jperezduerto.info
Active
Windows· Easy· Credential Access· Privilege Escalation
Summary
I accessed a world-readable SMB share that exposed a legacy Group Policy Preferences file containing a service account password encrypted with a publicly known key. After decrypting the credential with a freely available tool, I authenticated to the domain, enumerated service principal names, and Kerberoasted the domain Administrator account — cracking its ticket offline with a dictionary attack and achieving complete domain controller compromise.
Command conventions
The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.
export TARGET="<retired-instance-ip>"
export PASSWORD="<the-password-you-recovered>"
export PASSWORD2="<the-password-you-recovered>"
export PASSWORD3="<the-password-you-recovered>"Attack path — how the box was taken
1EnumerationAnonymous SMB Enumeration
Listed SMB shares anonymously and found a world-readable SYSVOL copy
The domain controller accepted unauthenticated SMB connections. Without supplying any credentials, I listed all available shares and discovered that 'Replication' — a legacy mirror of the SYSVOL Group Policy tree — was readable by anonymous users on the network.
Step 1 uses smbclient with the -N (no-password) flag against //$TARGET/Replication, confirming anonymous read access succeeded.
Exact commands 2
shell
List all shares via null session; look for READ permission on Replication.
$ nxc smb $TARGET -u '' -p '' --sharesshell
Alternative share listing without credentials.
$ smbclient -L //$TARGET -NFixRemove anonymous read access from all SMB sharesHigh
WeaknessThe 'Replication' share — a copy of the SYSVOL Group Policy tree — was readable by unauthenticated users, exposing the entire policy configuration (including credential files) to any host on the network without requiring a username or password.
FixRemove the Everyone and ANONYMOUS LOGON ACEs from the Replication share using 'icacls' or the Share and Storage Management console. Enable the 'Network access: Restrict anonymous access to named pipes and shares' policy (RestrictNullSessAccess = 1) via GPO. If DFS-R handles SYSVOL replication, decommission the legacy 'Replication' share entirely. Audit all shares quarterly with 'net share' and 'Get-SmbShareAccess' to confirm no share grants access to unauthenticated principals.
2Credential DiscoveryGroup Policy Preferences (GPP) Credential Exposure
Retrieved a Group Policy Preferences file containing an encrypted account password
Inside the publicly readable Replication share, I navigated the Group Policy object directory tree and retrieved Groups.xml — a file that Windows GPP uses to configure local accounts. The file stored the username active.htb\SVC_TGS and its password in a 'cpassword' field, encrypted with a symmetric key Microsoft publicly disclosed in 2012.
Step 1 command downloads active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Preferences/Groups/Groups.xml from the Replication share, containing the SVC_TGS cpassword entry.
Exact commands 1
shell
Retrieve Groups.xml directly to stdout; note the userName and cpassword attributes in the output.
$ smbclient //$TARGET/Replication -N -c 'get active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Preferences/Groups/Groups.xml -' 2>/dev/nullFixPurge all GPP cpassword entries from SYSVOL and prevent future creationCritical
WeaknessA Group Policy Preferences Groups.xml file stored the SVC_TGS account password in a 'cpassword' field encrypted with an AES key Microsoft published publicly in 2014 (MS14-025). An unauthorised user — authenticated or not — who can read SYSVOL can decrypt any cpassword to plaintext in milliseconds using freely available tooling.
FixInstall KB2962486 on all systems running Group Policy Management Console to prevent any new cpassword values from being written. Use the PowerShell function 'Get-GPPPassword' (from PowerSploit or manually) to scan all GPOs in SYSVOL for existing cpassword entries and delete them. Immediately rotate the password for any account whose credential appeared in a GPP file, as the duration of exposure is unknown. Repeat this audit after any new GPO is created.
3Credential AccessGPP CPassword Decryption (MS14-025)
Decrypted the GPP password using Microsoft's own published AES key
Microsoft published the AES-256 key used to encrypt all GPP cpassword values in security bulletin MS14-025 (2014). Anyone with the cpassword string can instantly recover the plaintext using standard tools. The decrypted password for SVC_TGS was <withheld>.
Exact commands 1
shell
Paste the cpassword value from Groups.xml; tool outputs plaintext '$PASSWORD2' immediately.
$ gpp-decrypt $PASSWORD4FootholdValid Account — Domain Credentials
Authenticated to the domain as SVC_TGS and read the user flag
With the recovered plaintext credential active.htb\SVC_TGS's password, I authenticated to the domain controller over SMB, browsed the Users share, and read the user flag from SVC_TGS's Desktop — confirming a valid, interactive foothold as a domain user.
