Hack The Box · Windows Domain Controller
Active
| Name | Active |
|---|---|
| Release date | 28 July 2018 |
| Retire date | 12 August 2018 |
| OS | Windows Server 2008 R2 |
| Difficulty | Easy - Retired [0] |
| Rated difficulty |  |
| Radar graph |  |
| First blood — user | m0noc — 00 days, 03 hours, 05 mins, 37 seconds |
| First blood — root | no0ne — 00 days, 04 hours, 06 mins, 00 seconds |
| Creators | eks and mrb3n |
| CherryTree file | Download and remove the .txt extension |
Enumeration
Start with a standard service and version scan:
nmap -sC -sV -oA ./Active 10.10.10.100The host exposes DNS, Kerberos, LDAP, SMB, and multiple RPC services. Combined with the Windows Server 2008 R2 fingerprint, this clearly identifies a domain controller for active.htb.
Anonymous SMB access exposes the Replication share. Navigating through the policy folders reveals a Groups.xml file containing a Group Policy Preferences cpassword value for active.htb\SVC_TGS.
<Properties action="U" ...
cpassword="edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ"
userName="active.htb\SVC_TGS" />GPP credential recovery
The published Group Policy Preferences AES key allows the password to be decrypted. Running the Ruby recovery script produces:
GPPstillStandingStrong2k18
User access
Using SVC_TGS with the recovered password grants access to the Users share. The user flag is located on the service account's desktop.
Kerberoasting
Add the domain controller to /etc/hosts, then request service tickets with Impacket:
10.10.10.100 active.htb dc.active.htb
python GetUserSPNs.py active.htb/SVC_TGS:GPPstillStandingStrong2k18 -requestThe request returns a Kerberos TGS hash for the Administrator account. Crack it with Hashcat mode 13100:
hashcat -a 0 -m 13100 administrator.tgs rockyou.txtThe recovered Administrator password is Ticketmaster1968.
Administrator access
Authenticate to SMB as Administrator using the cracked password and retrieve the root flag from the Administrator desktop.
