HTB - Cascade

Zweilosec's write-up on the medium difficulty Windows machine Cascade from https://hackthebox.eu

Overview

This medium difficulty Windows machine was a good refresher on themes and techniques I had seen in other machines (such as Nest), but also introduced new things and gave enough of a challenge to be quite fun. With proper enumeration this should be a fairly easy challenge, depending on the comfort level with some aspects (such as reading C# code).

Useful Skills and Tools

Enumerate SMB shares without credentials

smbclient -N -L \\\\<server_IP>\\

or

smbmap -d <domain> -L -H <IP>

Copying an entire SMB folder recursively using smbclient:

  1. Connect using: smbclient -U <user> \\\\<ip>\\<folder> <password>

  2. smb: tarmode

  3. smb: recurse

  4. smb: prompt

  5. smb: mget <folder_to_copy>

Decode VNC Passwords

Many VNC products contain the same DES hardcoded encryption key for user passwords, which makes them trivial to break.

Compile .NET code online

To quickly compile and run any kind of .NET code on the go without having to install Visual Studio and the proper dependencies, I highly recommend the website https://dotnetfiddle.net/

Disassemble .NET binaries

Binaries written in .NET languages (such as C#) are fairly simple to break down to the original source code with https://github.com/icsharpcode/AvaloniaILSpy.

Enumeration

Nmap scan

I started my enumeration with an nmap scan of 10.10.10.182. The options I regularly use are: -p-, which is a shortcut which tells nmap to scan all ports, -sC is the equivalent to --script=default and runs a collection of nmap enumeration scripts against the target, -sV does a service scan, and -oN <name> saves the output with a filename of <name>.

At first my scan wouldn't go through until I added the -Pn flag to stop nmap from sending ICMP probes. After that it proceeded normally.

The nmap OS detection script identified this machine as windows_server_2008:r2:sp1 which is a pretty old version of Windows! Other than that I found the standard Windows Domain Controller ports open.

rpcclient

Next, I connected to the RPC service using rpcclient.

I was not able to get much information, but I did get a list of usernames (and their RIDs).

Metasploit - Kerberos user enumeration

I saved the usernames to a file and ran the Metasploit module auxiliary(gather/kerberos_enumusers) to see which of them were valid users and to check if any of them did not require pre-authentication.

This was interesting. Some of the accounts had their credentials revoked and were disabled or locked out. I hoped this was not the result of someone brute-forcing a login attempt! Unfortunately, all of the active accounts required pre-authentication.

enum4linux

While I was running those other commands I also had the script enum4linux running in another terminal. This script automates a lot of the common enumeration tasks against a Windows machine, but can take some time to run.

The script returned a lot of the same information I could have gotten from other sources such as ldapsearch, put compiled it into one location, neatly separated by category. As useful as this tool is, I do not recommend using it as your sole source of information, as it chops out a lot of the information fields that can sometimes contain useful information.

The most useful information I got from this was the group membership for each user.

  • IT group contains: r.thompson, s.smith, and arksvc.

  • HR group contains: s.hickson

  • AD Recycle Bin group contains: arksvc

  • Remote Management Users group contains s.smith and arksvc

  • Audit Share group contains s.smith

  • Data Share group contains all Domain Users

smbclient

Some of the interesting groups insinuated that there was a Data and an Audit share folder.

I tried connecting to each folder anonymously to see what I could find. I was able to login successfully, but the ACL denied me access to those folders. Odd!

ldapsearch

Since I had found lots of useful information, but still had no credentials, I decided to dive deeper into LDAP and see if there were some details the other tools had missed. (I had even tried using the usernames list as the passwords to check for that common problem, but no dice there).

There were some small details that were not found in the other tools, such as the exact share folder naming. Easily overlooked, there was also an entry on the user r.thompson that seemed to have a potential password in the cascadeLegacyPwd field .

Base64 decoding clk0bjVldmE= gave me the password rY4n5eva.

crackmapexec

I saved this password to my passwords file and used crackmapexec to test all of the users against SMB with this password.

As expected, the password belonged to r.thompson.

Initial Foothold

Enumeration as r.thompson

smbmap

Using my new credentials, I was able to get a full listing of the network shares on this machine.

This user was only able to access Data, NETLOGON, print$, and SYSVOL.

smbclient

I checked SYSVOL first since it can sometimes contain passwords, but neither it nor NETLOGON had anything interesting. The print$ admin share only contained a bunch of printer drivers, and I didn't want to jump down the rabbit hole of looking for exploits there until I had exhausted all other avenues of enumeration.

Road to User

After connecting to the Data share, I found folders corresponding to each of the business unit security groups I had seen earlier. Since r.thompson is a member of the IT group I figured that was probably what he had access to. (I did check the other folders; no access).

I used a little trick I had learned on the machine Nest for downloading all of the files in an SMB folder recursively. After downloading all of the files, I browsed through my loot.

I found another potential username TempAdmin in the Meeting_Notes_June_2018.html file. This user was given the same password as the normal admin account, so if I can find the password for one, I have the password for the other!

