search

Cascade

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 -Pn 10.129.178.248
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-06 08:23 EDT
Nmap scan report for 10.129.178.248
Host is up (0.0083s latency).
Not shown: 65520 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
49154/tcp open  unknown
49155/tcp open  unknown
49157/tcp open  unknown
49158/tcp open  unknown
49165/tcp open  unknown

hashtag
SMB Null Shares

SMB enumeration gave me a load of usernames.

ASREP-Roasting doesn't work, and brute forcing didn't work. In this case, we can take a look at LDAP and its output.

hashtag
LDAP Enum

We can run an anonymous ldapsearch on the machine, and find loads of output. While looking through the users' LDAP information, I came across this

There was a cascadceLegacyPwd field, which is normally not present. Decoded, this gives rY4n5eva. Using these credentials, we can gain access to the SMB shares, but no shell yet.

hashtag
SMB Shares

We can enumerate the files within the SMB shares, and hopefully find some credentials. I downloaded all the files within the Data share.

The Printer share had a bunch of DLLs and other printer-related files like images, which was not interesting. Out of all files downloaded, the VNC Install one was the most interesting. VNC is sort of like RDP, so there might be credentials there.

Sure enough, we can find a password there. However, VNC passwords are encrypted, and they can be decoded by following the instructions on this repository:

LogoGitHub - frizb/PasswordDecrypts: Handy Stored Password Decryption TechniquesGitHubchevron-right

With these credentials, we can login as s.smith.

Grab the user flag.

hashtag
Privilege Escalation

hashtag
CascAudit.exe -> ArkSvc Creds

We can first enumerate what groups this user is part of:

Audit Share is rather interesting. We can take another look at the SMB shares I have available to s.smith.

There's a new share called Audit$ available. Within it, there were some files, including a DB file.

Audit.db was an SQLite database file, which we can open using sqlite3.

We have another password, and this wasn't base64 encoded. In this case, let's take another look at the .exe file and open it within DnSpy on my Windows VM. When we decompile the main function, this is what we see:

There was some type of password encrypting, and it uses c4scadek3y654321 to do so. It also uses the database that is present as an argument. In this case, I ran it within my machine after setting a breakpoint at the password line after passing the absolute directory of the Audit.db file as one argument.

When we view the local variables, we find a password:

With this, we can login as the ArkSvc user.

hashtag
Recycle Bin

This user is part of the Recycle Bin group:

This means we can restore and view deleted items. We can run this one-liner:

Within the output, we would see another CascadeLegacyPw field.

This decodes to give baCT3r1aN00dles, and I noticed this was for a user called TempAdmin. By testing password reuse, we find that we can login as the Administrator using this password.

Rooted!

PreviousCanapeNextCatch

Last updated