HackMDCicada Walkthrough (HTB)
As-Salaam-Alaikum frens, In the name of Allah, the Most Merciful and Most Beneficent, I’d like to share an easy walkthrough for a recent Windows challenge I tackled on Hack The Box (HTB).
Enumeration
The first step for any machine is enumeration. We’ll kick things off with a straightforward Nmap scan to identify open ports on the target. From there, we can focus on the low-hanging fruit and start our enumeration process.
We found some interesting ports, including Kerberos, SMB, and LDAP. However, the most intriguing ones to start with are ports 139 and 445. First, let’s add the domain name to our hosts file using the simple command below:
With the open SMB port, we can try to enumerate it to check for anonymous login access or using random user accounts. We can use netexec for this purpose.
Since it accepts random usernames without a password, similar to an anonymous login, we can use the same netexec command to enumerate the shares available on the system.
Great! We now have read access to the HR and IPC$ shares. Let’s use smbclient to access them.
After accessing the HR share with smbclient, we found a notice file. Using the mget command, we downloaded it to our local machine. Let’s check out what it contains!
Upon reading the content of the file, we noticed it discusses changing a password and mentions a default password. However, we don’t know which user this password applies to. This is where netexec comes into play again; we can use it with the --rid-brute option to retrieve the users on the system. If we prefer not to use netexec, there’s another method using impacket-lookupsid, which I’ll demonstrate next.
OR
When we run impacket-lookupsid, it might prompt us for a password, but we can just hit enter to skip that. This will display the users on the system. We’re particularly interested in the entries labeled as SidTypeUser, as those are the ones we can work with. Let’s jot down the users we find and try a password spray using the password we discovered earlier.
It looks like the user michael.wrightson is associated with the password we found. Let’s go ahead and use that password to check which shares we have read or write access to.
From the output of our shares, we found some with read access, but unfortunately, there wasn’t much of value in them. However, we noticed the DEV share, which we don’t have access to. So, what’s next? If we remember our earlier Nmap scan, we saw that LDAP is open. Let’s try using user michael.wrightson and it's password we have to see if we can authenticate with LDAP.
Boom! We can authenticate with LDAP. One of the great things about LDAP is that it allows us to retrieve both users and passwords. Since we already have the user list, we’re specifically looking for passwords this time. Still, I’ll demonstrate how to extract users using LDAP, just for clarity.
For extracting users only simply use below command:
Using this command, we can see that it only displays the usernames. To look for passwords, we can use grep pass at the end, as shown below.
Looks like we’ve found another password! Let’s go ahead and perform a password spray to identify its owner.
Now that we have the password owner as david.orelious, let’s check if we have access to the DEV shares now.
Finally, we’ve gained read access to the DEV shares. Let’s dive in and see what we can discover.
We’re in, and we’ve spotted a backup PowerShell file. We used the get command to download it to our local Kali machine. Now, let’s check its contents to see what it does.
Awesome! With the new username and password, it looks like we might be in for a windfall of credentials. Let’s check if the WinRM port is open on the target.
Foothold
To check if the WinRM port is open, a simple Nmap scan will do the trick, just specify the port.
Now that we have the new credentials, let’s see if we can log in with them. We can use netexec to confirm our access.
Since we received a pwned response from netexec, we can use that to gain access to the target.
Now that we’re in, all that’s left is to locate and view the contents of the user.txt file in the user’s desktop directory.
Privilege Escalation
To access the administrator directory, we need to elevate our privileges from the current user to admin rights. The first step is to run whoami /priv to check our current privileges.
The SeBackupPrivilege allows user to read all files on the system, and we’ll definitely use this to our advantage. First, we'll navigate to the C:\ directory and create a Temp directory. If we want to be more discreet, we can also go to a directory where we have read and write privileges.
Once in the Temp directory, we’ll use our SeBackupPrivilege to read the SAM file and save a copy of it. We’ll do the same for the SYSTEM file, ensuring we have variants of both.
Now, let's change into the Temp directory we created. We should be able to see the SAM and SYSTEM files that we just saved there and download them to our localhost.
Now, we can extract the hive secrets from the SAM and SYSTEM files using pypykatz, a Python variant of Mimikatz. We’ll run its registry function and use the --sam parameter to provide the paths to the SAM and SYSTEM files. Once we execute the command we should be able to retrieve the NTLM hashes of the administrator.
With the Administrator hash in hand, we can access the Administrator account using Evil-WinRM.
That's all for the day and Thanks for reading! If you have any questions or issues with my write-up, feel free to reach out to me on Twitter or LinkedIn.
