Active
#ActiveDirectory #Default_Credentials #Weak_Permissions #Anonymous_Access
Active is an easy-rated Windows machine from HackTheBox, created by eks and mrb3n. In the current post, my IP is 10.10.14.210, and the target IP is 10.129.38.41
Recon
The first steps are about getting basic information about the target, by using nmap and searching information from the website.
ping -c 1 10.129.38.41PING 10.129.38.41 (10.129.38.41) 56(84) bytes of data.
64 bytes from 10.129.38.41: icmp_seq=1 ttl=63 time=202 ms
--- 10.129.38.41 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 202.335/202.335/202.335/0.000 msWhat a weird TTL for a Windows Machine...
nmap -p- --open -sS --min-rate 5000 -vvv -n 10.129.38.41Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE REASON
53/tcp open domain syn-ack ttl 126
88/tcp open kerberos-sec syn-ack ttl 126
135/tcp open msrpc syn-ack ttl 126
139/tcp open netbios-ssn syn-ack ttl 126
389/tcp open ldap syn-ack ttl 126
445/tcp open microsoft-ds syn-ack ttl 126
464/tcp open kpasswd5 syn-ack ttl 126
593/tcp open http-rpc-epmap syn-ack ttl 126
636/tcp open ldapssl syn-ack ttl 126
3268/tcp open globalcatLDAP syn-ack ttl 126
3269/tcp open globalcatLDAPssl syn-ack ttl 126
5722/tcp open msdfsr syn-ack ttl 126
9389/tcp open adws syn-ack ttl 126
47001/tcp open winrm syn-ack ttl 126
49153/tcp open unknown syn-ack ttl 126
49154/tcp open unknown syn-ack ttl 126
49155/tcp open unknown syn-ack ttl 126
49157/tcp open unknown syn-ack ttl 126
49158/tcp open unknown syn-ack ttl 126
49162/tcp open unknown syn-ack ttl 126
49166/tcp open unknown syn-ack ttl 126
49168/tcp open unknown syn-ack ttl 126And then we try to get the version and run basic scripts with Nmap in each port.
Quite a few open ports! Normal in Windows... now, we are interested in the port that manages the SMB environment; these are ports 139 and 445. Therefore, we will use basic tools for their exploration.
SMB Enumeration
The only relevant information comes from "Share Enumeration," where we list the shared resources and determine which ones are visible to the Anonymous user; in this case, it is "Replication." Now, we will review it using smbclient or smbmap.
Exploring Replication
With smbclient, you can explore manually, but with smbmap, you can recursively extract all the files that you have permission to read.
From the entire list of folders and files, the only thing that seems relevant is "Groups.xml." Let's access and explore the file.
The Groups.xml file appears to be a log document created when a user is added with a group related to Group Policy Preferences (GPP). This is valuable information because, in this context, to use the active.htb user, we need to decrypt the password.
Password Decryption
Since it is a cpassword from GPP (Group Policy Preferences), we can use the following method to decrypt it:
Enumeration with active.htb
Now that we have a username and password, we'll use enum4linux again to see what capabilities we have with these credentials.
From this list, "Users" seems to be the most interesting... As usual, the flag is likely to be on the desktop. It is important to keep in mind that to log in, you need to use the group associated with the password. In this case, the group is "SVC_TGS."
Within the Impacket suite, there's a script called GetUserSPNs.py that is very useful for finding users vulnerable to Kerberoasting. This attack targets Service Principal Names (SPNs) associated with user accounts in Active Directory that are used for Kerberos authentication. {password: GPPstillStandingStrong2k18}
Now we just need to decrypt the hash. The good news is that the script outputs the data in a format compatible with Hashcat, making it easier to crack the hash.
Great! With the password "Ticketmaster1968," we can now check what the admin account has access to—potentially everything. The next step is to access the SMB share and extract the flag.
With admin status confirmed, you have elevated privileges. When exploring the SMB shares, the $C share represents the root of the C: drive, which is indeed the most important and often contains critical files, including potential flags or sensitive information.
Alternativa
With the credentials confirmed as valid, you can use them to gain shell access on the target system. Given the password "Ticketmaster1968," you can attempt to connect via different methods like SMB or WinRM to obtain a shell.
Last updated