Cascade
Gaining Access
Nmap scan:
$ nmap -p- --min-rate 5000 -Pn 10.129.178.248
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-06 08:23 EDT
Nmap scan report for 10.129.178.248
Host is up (0.0083s latency).
Not shown: 65520 filtered tcp ports (no-response)
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
49154/tcp open unknown
49155/tcp open unknown
49157/tcp open unknown
49158/tcp open unknown
49165/tcp open unknownSMB Null Shares
SMB enumeration gave me a load of usernames.
ASREP-Roasting doesn't work, and brute forcing didn't work. In this case, we can take a look at LDAP and its output.
LDAP Enum
We can run an anonymous ldapsearch on the machine, and find loads of output. While looking through the users' LDAP information, I came across this
There was a cascadceLegacyPwd field, which is normally not present. Decoded, this gives rY4n5eva. Using these credentials, we can gain access to the SMB shares, but no shell yet.
SMB Shares
We can enumerate the files within the SMB shares, and hopefully find some credentials. I downloaded all the files within the Data share.
The Printer share had a bunch of DLLs and other printer-related files like images, which was not interesting. Out of all files downloaded, the VNC Install one was the most interesting. VNC is sort of like RDP, so there might be credentials there.
Sure enough, we can find a password there. However, VNC passwords are encrypted, and they can be decoded by following the instructions on this repository:
With these credentials, we can login as s.smith.
Grab the user flag.
Privilege Escalation
CascAudit.exe -> ArkSvc Creds
We can first enumerate what groups this user is part of:
Audit Share is rather interesting. We can take another look at the SMB shares I have available to s.smith.
There's a new share called Audit$ available. Within it, there were some files, including a DB file.
Audit.db was an SQLite database file, which we can open using sqlite3.
We have another password, and this wasn't base64 encoded. In this case, let's take another look at the .exe file and open it within DnSpy on my Windows VM. When we decompile the main function, this is what we see:
There was some type of password encrypting, and it uses c4scadek3y654321 to do so. It also uses the database that is present as an argument. In this case, I ran it within my machine after setting a breakpoint at the password line after passing the absolute directory of the Audit.db file as one argument.
When we view the local variables, we find a password:
With this, we can login as the ArkSvc user.
Recycle Bin
This user is part of the Recycle Bin group:
This means we can restore and view deleted items. We can run this one-liner:
Within the output, we would see another CascadeLegacyPw field.
This decodes to give baCT3r1aN00dles, and I noticed this was for a user called TempAdmin. By testing password reuse, we find that we can login as the Administrator using this password.
Rooted!
Last updated