HackTheBox - Cicada
Source: YouTube · IppSec · published Feb 15, 2025 · 32:29
The video demonstrates a Hack The Box machine walkthrough where an attacker exploits an open file share to discover a default password, performs a RID brute-force to enumerate users, and leverages embedded credentials in a PowerShell script to gain domain access 0:00-0:38.
Key Takeaways:
• The target is a Windows box without a web server, starting with an open file share containing a password file for new accounts 0:00-0:11.
• Since no user list exists, a RID brute-force attack is used to generate a list of valid usernames for password spraying 0:11-0:18.
• Password spraying reveals valid credentials, allowing the attacker to dump more domain user information 0:18-0:28.
• A specific user's account description contains their password, granting access to a different file share 0:28-0:33.
• Downloading a PowerShell backup script from this share reveals an embedded credential, escalating the attack 0:33-0:38.
This walkthrough highlights the critical risks of default passwords and hardcoded credentials in administrative scripts within Windows environments.
Sources:
- 0:00 Introduction to the Hack The Box machine and initial open share findings
- 0:11 Explanation of RID brute-forcing to enumerate users
- 0:18 Password spraying and credential dumping techniques
- 0:28 Discovery of a password in a user account description
- 0:33 Extraction of embedded credentials from a PowerShell backup script
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
what's going on YouTube this is IPC M cicada from hack the box which is a relatively straightforward Windows box that doesn't have a web server it starts off with a numerating files on an open share to discover there's a file that contains the password new accounts are created with however without a user list we can't really use that password but we can do our rid brute force in order to build our own user list and then spray that password against it and that gives us credentials to the Box we can't log in just yet but we can use these credentials to dump more user information about the domain and discover one user has their password set in the description of their account and this user has access to a different file share that you download the script it's a backup script written in Powers…