Cicada - Hack The Box
Enumeration
Nmap
Initial Nmap scan revealed SMB, LDAP, Kerberos and WinRM Ports.
SMB Null
SMB Null Session was enabled for HR Share which included default password for newcomers.
Rid Brute
Because SMB Null session was enabled for IPC$ we could apply rid brute forcing then create a user list.
Exploitation
Brute Force
Using the user list and default password, I applied a brute force for SMB login and got a valid user.
LDAP Search
Then using the found credentials, I ran an ldapsearch and found a password on description field.
SMB Enumeration
The new user had access to Dev shares which included a backup script. Inside the backup script there was a credentials.
WinRM
This user had PSRemote privileges so I simply used evil-winrm and got a shell.
Privilege Escalation
SeBackupPrivilege
The user had SeBackupPrivilege enabled.
So I simply followed this steps and got the Administrator hash.
And then using the psexec I simply got the shell.
Pwned
The machine was fully pwned.