This file ArkAdRecycleBin.log looked interesting. If I could login as arksvc it seemed likely that I would probably have SeBackupPrivilege which would grant pretty much instant pwn. This service account also has Remote Management Users group membership so it seems likely that this is a good path to look for.

Finding user creds

The last file I opened was the most juicy looking. Registry keys often have interesting things in them.

As soon as I saw the VNC Install.reg key I knew there had to be a password in it, and I was not disappointed. The password was encrypted and stored in a hexadecimal format, though frizb has a repository on GitHub that describes how to decrypt this at https://github.com/frizb/PasswordDecrypts.

VNC uses a hardcoded DES key to store credentials. The same key is used across multiple product lines.

frizb mentions that there is an easy way to decode this using the interactive Ruby prompt in Metasploit. Using the "industry standard" decryption key \x17\x52\x6b\x06\x23\x4e\x58\x07 I was able to decode the password sT333ve2.

User.txt

There were ne surprises in either the groups or privileges for s.smith. I was happy to find the user.txt file in the Desktop folder though!

Path to Power (Gaining Administrator Access)

Enumeration as s.smith

smbmap

Once again I fired up smbmap to see what level of access this user had to the Audit$ share folder since I didn't know where it was mounted in the filesystem.

s.smith only had Read access to the Data and Audit shares, as well as print$, NETLOGON, and SYSVOL

Since I had already checked all of the other shares, I logged into the audit$ share. The first file I checked, RunAudit.bat, only contained one line.

It looked like the executable CascAudit.exe runs against the database file Audit.db when this batch script is run. I downloaded the database file and then used the command sqlite3 Auditdb, which got me a SQLite shell with which I could enumerate the database.

First I dumped the DeletedUserAudit table, which revealed that the user TempAdmin I had been looking for had been deleted! Perhaps I could find some remnants of that user which would give me his admin credentials. I dumped the Ldap table of this database, which gave me only a few queries including the line INSERT INTO Ldap VALUES(1,'ArkSvc','BQO5l5Kj9MdErXx6Q6AGOw==','cascade.local'); which looked like it contained a password for the ArkScv user that I was hoping to move laterally into. Now I had to figure out what kind of encryption it was stored with (it wasn't simple base64 unfortunately).

Since I had noticed that CascAudit.exe interacted with the database file, I was fairly certain that it had something to do with the encryption. The file CascCrypto.dll in the same folder strengthened my suspicions. I loaded each of those files in ILSpy hoping that they had been compiled with .NET. Luckily for me they had, and I was presented with the source code for the files. I very quickly spotted the linepassword = Crypto.DecryptString(encryptedString, "c4scadek3y654321"); which pointed me to both the decryption method and also what was most likely a hardcoded encryption key.

I copied the decryption method from CascCrypto.dll and the encryption key from the executable then loaded the code into dotnetfiddle.net where I could compile and run it.

If I hadn't been comfortable with writing a tiny bit of C# to get the code to run, all of the information needed to use other methods is contained in the code. The encryption algorithm is AES in CBC mode with a key and block size of 128 bits, and an IV of 1tdyjCbY1lx49842. Taking this information with the known ciphertext and encryption key, I could have used any number of programming or scripting languages, or even websites to decrypt the password (such as one of my favorite sites for deciphering and decoding: https://gchq.github.io/CyberChef/).

After a little bit of work to make the code function as a stand-alone program, it gave me the password w3lc0meFr31nd. I'm not sure what the undecipherable characters are in the output, but luckily leaving them out did not cause any issues with logging in with this password.

Moving Laterally to arksvc

Darn, I expected this user to have SeBackupPrivilege. Oh well, so much for the easy win. The group AD Recycle Bin looked promising, however. I did some research on this group and found a blog that talked about how to exploit it at https://blog.stealthbits.com/active-directory-object-recovery-recycle-bin/. There was also a bit of interesting trivia included that related to this machine:

The Active Directory Recycle Bin was introduced in the Windows Server 2008 R2 release.

Using the information in the blog, it looked like I could revive the TempAdmin account that I had seen when I enumerated the database, which had been deleted.

Running this command from the article returns:

There is the TempAdmin user we were looking for. According to the blog, we can restore it with the command Restore-ADObject -Identity "<ObjectGUID>".

Well that looks like a bust...I wonder what else can arksvc do with a deleted account? I tried trimming down the command to see how different the output was.

For a deleted account there was sure a lot of information still stored! There were a few other deleted objects, but the additional information included in the TempAdmin object gave me everything I needed. There was another base64 encoded CascLegacyPwd.

Decoding the base64 string YmFDVDNyMWFOMDBkbGVz gave me the password baCT3r1aN00dles.

Getting an Administrator shell

Pwn3d!

Root.txt

After getting the password for TempAdmin, which I had read earlier was the same as the normal Administrator account, I was able to finally login to an Administrator shell and gather up my hard-earned loot.

Woot! Domain Admin!

Thanks to Vbscrub for this machine which was fairly easy, but had some interesting takes on old methods and also included some things which were new to me. Easy challenges should never be beneath you, because each one is a validation of how much you have learned!

If you like this content and would like to see more, please consider buying me a coffee!

PreviousHTB - NestNextHTB - Fuse

Last updated

Was this helpful?