Active

Join The Best Hacking Community Worldwide | Hack The Box

Over half a million platform members exhange ideas and methodologies. Be one of us and help the community grow even further!

www.hackthebox.com

Nmap Scan

To begin, let's run an Nmap scan to identify the open ports and services on the target machine.

Key results from the scan:

• The server appears to be running Windows Server 2008 R2 SP1.
• Several important ports are open, including DNS (53), Kerberos (88), LDAP (389), SMB (445), and RPC services.

Adding Host Entry

Next, add the target's domain to our /etc/hosts file to make subsequent interactions easier:

echo "10.129.1.129    active.htb" | sudo tee -a /etc/hosts

Enumerating SMB Shares

How many SMB shares are shared by the target? 7

To determine how many SMB shares, use smbclient:

Results:

• A total of 7 shares are available, including Replication and Users.
• The Replication share allows anonymous read access.

You can also run nxc smb to enumerate shares

What is the name of the share that allows anonymous read access? Replication

Accessing the Replication Share

Which file has encrypted account credentials in it? Hint: It's an XML file. Groups.xml.

Method 1:

To dig deeper into ‘Replication’, I unleashed Netexec’s spider module. This handy tool crawls through the share, much like a spider exploring every nook and cranny of its web. It downloads files as it goes, which means I could sit back and let it gather all the goodies.

Method 2: Alternatively, you can access the share using smbclient, enable recursive listing and search for .xml files:

Get Groups.xml file

Decrypting the Password

Upon opening the Groups.xml we can see an encrypted cpassword for the user active.htb\SVC_TGS

The Groups.xml file is identified as a Group Policy Preferences (GPP) file, which stores passwords encrypted with AES-256. We use the gpp-decrypt tool to retrieve the password:

└─$ gpp-decrypt "edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ"
GPPstillStandingStrong2k18

What is the decrpyted password for the SVC_TGS account? GPPstillStandingStrong2k18

Validating Credentials

With the username SVC_TGS and the decrypted password, validate access using nxc smb:

└─$ nxc smb active.htb -u 'SVC_TGS' -p GPPstillStandingStrong2k18               
SMB         10.129.1.129    445    DC               [*] Windows 7 / Server 2008 R2 Build 7601 x64 (name:DC) (domain:active.htb) (signing:True) (SMBv1:False)
SMB         10.129.1.129    445    DC               [+] active.htb\SVC_TGS:GPPstillStandingStrong2k18 

The credentials are valid, and we can now access additional shares, including the Users share.

Retrieving User Flag

Using smbclient, we connect to the Users share to retrieve the user.txt file.

Navigate to the SVC_TGS\Desktop directory, find the user.txt and download it.

The User Flag is

└─$ cat user.txt      
43d6c8971545f31bf3e0dc8fea6afcfd

Kerberoasting

To escalate privileges, we attempt a Kerberoasting attack. Before proceeding further, we need to ensure our system clock is in sync with the Domain Controller, as time synchronisation is crucial for handling Kerberos tickets. We use ntpdate to synchronise our clock with the DC:

└─$ sudo ntpdate active.htb   
2024-10-21 22:47:07.748134 (-0400) -0.512112 +/- 0.077772 active.htb 10.129.1.129 s1 no-leap
CLOCK: time stepped by -0.512112

We then use Impacket's GetUserSPNs.py to locate Kerberoastable users:

Which service account on Active is vulnerable to Kerberoasting? Administrator

A TGS-REP hash for the Administrator account is found. Save this hash to a file and use Hashcat to crack it.

To find out the hashcat module number, run:

The cracked password is: Ticketmaster1968

Gaining Administrative Access

With the Administrator credentials, we use Impacket's psexec to gain a shell as nt authority\system:

Once connected, we retrieve the root.txt flag from the Administrator's desktop:

References

• https://medium.com/@sanskarkalra121/cracking-active-unmasking-the-gpp-passwords-and-roasting-my-way-to-admin-access-ff439b9995c9