root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat active.md
// writeups

Active

28 Jul 2018 · 9 min read
writeupshacktheboxwindowsEasyretiredvip
Active - maquina de Hack The Box

Executive summary — Active is an Active Directory classic where the flaw isn't an exotic exploit but misconfiguration. The Replication share (replicated SYSVOL) is anonymously readable and contains a Groups.xml with a cpassword (GPP): Microsoft published the AES key, so it decrypts to SVC_TGS's credentials. With that account we enumerate the domain (RID brute) and Kerberoast Administrator — which has an SPN registered by mistake —, crack its TGS offline and log in as Domain Admin. Path: GPP → SVC_TGS → Kerberoasting → Administrator.

PlatformHack The Box
Operating systemWindows Server — Domain Controller (Active Directory)
Domainactive.htb
DifficultyEasy
StatusRetired
Target IP10.129.8.141

Attack map

[Anonymous SMB] Replication share (SYSVOL) → Groups.xml (GPP)
   │  cpassword (public AES key, MS14-025) → gpp-decrypt
   │  → SVC_TGS : GPPstillStandingStrong2k18
   ▼
[SVC_TGS]  (user.txt) → RID brute (NetExec) → user list
   │  Kerberoasting against Administrator (SPN it shouldn't have)
   │  GetUserSPNs → TGS-REP etype23 → hashcat/john
   ▼
[ADMIN]  Administrator : Ticketmaster1968 → psexec → root.txt

1. Reconnaissance (Nmap)

First we confirm what the target exposes and whether it looks like a Domain Controller:

nmap -Pn -sC -sV -p- --min-rate 10000 10.129.8.141 -oN nmap_active.txt

Flag breakdown: -Pn assumes the host is up even without a ping reply (common on HTB, which usually blocks ICMP); -sC runs the default NSE scripts for basic enumeration; -sV detects service versions; -p- scans all 65535 TCP ports; --min-rate 10000 speeds up the scan; -oN saves the output to a file. What I'm looking for is the typical DC combo: 53 (DNS), 88 (Kerberos), 389/3268/3269 (LDAP/Global Catalog), 445 (SMB) and 464 (kpasswd). If they all show up together, the target is almost certainly an Active Directory Domain Controller.

2. SMB enumeration: useful shares

On a DC, SMB is often a goldmine: shares like SYSVOL, NETLOGON or, on this box, Replication give key hints about the domain setup.

smbclient -N //10.129.8.141/Replication
# recurse to: .../Policies/{...}/MACHINE/Preferences/Groups/Groups.xml

-N forces a null session (no credentials). Replication on Active is exactly that: the replicated contents of SYSVOL, holding the domain's group policies (GPOs). That's where I look for the classic Groups.xml from Group Policy Preferences, where credentials used to be stored.

3. GPP: extracting and decrypting the cpassword

Group Policy Preferences used to let admins push passwords (for example, for local users) directly from a GPO. Microsoft fixed this with MS14-025, but many environments still carry the old XML files that were never cleaned up, and the root problem remains serious: the AES key used to "encrypt" the cpassword attribute was published in MSDN documentation, so the encryption is purely cosmetic and anyone can reverse it.

gpp-decrypt edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ
# → SVC_TGS : GPPstillStandingStrong2k18

Groups.xml yields plaintext domain credentials: user SVC_TGS, password GPPstillStandingStrong2k18.

4. Validating credentials and user.txt

With a valid domain account, the first thing to do is verify access and look for flags/files by browsing user shares:

smbclient //10.129.8.141/Users -U 'SVC_TGS%GPPstillStandingStrong2k18'
# browse to SVC_TGS\Desktop\user.txt

Access works: we now have working domain credentials and can read user.txt from SVC_TGS's profile.

5. Enumerating domain users (RID brute with NetExec)

Before attacking Kerberos it's worth getting the real list of domain accounts. RID cycling abuses the fact that, with an authenticated session (even a low-privilege one), you can enumerate sequential SAM/LSA RIDs (relative identifiers) and resolve them to account names:

netexec smb 10.129.8.141 -u 'svc_tgs' -p 'GPPstillStandingStrong2k18' --rid-brute \
  | grep SidTypeUser \
  | awk '{print $6}' \
  | awk -F '\' '{print $2}' > users.txt

Breakdown: --rid-brute brute-forces RIDs against the DC to discover existing accounts (users, groups, machines); grep SidTypeUser filters only user-type entries (drops groups and machines); the first awk keeps the DOMAIN\user field; the second splits on the backslash and keeps just the username. The result, users.txt, is a clean list of real domain accounts, useful for spraying or for steering the next step.

6. Kerberoasting against Administrator

With a valid account and an identified DC, the logical move is to look for accounts with an SPN (Service Principal Name): the KDC hands over, to whoever requests it, a TGS encrypted with the SPN owner's password hash — and that ticket is crackable offline without touching the DC again. On Active, surprisingly, Administrator itself has a registered SPN:

impacket-GetUserSPNs active.htb/SVC_TGS:'GPPstillStandingStrong2k18' -dc-ip 10.129.8.141 -request

GetUserSPNs lists accounts with an SPN, and with -request it also requests the TGS for each one, printing it already in crackable hash format:

$krb5tgs$23$*Administrator$ACTIVE.HTB$...

7. Cracking the TGS offline

I save the full hash on a single line (no stray line breaks) and confirm the file has exactly that one line before cracking:

wc -l admin.hash   # should read: 1 admin.hash

Option A — hashcat (mode 13100 = Kerberos 5 TGS-REP, etype 23):

hashcat -m 13100 admin.hash /usr/share/wordlists/rockyou.txt \
  -r /usr/share/hashcat/rules/best64.rule
hashcat -m 13100 admin.hash --show

Option B — John (alternative, very handy with rules):

john --format=krb5tgs admin.hash --wordlist=/usr/share/wordlists/rockyou.txt --rules
john --show admin.hash

The rockyou.txt wordlist together with the best64 rules (which mutate typical case, digits and symbols) is enough here. Cracking recovers Administrator's real password:

Administrator:Ticketmaster1968

8. Final access as Domain Admin

With Administrator's real password, the direct route to a high-privilege shell is Impacket's psexec, which creates a remote service over SMB:

impacket-psexec active.htb/Administrator:'Ticketmaster1968'@10.129.8.141

(Optional) access can also be validated by simply browsing shares as Administrator before launching psexec:

smbclient //10.129.8.141/Users -U 'Administrator%Ticketmaster1968'
cd C:\Users\Administrator\Desktop
type root.txt

On Windows, "root" equals the Administrator flag. Domain fully compromised. 🏴‍☠️

Vulnerability summary

PhaseComponentVulnerabilityImpact
ReconSMB ReplicationAnonymously readable SYSVOL shareAccess to Groups.xml
FootholdGroup Policy PreferencesReversible cpassword via public AES key (MS14-025)SVC_TGS credential
ReconRPC / RID cyclingRID enumeration with an authenticated low-privilege sessionDomain user list
PrivEscAdministrator SPNKerberoasting → offline TGS-REP crackAdministrator's password → Domain Admin

Lessons learned

  • Never use GPP to push credentials: the cpassword is reversible (public AES key); MS14-025 removed the feature, but old XML files with secrets still circulate in many environments that never cleaned up SYSVOL.
  • Review SYSVOL/Replication: don't leave GPO artefacts with secrets readable by any user, not even anonymous ones.
  • RID cycling is cheap enumeration: with just one low-privilege account you get the full domain user list; don't rely on username obscurity as a security control.
  • Kerberoasting: service accounts (and much worse, Administrator) with an SPN need long, random passwords — or, better, no SPN at all.
  • Segregate privileges: Administrator should never have a registered SPN; if an account needs one, it should be a dedicated, scoped service account.