Cicada — HTB Writeup | The Hack Sparrow

Executive summary — Cicada is an Easy Active Directory box that doesn't rely on an exploit but on a chain of administrative bad practices. An anonymously accessible SMB HR share leaks a corporate default password; with RID brute we identify a valid account (michael.wrightson) to test it against and, once authenticated to LDAP, discover that david.orelious stores their own password in the description field of their user object. david has access to the DEV share, where a backup script (Backup_script.ps1) contains cleartext credentials for emily.oscars. Emily logs in over WinRM and has SeBackupPrivilege: we use it to dump the SAM and SYSTEM hives, extract Administrator's NTLM hash, and close out the box with Pass-the-Hash. Path: HR → LDAP → david → DEV → emily → SeBackup → Administrator.

Platform	Hack The Box
Operating system	Windows
Difficulty	Easy
Status	Retired
Target IP	`10.129.5.230`

Attack map

[Anonymous SMB] HR share -> "Notice from HR.txt" -> default password
   |  RID brute (null session) -> valid user: michael.wrightson
   v
[Authenticated LDAP]  description attribute -> david.orelious password
   |  DEV share -> Backup_script.ps1 with hardcoded credentials
   v
[emily.oscars]  smbmap: C$ (READ/WRITE) -> WinRM (user.txt)
   |  whoami /priv -> SeBackupPrivilege
   v
[SAM+SYSTEM]  reg save -> secretsdump -> Administrator NTLM hash
   |  Pass-the-Hash (impacket-psexec)
   v
[SYSTEM]  root.txt

1. Reconnaissance

The scan itself reveals the Domain Controller's names (CICADA-DC.cicada.htb). Many AD tools (LDAP, Kerberos, SMB) fail or misbehave if they can't resolve the domain and the DC's FQDN, so the first step is mapping them by hand:

echo "10.129.5.230 cicada.htb CICADA-DC.cicada.htb" | sudo tee -a /etc/hosts

With name resolution in place, we run a full port scan:

sudo nmap -Pn -sC -sV -p- --min-rate 10000 10.129.5.230 -oA nmap-cicada

Why these flags:

-Pn → skip host discovery ping (useful when ICMP is filtered, common on HTB).
-sC → run the default NSE scripts (banners, quick service fingerprinting).
-sV → detect each service's version.
-p- → scan all 65535 TCP ports, not just the top 1000.
--min-rate 10000 → speeds up the packet send rate.
-oA nmap-cicada → saves the output in several formats for later reference.

53/tcp   open  domain    (DNS)
88/tcp   open  kerberos-sec
389/tcp  open  ldap
445/tcp  open  microsoft-ds  (SMB)
636/tcp  open  ldapssl
3268/tcp open  globalcatldap
3269/tcp open  globalcatldapssl
5985/tcp open  wsman  (WinRM)

Analysis: DNS + Kerberos + LDAP/Global Catalog + SMB + WinRM on the same host is the classic fingerprint of an Active Directory Domain Controller. It sets the roadmap: SMB to look for leaked shares, LDAP to enumerate the directory, and WinRM as the final remote-access target.

Resumen ejecutivo — Cicada es un Easy de Active Directory que no depende de un exploit, sino de una cadena de malas practicas de administracion. Un share SMB HR accesible de forma anonima filtra una contraseña por defecto corporativa; con RID brute identificamos una cuenta valida (michael.wrightson) para probarla y, ya autenticados en LDAP, descubrimos que david.orelious guarda su propia contraseña en el campo description de su usuario. david tiene acceso al share DEV, donde un script de backup (Backup_script.ps1) contiene credenciales en claro de emily.oscars. Emily entra por WinRM y tiene SeBackupPrivilege: con el volcamos las colmenas SAM y SYSTEM, extraemos el hash NTLM de Administrator y cerramos la maquina con Pass-the-Hash. Recorrido HR → LDAP → david → DEV → emily → SeBackup → Administrator.

Plataforma	Hack The Box
Sistema operativo	Windows
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.5.230`

Mapa del ataque

[SMB anonimo] share HR -> "Notice from HR.txt" -> password por defecto
   |  RID brute (sesion nula) -> usuario valido: michael.wrightson
   v
[LDAP autenticado]  atributo description -> password de david.orelious
   |  share DEV -> Backup_script.ps1 con credenciales hardcodeadas
   v
[emily.oscars]  smbmap: C$ (READ/WRITE) -> WinRM (user.txt)
   |  whoami /priv -> SeBackupPrivilege
   v
[SAM+SYSTEM]  reg save -> secretsdump -> hash NTLM de Administrator
   |  Pass-the-Hash (impacket-psexec)
   v
[SYSTEM]  root.txt

1. Reconocimiento

El propio escaneo revela nombres del Domain Controller (CICADA-DC.cicada.htb). Muchas herramientas de AD (LDAP, Kerberos, SMB) fallan o se comportan raro si no pueden resolver el dominio y el FQDN del DC, asi que lo primero es mapearlos a mano:

echo "10.129.5.230 cicada.htb CICADA-DC.cicada.htb" | sudo tee -a /etc/hosts

Con la resolucion en marcha, lanzamos un escaneo completo de puertos:

sudo nmap -Pn -sC -sV -p- --min-rate 10000 10.129.5.230 -oA nmap-cicada

Por que estas flags:

-Pn → no hace ping previo (util si ICMP esta filtrado, algo habitual en HTB).
-sC → lanza los scripts NSE por defecto (banners, deteccion rapida de servicios).
-sV → detecta la version de cada servicio.
-p- → escanea los 65535 puertos TCP, no solo el top-1000.
--min-rate 10000 → acelera la tasa de envio de paquetes.
-oA nmap-cicada → guarda la salida en varios formatos para consultarla despues.

53/tcp   open  domain    (DNS)
88/tcp   open  kerberos-sec
389/tcp  open  ldap
445/tcp  open  microsoft-ds  (SMB)
636/tcp  open  ldapssl
3268/tcp open  globalcatldap
3269/tcp open  globalcatldapssl
5985/tcp open  wsman  (WinRM)

Analisis: DNS + Kerberos + LDAP/Global Catalog + SMB + WinRM en el mismo host es la huella clasica de un Domain Controller de Active Directory. Marca la hoja de ruta: SMB para buscar shares filtrados, LDAP para enumerar el directorio y WinRM como objetivo final de acceso remoto.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.