Cascade writeup & walkthrough

Cascade is a medium HackTheBox Windows AD machine. LDAP enumeration reveals a base64-encoded password for a user with SMB access to an Audit share. The share contains a SQLite database and a .NET binary - reversing the binary reveals the ArkSvc account password, which can recover a deleted AD admin account and ultimately yield full domain compromise.

HackTheBox - Cascade

Access Path

no access => r.thompson => ArkSvc => Administrator

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level.

Command Flow

These notes preserve the original command sequence while grouping it in a command block for cleaner rendering.

nmap -sC -sV <ip>

# ─── Enumeration ───────────────────────────────────────────────────────────────

# LDAP enumeration reveals a cascadeLegacyPwd attribute (base64-encoded password)
# #cascade pass in base64 - decode and use for SMB/WinRM

# ─── VNC Password Decryption ───────────────────────────────────────────────────

# VNC password found on a fileshare - decrypt using the well-known DES key
#vnc password on a fileshare
#decrypting vnc password
echo -n d7a514d8c556aade | xxd -r -p | openssl enc -des-cbc --nopad --nosalt -K e84ad660c4721ae0 -iv 0000000000000000 -d | hexdump -Cv

# ─── Audit Share: SQLite + Binary Analysis ─────────────────────────────────────

# ArkSvc account has access to C:sharesAudit - contains an Audit DB and .NET binary
#evil winrm => C:\shares\Audit\DB\Audit.dp
sqlite3 Audit.dp .dump

# Reverse the .NET binary to find how it encrypts/stores passwords
# (see video for binary analysis walkthrough)
#binary analysiation (see video)

# ─── Privilege Escalation: Deleted AD Object Recovery ──────────────────────────

# ArkSvc is a member of AD Recycle Bin - recover deleted user objects
# The deleted TempAdmin account had the same password as the domain administrator
Get-ADObject -SearchBase "CN=Deleted Objects,DC=Cascade,Dc=Local" -Filter {ObjectClass -eq "user"} -IncludeDeletedObjects -Properties *