Cascade - HackTheBox

Finally Cascade retired!!!! My personal favorite box from HTB...


USER: LDAP leaks an attribute(cascadeLegacyPwd) for user R.Thompson containing his password. Using SMB, we get an interesting email along with a reg file containing encrypted password for s.smith. From github(https://github.com/frizb/PasswordDecrypts) we find the key the TightVNC app uses and decrypt the password to login using Evil-WinRM and get the user flag.

LATERAL MOVEMENT: Using the credentials of s.smith, we have access to a share containing a custom made application and an encrypted password for ArkSvc. De-compiling the app gives us the key and IV for AES decryption. On decrypting the password we can login as ArkSvc by Enter-PSSession.

ROOT: We can access the AD Recycling bin as ArkSvc user and get all attributes for TempAdmin. Due to the password of TempAdmin being same as normal Administrator account(described in the email from the shares), we find the cascadeLegacyPwd attribute for ArkSvc containing the base64 encoded password. Using that we login as the Administrator and get our root flag!


---My Errors---
- This was my first write-up video ever made. So the worst audio and video is presented ;)...
- Second time for getting the password from the .db file, I opened it using notepad instead of the DB browser. Tiny mistake but can be really confusing...
-OBS betrayed me after I recorded the windows part. It recorded it in 720p while I didn't wanted to everything again, I just went with the eye-damager powershell part...
And still counting...(comment if you didn't like something)
----------------------



This is a solution not an explanation.