LinkedInHTB ProfileAbout
Page cover

HTB - Cascade

Machine Info

Cascade is a medium difficulty Windows machine configured as a Domain Controller. LDAP anonymous binds are enabled, and enumeration yields the password for user r.thompson, which gives access to a TightVNC registry backup. The backup is decrypted to gain the password for s.smith. This user has access to a .NET executable, which after decompilation and source code analysis reveals the password for the ArkSvc account. This account belongs to the AD Recycle Bin group, and is able to view deleted Active Directory objects. One of the deleted user accounts is found to contain a hardcoded password, which can be reused to login as the primary domain administrator.

Enumeration

Scope

IP Address: 10.10.10.182

Nmap Scan

┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Cascade]
└─$ nmap -p- --min-rate 10000 $ip -Pn 

PORT     STATE SERVICE       REASON
53/tcp   open  domain        syn-ack
88/tcp   open  kerberos-sec  syn-ack
135/tcp  open  msrpc         syn-ack
139/tcp  open  netbios-ssn   syn-ack
389/tcp  open  ldap          syn-ack
445/tcp  open  microsoft-ds  syn-ack
636/tcp  open  ldapssl       syn-ack
3268/tcp open  globalcatLDAP syn-ack
5985/tcp open     wsman      syn-ack                                                                                                   
┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Cascade]
└─$ sudo nmap -sU $ip --min-rate 10000 --open -v -oN udp-scan -p1-10000

PORT    STATE SERVICE
53/udp  open  domain
123/udp open  ntp
389/udp open  ldap


┌──(kali㉿kali)-[~/…/HackThebox/HTB/machines/Cascade]
└─$ nmap -p -sCV $ip -Pn -oN Nmap/script-scan

PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
| dns-nsid: 
|_  bind.version: Microsoft DNS 6.1.7601 (1DB15D39)
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-07-10 02:05:24Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: cascade.local, Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: cascade.local, Site: Default-First-Site-Name)
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
Service Info: Host: CASC-DC1; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2024-07-10T02:05:33
|_  start_date: 2024-07-10T01:57:18
| smb2-security-mode: 
|   2:1:0: 
|_    Message signing enabled and required
|_clock-skew: 5s

DNS Enumeration

No zone transfer available

RPC Enumeration

Found usernames from rpc calls

Filter out these users and create a list of them

SMB Enumeration

No data from smb

Kerberos Enumeration

I want to check that users I found are valid on the domain, So I will verify this with Kerbrute

11/15 valid usernames, Let's attempt ASREP-Roasting attack against these users

I got no hash from this attack, Let's switch to ldap protocol

LDAP Enumeration

  • I will use ldapsearch with the following flags

    • -x simple authentication

    • -b principal name

    • -s scope

    • sub subtree

    • '*' all

The output was too big, So I searched for Users section for anything might be helpful. there were a lot of users details but this user below has a different record cascadeLegacyPwd .

It's a base64 encoding , Let's decode it in our terminal

It might be a password for that user, Let's check with crackmapexec

I also want to see if we can access the machine with winRM , but It failed

I will continue enumerate the domain with the credentials I found

Initial Access

Bloodhound-python

Fire up bloodhound.py and prepare the zip file for BloodHound GUI

Upload the data to bloodhound

SMB Credentialed Enumeration

List out the shares we have access to and In the next command I will crawl to the shares with Spider_plus Module

These files took my attention, So I downloaded them to my kali machine for examination

There is user TempAdmin and we need to find his password.

This is encrypted password for VNC SERVER, So we need to decrypt it

LogoGitHub - jeroennijhof/vncpwd: VNC Password DecrypterGitHub

Confirm access

Access the machine and get the flag

User Flag: 4701aeb4858f9ab9d7cxxxxxxxxxxxx

Privilege Escalation

After I solved the machine, I knew from the community the following attack path was unintended, So I added the intended path to this section, too

Unintended Path

Since, The machine release date is 2020, There is a CVE was published on the same year that allow Domain Admins rights from

Dump the ntds database

Access the machine ad administrator with psexe.py

Root Flag: 89f1c7a9f45ddf6f59cxxxxxxxxxxxxxx

Intended Path

After exploring the shares with crackmapexec as user s.smith, I found that he has read access on audit$ share

let's download CascAudit.exe and examine it in dnSpy.exe

The script check of provided arguments.

RunAudit.bat shows the command and appropriate argument

When reading the code, it has a connection string consist of username, domain name, password, So I put breakpoint on text2 to get the password

Provide the path of Audit.db as argument to make the script work properly

We got the username, domain name, and password

Confirm Access

From bloodhound, the user arksvc is a member of AD RECYCLE BIN group which has access to AD Deleted Object

From HackTricks:

LogoPrivileged Groups - HackTricksbook.hacktricks.xyz

We saw Tempadmin before and this record is important cascadeLegacyPwd: YmFDVDNyMWFOxxxxxxx

Decode the value we found

If we combine the pieces together the decoded password is the password of the administrator account

Get the flag

Root Flag: 89f1c7a9f45ddf6f59cxxxxxxxxxxxxxx

PreviousHTB - StreamIONextHTB - Monteverde

Last updated