Cicada（HTB Easy）

Fri, 04 Oct 2024 00:00:00 +0000

Cicada（HTB Easy）

基本信息

IP：10.10.11.35
VPN：10.10.16.16
域名：cicada.htb

信息收集

vim /etc/hosts
nmap -sC -sV -Pn -T4 -p- -oN Allports.nmap 10.10.11.35

Host script results:
| smb2-security-mode:
|   3:1.1:
|_    Message signing enabled and required
|_clock-skew: 6h48m43s
| smb2-time:
|   date: 2024-10-03T12:00:17
|_  start_date: N/A

rustscan -a 10.10.11.35 -- -sCTV

53/tcp    open  domain        syn-ack Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack Microsoft Windows Kerberos
135/tcp   open  msrpc         syn-ack Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: cicada.htb0.)
445/tcp   open  microsoft-ds? syn-ack
464/tcp   open  kpasswd5?     syn-ack
593/tcp   open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      syn-ack Microsoft Windows Active Directory LDAP
3268/tcp  open  ldap          syn-ack Microsoft Windows Active Directory LDAP
3269/tcp  open  ssl/ldap      syn-ack Microsoft Windows Active Directory LDAP
5985/tcp  open  http          syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)

445 开放，先用 CVE-2020-0796（SMBGhost）验证：

SeBackupPrivilege on 633k

Cicada（HTB Easy）

Cicada（HTB Easy）

基本信息

信息收集