Active - [HTB]

Introduction

Active is an easy windows machine from Hack The Box where the attacker will have to dig inside the available windows' shares in order to find a Group Policy Preference credential for a user account in the Active Directory. Finally, doing kerberoasting we are able to identify a service being run as Administrator where we can obtain its Administrator’s Kerberos 5 hash for a later password cracking, grating us an interactive shell.

Enumeration

As always, let's start finding all opened ports in the machine with nmap.

Then, we continue with a deeper scan of every opened port, getting more information about each service.

Enumerating the Windows shares with smbmap obtains that the share Replication is enumerable.

Looking inside there is a file Groups.xml at \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\.

Exploitation

This file contains the username active.htb\SVC_TGS and its encrypted password.

In order to decrypt the password we need to execute the following command.

Now, we have access to the Users share.

Inside it we can obtain the user flag in the directory \SVC_TGS\Desktop\.

Privilege Escalation

Because we have some domain credentials we can try kerberoasting using the tool GetUserSPNs.py

However, we have an issue due to the time difference between our machine and the kerberos service. In order to fix this problem we only need to execute the following commands.

Once fixed, we obtain the Administrator's TGS ticket in hashcat format.

Using hashcat we can retrieve the Administrator's password.

Finally, in order to obtain a reverse shell as "Administrator" we need to execute psexec.