search

Cicada Write-Up - HTB

Starting with nmap scan to discover active ports:

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-04-23 00:52:29Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:CICADA-DC.cicada.htb
| Not valid before: 2024-08-22T20:24:16
|_Not valid after:  2025-08-22T20:24:16
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:CICADA-DC.cicada.htb
| Not valid before: 2024-08-22T20:24:16
|_Not valid after:  2025-08-22T20:24:16
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:CICADA-DC.cicada.htb
| Not valid before: 2024-08-22T20:24:16
|_Not valid after:  2025-08-22T20:24:16
|_ssl-date: TLS randomness does not represent time
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:CICADA-DC.cicada.htb
| Not valid before: 2024-08-22T20:24:16
|_Not valid after:  2025-08-22T20:24:16
|_ssl-date: TLS randomness does not represent time
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
53185/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: CICADA-DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: 6h59m59s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2025-04-23T00:53:19
|_  start_date: N/A

We have a DC ahead. SMB and LDAP are primary enumeration targets.

SMB:

We have 2 interesting shares: DEV and HR.

Let's see what's inside the file!

We have password piece, now we miss username piece of puzzle. I decided to run kerbrute to enumerate the active usernames in the domain:kerbrute userenum --dc cicada.htb -d cicada.htb /usr/share/seclists/Usernames/xato-net-10-million-usernames.tx

Unfortunately, this doesn't give us too much:

I now start thinking about the password itself... This string looks like a cipher! Given the box name is Cicada... Hmm, I love this.

So we have: Cicada$M6Corpb+QLp#nZp!8

It's interesting, this is a combination real-meaning words and obfuscated/random words. Let's take M6 for example, which could stand for March 6, or Marketing 6 Corp b. Hmm.

Cicada 3301 Tradecraft Considerations:

  • Null Cipher: Extract uppercase letters from obfuscated core:

  • Base58 Encoding (BTC address format):

  • Vigenère Cipher (Key="CICADA"):

I realized I am running in circles, it can't be cipher. I reverted to something easier in the meantime, more user enumeration. This time through:

Made a list:

Output returned:

I tried running evil-winrm, but it seems we are not allowed to connect with our user. Maybe the company didn't apply all the rights yet 🥁

Tried running bloodhound to see what we have, but I realized there must be a chain here... Psexec didn't work neither.

So, I was thinking of doing some thorough rpcqueries with michael's creds.

Just in case I don't forget his password!

Crispy!

The file contains:

A new combination found: emily.oscars - Q!3@Lp#M6b*7t*Vt

Cicada 3301, footholding: completed! -— We are about to be recruited by a top-secret organization now. Prepare.

Let's first check our local privileges by running whoami /all:

SeBackupPrivilege is on. Game is over.

Really easy stuff here, we won't spend time trying to dump NTDS.dit or making a shadow volume. We will directly "backup" the root flag :)

Cool machine. Easy af.

PreviousSupport Write-Up - HTBNextTimelapse Write-up - HTB

Last updated