https://chaelsoo.me/tags/nxc/Recent content in Nxc on kanyo's blogHugo -- gohugo.ioen-gbMon, 01 Jun 2026 00:00:00 +0000https://chaelsoo.me/writeups/htb-cicada/Mon, 01 Jun 2026 00:00:00 +0000https://chaelsoo.me/writeups/htb-cicada/<p>Windows box, no web server. Everything comes from SMB and LDAP, one credential leading to the next. It&rsquo;s a nice example of how a single operational security mistake, a default password in an HR notice, a cleartext password in an AD description, credentials embedded in a script, cascades into domain compromise. The escalation at the end via Backup Operators and SeBackupPrivilege is a classic that deserves proper understanding.</p> <h2 id="recon">Recon</h2> <p>10.129.231.149, domain <code>cicada.htb</code>, DC hostname <code>CICADA-DC</code>. Windows Server 2022. Standard AD ports, WinRM on 5985, no MSSQL this time. Anonymous SMB auth was denied, but the guest account worked:</p>