Cascade

Verified writeups for the Cascade machine of Hack The Box

Cascade

$ tldr LDAP/SMB enum → TightVNC + DotPeek decrypt → AD admin

·	·
Operating system	Windows
Difficulty	Medium
Vector	Active Directory
IP	10.10.10.182
Retirement date	2020-07-25
Skills	RPC Enumeration User Enumeration via Kerberos - Kerbrute ASREPRoast Attack - GetNPUsers.py (Failed) LDAP Enumeration - ldapsearch && ldapdomaindump SMB Enumeration - smbclient && smbmap Cracking TightVNC Password - vncpwd Kerberoasting Attack - GetUserSPNs.py (Failed) Abusing WinRM - EvilWinRM Enumerating SQLite3 Database File Analysis of Windows EXE binary Installing DotPeek on a Windows virtual machine Reverse engineering the CBC cipher - Obtaining clear text passwords Abusing AD Recycle Bin Group - Active Directory Object Recovery (Get-ADObject) [Privilege Escalation] EXTRA: Chisel Remote Port Forwarding (RDP + Remmina)

Writeups

Language	Author	Format	Link
🇪🇸 ES	S4vitar	Vídeo	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	IppSec	Vídeo	Open

Skill resources

Curated documentation for each technique listed in the Skills column above. Sources: HackTricks, GTFOBins, PortSwigger, etc.

Skill	Source	Link
Active Directory	HackTricks	Open
Port Forwarding / Pivoting	HackTricks	Open
Kerberoasting	HackTricks	Open
GetNPUsers (Impacket)	HackTricks	Open
SQL Injection	HackTricks	Open
SQL Injection	PortSwigger	Open
SMB (139/445)	HackTricks	Open

Related skills worth mastering

DCSync · BloodHound · Group Policy Preferences (GPP) · Remote Code Execution (RCE) · Cross-Site Scripting (XSS) · EternalBlue (MS17-010) · MS08-067 (NetAPI)

If you liked this machine, try

• Sizzle — Windows, Insane
• Blackfield — Windows, Hard
• Search — Windows, Hard
• MultiMaster — Windows, Insane
• Scrambled — Windows, Medium

---

Comments & tips

Did the official writeup not work? Found a smarter trick? Share it here — comments live in GitHub Discussions.

Last updated: 2026-06-07