Finding 1 proof-of-concept command: smbclient //$TARGET/Users -U 'active.htb/SVC_TGS%<withheld>' -c 'get SVC_TGS/Desktop/user.txt -' 2>/dev/null
Exact commands 2
shell
Confirm credentials are valid and enumerate accessible shares.
$ nxc smb $TARGET -u SVC_TGS -p $PASSWORD2 -d active.htb --sharesshell
Read the user flag -> <user.txt>
$ smbclient //$TARGET/Users -U "active.htb/SVC_TGS%$PASSWORD2" -c 'get SVC_TGS/Desktop/user.txt -' 2>/dev/null5Privilege EscalationKerberoasting (T1558.003)
Kerberoasted the Administrator account to obtain an offline-crackable service ticket
The built-in Administrator account had a Service Principal Name (SPN) registered — a configuration that allows any authenticated domain user to request a Kerberos service ticket (TGS) for it. The ticket is encrypted with the account's password hash and can be exported and cracked entirely offline, with no lockout risk and no further interaction with the domain controller needed.
Exact commands 1
shell
Enumerate SPNs as SVC_TGS and request TGS tickets; Administrator's encrypted ticket is written to admin_tgs.hash.
$ impacket-GetUserSPNs active.htb/SVC_TGS:$PASSWORD2 -dc-ip $TARGET -request -outputfile admin_tgs.hashFixRemove Service Principal Names from privileged and administrative accountsHigh
WeaknessThe built-in Administrator account had a Service Principal Name registered, making it eligible for Kerberoasting. Any authenticated domain user — including low-privilege accounts like SVC_TGS — can request a Kerberos ticket encrypted with the Administrator's password hash and attempt to crack it offline indefinitely.
FixRun 'setspn -T active.htb -Q */*' to enumerate all SPN registrations and remove any SPN assigned to privileged or built-in accounts (Administrator, Domain Admins members) that have no legitimate Kerberos service authentication requirement. For service accounts that genuinely need SPNs, migrate to Group Managed Service Accounts (gMSA), which use automatically-rotated 240-character random passwords that are computationally infeasible to crack offline.
6Credential AccessOffline Kerberos Ticket Cracking
Cracked the Administrator's Kerberos ticket offline using a common wordlist
The exported TGS ticket for Administrator was encrypted with a password weak enough to appear in a standard wordlist. Offline cracking recovered the plaintext password within seconds — no network traffic, no lockout, and no alert generated on the domain controller.
Exact commands 1
shell
Mode 13100 targets Kerberos 5 TGS-REP etype 23; recovers plaintext password '$PASSWORD3'.
$ hashcat -m 13100 admin_tgs.hash /usr/share/wordlists/rockyou.txt --forceFixEnforce long, random passwords on all privileged and service accountsHigh
WeaknessThe domain Administrator account used a short, dictionary-based password that was cracked in seconds once the Kerberos service ticket was obtained. Any password a human can remember is vulnerable to offline dictionary and rule-based attacks with no lockout protection.
FixSet a minimum 25-character passphrase or fully random password on all privileged accounts, stored in a Privileged Access Management (PAM) solution or Windows LAPS (Local Administrator Password Solution). Deploy Microsoft Entra Password Protection on-premises to block common words, patterns (including word+year combinations), and your organisation's name from being used as AD passwords domain-wide. Rotate privileged account passwords on a 90-day cycle or immediately after any suspected exposure.
7Full CompromiseRemote Code Execution — Pass-the-Password (PsExec-style)
Logged in as domain Administrator and captured the root flag
The cracked Administrator password provided unrestricted remote access to the domain controller. Using a remote-execution utility, I opened a SYSTEM-level shell, confirmed full administrative control, and retrieved the root flag — completing total domain compromise from an initially unauthenticated position.
Exact commands 2
shell
Opens a SYSTEM shell on the DC; spawns cmd.exe as NT AUTHORITY\SYSTEM.
$ impacket-psexec active.htb/Administrator:$PASSWORD3@$TARGETshell
Alternative: read root flag non-interactively -> <root.txt>
$ impacket-wmiexec active.htb/Administrator:$PASSWORD3@$TARGET 'type C:\Users\Administrator\Desktop\root.txt'Techniques used
New to these ideas? Learn the concepts in Hack & Learn.