Saturday, February 2, 2019



- Layout for this exercise:


The goal of this exercise is to develop a hacking process for the vulnerable machine Active, what is a retired machine from the Hack The Box pentesting platform:


Active's IP is

- Scanning with Nmap:

- So we have a Microsoft Windows Server 2008 R2 SP1 running an Active Directory with a domain active.htb

- Also, as we will see later it is of crucial importance the fact that Active has a Kerberos server running at port 88.

- Because port 445 is open we run enum4linux to enumerate SMB and detect potential shared folders:

- The share Replication allows Anonymous login, and it is probably a replication of SYSVOL

SYSVOL stores the Group Policy Preferences holding information about users and groups of the network, so it will be a promising vector attack.


- Let's access /Replication with smbclient and Anonymous login:

- Listing content:

- Inside Policies there are two folders:

- Going with the first one:

- Inside /MACHINE/Preferences/Groups there is the file Groups.xml associated with the Group Policy Preferences (GPP):

- Also, /Replication 
could be explored recursively in this way:


- Anyway, downloading and reading Groups.xml:

- So we have found the username and the cpassword atributes.

cpassword is the name of the attribute that stores passwords in a Group Policy Preferences item:

- Let's store these credentials for later usage:

- The script decrypts local user password cpassword:

- Applying over cpassword:

- Connecting again with smbclient, now with the recently achieved credentials:

- Listing content:

ldapsearch and this complicated command yields active accounts for Active Directory:

- Also, is useful to enumerate the Active Directory user accounts:


- Going to the user SVC_TGS home folder:

- Getting and reading user.txt we are able to read the 1st flag:


- However, access to the Administrator home folder is denied, so we need Privilege Escalation:

- The Nmap scan yielded the result that Kerberos service was running at port 88, as we saw before.

- The Kerberoasting attack was the subject of Tim Medin’s presentation Attacking Microsoft Kerberos: Kicking the Guard Dog of Hades at Derbycon 2014.

- The attack involves an effective method that allows normal domain users to get their hands on credentials for service accounts. 

- This attack is most likely to succeed when service accounts have weak passwords.

Kerberoasting works by extracting the hash of the Kerberos TGS (Ticket Granting Service) ticket reply, what is encrypted with the NTLM password hash of the account.

- Kerberos uses Service Principal Names (SPN) to identify an account associated with a service instance.

- The Python script is able to extract hashes of Service Principal Names that are associated with normal user accounts:

- Downloading the script and giving execution permissions:

- Options -request and -dc-ip will be used: 

- After launching the hash for user Administrator is extracted:

- Storing the hash at a text file:

- Now, to decrypt the hash it could be used both John The Ripper and hashcat (locally or online):

- Finally  we have a decrypted password Ticketmaster1968 for the Administrator:

- The Metasploit psexec exploit is able to get a System shell:

- An alternative to Metasploit for getting a System shell is the Python script


- Reading root.txt: