Active

Executive summary — Active is an Active Directory classic where the flaw isn't an exotic exploit but misconfiguration. The Replication share (replicated SYSVOL) is anonymously readable and contains a Groups.xml with a cpassword (GPP): Microsoft published the AES key, so it decrypts to SVC_TGS's credentials. With that account we enumerate the domain (RID brute) and Kerberoast Administrator — which has an SPN registered by mistake —, crack its TGS offline and log in as Domain Admin. Path: GPP → SVC_TGS → Kerberoasting → Administrator.

Resumen ejecutivo — Active es un clasico de Active Directory donde el fallo no es un exploit raro, sino mala configuracion. El share Replication (SYSVOL replicado) es legible de forma anonima y contiene un Groups.xml con un cpassword (GPP): Microsoft publico la clave AES, asi que se descifra y da las credenciales de SVC_TGS. Con esa cuenta enumeramos el dominio (RID brute) y hacemos Kerberoasting contra Administrator — que tiene un SPN registrado por error —, crackeamos su TGS offline y entramos como Domain Admin. Recorrido GPP → SVC_TGS → Kerberoasting → Administrator.