Cascade #5 AD
Reconnaissance:
NMAP:
┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.182
All 1000 scanned ports on 10.10.10.182 (10.10.10.182) are in ignored states.┌──(kali💀kali)-[~]
└─$ sudo nmap -sU -O 10.10.10.182
PORT STATE SERVICE
53/udp open domain
123/udp open ntp
389/udp open ldap
OS CPE: cpe:/h:allen-bradley:micrologix_1100 cpe:/h:atcom:at-320 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows cpe:/o:microsoft:windows_xp::sp3 cpe:/o:microsoft:windows_server_2012 cpe:/a:vmware:player┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -p- 10.10.10.182
53/tcp open domain Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
| dns-nsid:
|_ bind.version: Microsoft DNS 6.1.7601 (1DB15D39)
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2023-12-26 07:47:32Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: cascade.local, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: cascade.local, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49157/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49158/tcp open msrpc Microsoft Windows RPC
49170/tcp open msrpc Microsoft Windows RPC
Service Info: Host: CASC-DC1; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2023-12-26T07:48:31
|_ start_date: 2023-12-26T07:34:24
| smb2-security-mode:
| 2:1:0:
|_ Message signing enabled and required Enumeration: SMB - TCP 445
SMB seems to allow anonymous login, but then shows no shares:
Enumeration: RPC - 445
RPC does allow for anonymous connection as well. I am able to list domain users:
Enumeration: LDAP - TCP 389
First, we can try an anonymous bind on the LDAP port using ldapsearch and list usernames. Here, we used the grep command to look for the userPrincipalName attribute that specifies the UPN of the users.
We got some users. Now, for the CTF-y part, we had to take a closer look at ldapsearch command output and found an attribute named cascadeLegacyPwd for the r.thompson@cascade.local user.
Using the base64 command, it was possible to decode the value and get a potential password.
Then, using crackmapexec, it was possible to check if the password was valid.
I tried connecting over WinRM, but didn’t succeed.
Shell as s.smith
Revisiting SMB: With the password collected from LDAP, more shares are visible:
smbmap shows the same:
Share Enumeration:
By taking a look at the Data share, we found multiple folders. In a real-world scenario, adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives. With the previously discovered shares, let’s see if we can find interesting files.
Done. Let’s start by taking a look at the Meeting_Notes_June_2018.html file. I’ll keep an eye out for the admin account password and TempAdmin.
VNC Install.reg is interesting too. The file uses 16-bit characters, and therefore looks really ugly in less or vim, but cat handles it: The line "Password"=hex:6b,cf,2a,4b,6e,5a,ca,0f jumped out as interesting.
Crack TightVNC Password:
OPTION1:
Some reading about TightVNC shows that it stores the password in the register encrypted with a static key. There’s a bunch of tools out there to do it. I used this. That command is using the -r -p options in xxd to convert from a hex string to ran binary.
OPTION2:
This is interesting, it’s a backup of registry keys related to VNC. We can also see an encoded password. VNC uses a hardcoded DES key to store credentials. The same key is used across multiple product lines so we may get a cleartext password by decrypting it.
Using this post about VNC passwords, we can try to decrypt it. According to the article, decryption the password is as simple as that:
WinRM:
With these creds, crackmapexec shows that it is possible to get a shell over WinRM:
Privesc: s.smith –> arksvc
Enumeration:
s.smith is the only user in the group, but the comment is a useful hint to look at this share. There’s a c:\shares, but I don’t have permissions to list the directories in it:
However, I can just go into Audit based on the share name in the comment:
I can also access this share from my local box:
I’ll copy all the files to my local VM:
Audit.db:
The first thing I looked at was DB\Audit.db. It’s a SQLite3 database:
I dumped all the data from the three tables:
Nothing jumped out as particularly interesting. I thought the Ldap table could have had a password in it, but the base64-encoded data didn’t decode to ASCII. Perhaps it’s encrypted somehow.
CascAudit.exe:
RunAudit.bat shows that CascAudit.exe is run with the db file as an argument:
It’s a .NET binary:
I’ll jump over to a Windows VM and use DNSpy to take a look. In the MailModule, there’s this code:
It is opening an SQLite connection to the database passed as an arg, reading from the LDAP table, and decrypting the password.
I decided to recover the plaintext password by debugging. I put a breakpoint on line 53 where the SQL connection is closed. Then I went Debug -> Start Debugging…, and set the Arugument to where I had a copy of Audit.db:
On hitting OK, it runs to the breakpoint, and I can see the decrypted password in the Locals window:
Based on the line in the SQLite DB, this password, w3lc0meFr31nd, likely pairs with the account arksvc.
WinRM:
crackmapexec shows that not only does the password work, but will provide a WinRM shell:
Had I not know the account that was associated with this password, I could have used crackmapexec with a list of users:
Anyway, I can get a shell over Evil-WinRM as arksvc:
Privesc: arksvc –> administrator
Enumeration:
arksvc is also in some interesting groups:
AD Recycle:
AD Recycle Bin is a well-know Windows group. Active Directory Object Recovery (or Recycle Bin) is a feature added in Server 2008 to allow administrators to recover deleted items just like the recycle bin does for files. The linked article gives a PowerShell command to query all of the deleted objects within a domain:
The last one is really interesting, because it’s the temporary administer account mentioned in the old email I found earlier (which also said it was using the same password as the normal admin account). I can get all the details for that account:
Immediately cascadeLegacyPwd : YmFDVDNyMWFOMDBkbGVz jumps out. It decodes to baCT3r1aN00dles:
WinRM:
This password works for the main administrator account:
I can get a WinRM session as administrator:
Last updated