Active
Active is a short and easy Windows box. This box involves SMB share pillaging to get initial access, then some kerberoasting for the administrator account.
This box was very short and sweet but can help you understand some important skills.
Contents
Tools Used
nmap – Network mapping tool, used to enumerate a device. ntpdate – Network time protocol utility. netexec – A great Swiss army knife of a tool, in this case I used it to spider shares but it has a lot of other functionalities. gpp-decrypt – A tool for parsing Group Policy Preferences (GPP) XML files and decrypting passwords contained inside. impacket suite – A collection of Python scripts for interacting with network protocols on a Windows machine.
nmap scan
The target has multiple ports open consistent with a Windows box. I see Kerberos, NetBIOS, LDAP, SMB, WinRPC, among others. The device reports that it is part of the domain active.htb.
Because this box is using Kerberose, I synchronize my system time with it using ntpdate.
I start a UDP scan and begin enumerating SMB, looking for accounts or some kind of access
The machine allows null authentication, which means we can attempt to access some shares. Using the null authentication I can connect to the Replication share only, it seems.
Scraping the Replication share, I find a username and an encrypted password for the account SVC_TGS in a Group Policy Preferences (GPP) file. I looked up some information on hacktricks.wiki and find that in the past there was a method of deploying custom local administrator accounts on machines this way. The wiki also states that the password is encrypted with AES256, but the default key is publicly documented.
Although hacktricks.wiki says that it can be decrypted “by any authenticated user”, it seems like you don't need any additional access outside of getting the initial encrypted password. I ran gpp-decrypt, which uses the default key, and got a password for the service account.
With an authenticated account, we can start enumerating some more.
Account Enumeration
The svc_tgs account has read access to a few other shares that we can pillage. I don't find much else, but I do see that SVC_TGS is the only other account on the box, so I know my next jump is to administrator.
Privilege Escalation
I do some scanning with ldapsearch, and we find a servicePrincipalName for both Administrator and krbtgt, but since krbtgt is a special service account we cannot kerberoast it.
I use impacket-getuserspns to kerberoast the administrator account, run it through hashcat, and get the password to the account.
Lessons Learned
I learned about the GPP file, which is something I had not known. I think its important to realize that a lot of boxes that you do will have things that you don't recognize, so knowing when and how to research that is important. I use hacktricks.wiki a lot and search keywords to find information.
Thanks for reading!