what's happening here change me change me one okay that password now worked let's try this again delete Sam drag save hklm Sam like this change me one that's still working awesome let's delete Sam download Sam okay we still have that hash and there we go it's invalid I'm not exactly sure what happened there I think probably like every 5 minutes the passwords May revert back to the account in case someone changed it doesn't break the box but the um local account in the Sam does not stay updated as it does on ntds.dit once you change over to the main controller so that's going to be the video hope you guys en actually before we go um there's one thing I see

title: HackTheBox - Cicada


text: a lot of people do that I always have trouble with so I figure I will show it real quick and if we go back to Emily Oscar we're going to go where we back up the registry so so there is a impacket script R.P and I forget what box I did this on that I had a lot of trouble it may have been Red stre 2 as well but let's just set it so it logs in um is it a colon maybe that's why I was doing wrong maybe it's colon not perc on impacket I think that's it uh let's do 10 10 11 35 and I'll put the password in quotes like this okay so in I have the whole user as quote that is wrong hold on let's just make sure her password is correct I don't know why I got this Q exit I guess I copied too much okay I think the flag is backup and then we can specify a share so let's do 10 10 11 uh 14 8 share I'm going to make a directory

title: HackTheBox - Cicada


text: SMB we can go in SMB pseudo impacket SMB server PWD share I think it shared the name and then that so we can run and it's going to hopefully start backing things up SMB client DL I script the flags I don't think I did oh we need smb2 support that's probably it let's see if this works there we go now it's starting to save the impet SMB server is painfully slow and it also will is prone to timeouts so I think when it's going to start copying this system. saave it's likely going to time out and then um crash so I'm just going to see if that happens here if it does then you'll get the idea and I wish I ran time on that command um let's see let's cancel out of this that's fine let's let's delete these files start this back up and then I'm going to do time so we can see how long this actually takes to

title: HackTheBox - Cicada


text: copy because I know a lot of people would use this and uh oh I wonder if it's failing because okay there we go now it's running so I'm going to pause the video and we're going to see um how long this actually takes before it crashes or if it even um can save every file so okay the command has errored we can see after about 5 minutes we see the couldn't save the net bios connection with the remote host timed out and it doesn't save the entire system. saave we look at the size let's see how bit much saved um maybe it did 18 megabytes let's see with this size huh maybe let's try Secrets stump. local Sam and then system looks like it did so you could have also used R.P I just have uh really bad luck with this um I think we just got lucky I don't think these are the same exact uh files let's see md5 sum on

title: HackTheBox - Cicada


text: it let's do up one yeah they're definitely not the same file it just copied enough data where we could actually run our impacket Command I've I've bet if I ran it like five times like two times it wouldn't copy whatever it needs out of that system Hive but that's another way you could do it I remember when I initially had this problem I tried moving away from like the impacket SMB server just using the native Linux SMB server I still had a lot of issues with that copy so that's why um when doing the registry backup I always like copying it to the dis and if there's a web service copying the uh backup file to that web service directory and then just download with WG or if not if I have like winrm just doing a download command like you saw in this video so with that being said um that's going to be it so take care and I

title: HackTheBox - Cicada


text: will see you all next time

title: HackTheBox - Cicada