search

Cascade #5 AD

hashtag
Reconnaissance:

NMAP:

┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.182

All 1000 scanned ports on 10.10.10.182 (10.10.10.182) are in ignored states.
┌──(kali💀kali)-[~]
└─$ sudo nmap -sU -O 10.10.10.182 

PORT    STATE SERVICE
53/udp  open  domain
123/udp open  ntp
389/udp open  ldap

OS CPE: cpe:/h:allen-bradley:micrologix_1100 cpe:/h:atcom:at-320 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows cpe:/o:microsoft:windows_xp::sp3 cpe:/o:microsoft:windows_server_2012 cpe:/a:vmware:player
┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -p- 10.10.10.182    

53/tcp    open  domain        Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
| dns-nsid: 
|_  bind.version: Microsoft DNS 6.1.7601 (1DB15D39)
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2023-12-26 07:47:32Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: cascade.local, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: cascade.local, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49154/tcp open  msrpc         Microsoft Windows RPC
49155/tcp open  msrpc         Microsoft Windows RPC
49157/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49158/tcp open  msrpc         Microsoft Windows RPC
49170/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: CASC-DC1; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2023-12-26T07:48:31
|_  start_date: 2023-12-26T07:34:24
| smb2-security-mode: 
|   2:1:0: 
|_    Message signing enabled and required

hashtag
Enumeration: SMB - TCP 445

SMB seems to allow anonymous login, but then shows no shares:

hashtag
Enumeration: RPC - 445

RPC does allow for anonymous connection as well. I am able to list domain users:

hashtag
Enumeration: LDAP - TCP 389

First, we can try an anonymous bind on the LDAP port using ldapsearch and list usernames. Here, we used the grep command to look for the userPrincipalName attribute that specifies the UPN of the users.

We got some users. Now, for the CTF-y part, we had to take a closer look at ldapsearch command output and found an attribute named cascadeLegacyPwd for the r.thompson@cascade.local user.

Using the base64 command, it was possible to decode the value and get a potential password.

Then, using crackmapexec, it was possible to check if the password was valid.

I tried connecting over WinRM, but didn’t succeed.

hashtag
Shell as s.smith

Revisiting SMB: With the password collected from LDAP, more shares are visible:

smbmap shows the same:

Share Enumeration:

By taking a look at the Data share, we found multiple folders. In a real-world scenario, adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives. With the previously discovered shares, let’s see if we can find interesting files.

Done. Let’s start by taking a look at the Meeting_Notes_June_2018.html file. I’ll keep an eye out for the admin account password and TempAdmin.

VNC Install.reg is interesting too. The file uses 16-bit characters, and therefore looks really ugly in less or vim, but cat handles it: The line "Password"=hex:6b,cf,2a,4b,6e,5a,ca,0f jumped out as interesting.

Crack TightVNC Password:

OPTION1:

LogoGitHub - jeroennijhof/vncpwd: VNC Password DecrypterGitHubchevron-right

Some reading about TightVNC shows that it stores the password in the register encrypted with a static key. There’s a bunch of tools out there to do it. I used this. That command is using the -r -p options in xxd to convert from a hex string to ran binary.

OPTION2:

LogoGitHub - frizb/PasswordDecrypts: Handy Stored Password Decryption TechniquesGitHubchevron-right

This is interesting, it’s a backup of registry keys related to VNC. We can also see an encoded password. VNC uses a hardcoded DES key to store credentials. The same key is used across multiple product lines so we may get a cleartext password by decrypting it.

Using this post about VNC passwords, we can try to decrypt it. According to the article, decryption the password is as simple as that:

WinRM:

With these creds, crackmapexec shows that it is possible to get a shell over WinRM:

hashtag
Privesc: s.smith –> arksvc

Enumeration:

s.smith is the only user in the group, but the comment is a useful hint to look at this share. There’s a c:\shares, but I don’t have permissions to list the directories in it:

However, I can just go into Audit based on the share name in the comment:

I can also access this share from my local box:

I’ll copy all the files to my local VM:

Audit.db:

The first thing I looked at was DB\Audit.db. It’s a SQLite3 database:

I dumped all the data from the three tables:

Nothing jumped out as particularly interesting. I thought the Ldap table could have had a password in it, but the base64-encoded data didn’t decode to ASCII. Perhaps it’s encrypted somehow.

CascAudit.exe:

RunAudit.bat shows that CascAudit.exe is run with the db file as an argument:

It’s a .NET binary:

I’ll jump over to a Windows VM and use DNSpy to take a look. In the MailModule, there’s this code:

It is opening an SQLite connection to the database passed as an arg, reading from the LDAP table, and decrypting the password.

I decided to recover the plaintext password by debugging. I put a breakpoint on line 53 where the SQL connection is closed. Then I went Debug -> Start Debugging…, and set the Arugument to where I had a copy of Audit.db:

On hitting OK, it runs to the breakpoint, and I can see the decrypted password in the Locals window:

Based on the line in the SQLite DB, this password, w3lc0meFr31nd, likely pairs with the account arksvc.

WinRM:

crackmapexec shows that not only does the password work, but will provide a WinRM shell:

Had I not know the account that was associated with this password, I could have used crackmapexec with a list of users:

Anyway, I can get a shell over Evil-WinRM as arksvc:

hashtag
Privesc: arksvc –> administrator

Enumeration:

arksvc is also in some interesting groups:

AD Recycle:

AD Recycle Bin is a well-know Windows group. Active Directory Object Recovery (or Recycle Bin) is a feature added in Server 2008 to allow administrators to recover deleted items just like the recycle bin does for files. The linked article gives a PowerShell command to query all of the deleted objects within a domain:

LogoActive Directory Object Recovery Using the Recycle Binblog.stealthbits.comchevron-right

The last one is really interesting, because it’s the temporary administer account mentioned in the old email I found earlier (which also said it was using the same password as the normal admin account). I can get all the details for that account:

Immediately cascadeLegacyPwd : YmFDVDNyMWFOMDBkbGVz jumps out. It decodes to baCT3r1aN00dles:

WinRM:

This password works for the main administrator account:

I can get a WinRM session as administrator:

PreviousResolute #4 ADNextBastion

Last updated