Cascade — HTB Writeup | The Hack Sparrow

Executive summary — Cascade is a Windows (Active Directory) machine that isn't solved by a single exploit, but by recovering credentials step by step: an anonymous LDAP dump leaks a base64 password, a TightVNC configuration file on an SMB share reveals another, a .NET audit binary decrypts a service account's key, and finally the AD Recycle Bin exposes a deleted TempAdmin account whose password still works for the domain Administrator. A LDAP → SMB → VNC → SQLite/.NET → AD Recycle Bin → Administrator journey.

Platform	Hack The Box
Operating system	Windows
Difficulty	Medium
Status	Retired
Target IP	`10.10.10.182`

Attack map

[LDAP/389]  anonymous dump → cascadeLegacyPwd attribute (base64)
   │  r.thompson : rY4n5eva
   ▼
[SMB/445]  Data share → IT\Temp\s.smith\VNC Install.reg
   │  "Password"=hex:6b,cf,2a,4b,6e,5a,ca,0f  (TightVNC static key)
   ▼
[VNC]  vncpwd → sT333ve2  →  WinRM shell as s.smith  (user.txt)
   │  "Audit Share" group → Audit$ share
   ▼
[Audit$]  CascAudit.exe + Audit.db (SQLite)
   │  Crypto.DecryptString(pwd, "c4scadek3y654321") → w3lc0meFr31nd
   ▼
[arksvc]  WinRM shell · member of "AD Recycle Bin"
   │  Get-ADObject -includeDeletedObjects → deleted TempAdmin
   ▼
[AD Recycle Bin]  cascadeLegacyPwd (base64) → baCT3r1aN00dles
   ▼
[ADMINISTRATOR]  same password → WinRM shell as administrator  (root.txt)

1. Reconnaissance

We map the full TCP surface with a fast all-ports scan, then refine with scripts and version detection on the open ports:

nmap -p- --min-rate 10000 -oA scans/nmap-alltcp 10.10.10.182
nmap -p 53,88,135,389,445,636,3268,3269,5985 -sV -sC -oA scans/nmap-tcpscripts 10.10.10.182

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos
135/tcp   open  msrpc         Microsoft Windows RPC
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: cascade.local, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: cascade.local)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
Service Info: Host: CASC-DC1; OS: Windows Server 2008 R2 SP1

Reading the scan: DNS + Kerberos + LDAP + SMB clearly point to an Active Directory Domain Controller (cascade.local, host CASC-DC1). The open 5985 (WinRM) port is key: if we obtain valid credentials for a user with remote-management rights, we get a direct shell. The OS is an out-of-support Windows Server 2008 R2.

Resumen ejecutivo — Cascade es una máquina Windows (Active Directory) que no cae por un exploit único, sino recuperando credenciales paso a paso: un volcado LDAP anónimo filtra una contraseña en base64, un fichero de configuración de TightVNC en un recurso SMB revela otra, un binario .NET de auditoría descifra la clave de una cuenta de servicio y, por último, la Papelera de reciclaje de AD expone una cuenta TempAdmin borrada cuya contraseña sigue siendo válida para el Administrator del dominio. Un recorrido LDAP → SMB → VNC → SQLite/.NET → AD Recycle Bin → Administrator.

Plataforma	Hack The Box
Sistema operativo	Windows
Dificultad	Medium
Estado	Retired
IP objetivo	`10.10.10.182`

Mapa del ataque

[LDAP/389]  volcado anónimo → atributo cascadeLegacyPwd (base64)
   │  r.thompson : rY4n5eva
   ▼
[SMB/445]  recurso Data → IT\Temp\s.smith\VNC Install.reg
   │  "Password"=hex:6b,cf,2a,4b,6e,5a,ca,0f  (clave estática de TightVNC)
   ▼
[VNC]  vncpwd → sT333ve2  →  WinRM shell como s.smith  (user.txt)
   │  grupo "Audit Share" → recurso Audit$
   ▼
[Audit$]  CascAudit.exe + Audit.db (SQLite)
   │  Crypto.DecryptString(pwd, "c4scadek3y654321") → w3lc0meFr31nd
   ▼
[arksvc]  WinRM shell · miembro de "AD Recycle Bin"
   │  Get-ADObject -includeDeletedObjects → TempAdmin borrado
   ▼
[AD Recycle Bin]  cascadeLegacyPwd (base64) → baCT3r1aN00dles
   ▼
[ADMINISTRATOR]  misma contraseña → WinRM shell como administrator  (root.txt)

1. Reconocimiento

Empezamos mapeando toda la superficie TCP con un escaneo rápido de puertos, y después afinamos con scripts y detección de versión sobre los que están abiertos:

nmap -p- --min-rate 10000 -oA scans/nmap-alltcp 10.10.10.182
nmap -p 53,88,135,389,445,636,3268,3269,5985 -sV -sC -oA scans/nmap-tcpscripts 10.10.10.182

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos
135/tcp   open  msrpc         Microsoft Windows RPC
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: cascade.local, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: cascade.local)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
Service Info: Host: CASC-DC1; OS: Windows Server 2008 R2 SP1

Lectura del escaneo: DNS + Kerberos + LDAP + SMB apuntan claramente a un Controlador de Dominio de Active Directory (cascade.local, host CASC-DC1). El puerto 5985 (WinRM) abierto es clave: si conseguimos credenciales válidas de un usuario con permisos de gestión remota, tendremos shell directa. La versión es un Windows Server 2008 R2, ya sin soporte.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.