Speaker A
what's going on YouTube this is if second we do an active from hack the box which was a really fun box that involved attacking an Active Directory server it starts off with just using SMB NOLA sonication or anonymous logon to pillage
IppSec walks through the HackTheBox 'Active' machine: anonymous SMB enumeration, finding GPP groups.xml credentials, Kerberoasting via BloodHound, and gaining domain admin.
Key Takeaways
- Anonymous SMB access and readable shares on a domain controller can expose sensitive Group Policy files
- Group Policy Preferences passwords (cpassword) are reversibly encrypted with a publicly known key and must never be stored
- Accounts with Kerberos pre-authentication disabled or service principal names exposed allow offline hash cracking
- Weak passwords make offline cracking of Kerberos hashes feasible, leading to full domain compromise
- Enumeration with nmap, SMB tools, and BloodHound is central to mapping Active Directory attack paths
What the video covers
- Starts with an nmap scan of the Windows Active Directory target, identifying DNS, Kerberos, LDAP and SMB services and the domain name active.htb
- Uses anonymous/null SMB authentication to enumerate file shares, finding the Replication share readable without credentials
- Locates a groups.xml file in Group Policy Preferences containing an encrypted cpassword for a local account
- Decrypts the GPP password using the publicly known AES key (gpp-decrypt), obtaining valid domain credentials for a low-privileged user
- Uses the low-privileged account to query Active Directory with ad-users and enumerate accessible shares via SMBMap
- Runs BloodHound to map Active Directory relationships and identify attack paths
- Discovers the Administrator account is vulnerable to Kerberoasting / AS-REP style attacks due to Kerberos pre-authentication settings
- Requests the Administrator's Kerberos ticket hash with GetNPUsers/GetUserSPNs and cracks it offline with hashcat and rockyou
- Uses the recovered administrator password to gain domain admin access on the domain controller
- Demonstrates troubleshooting such as DNS configuration, time sync requirements for Kerberos, and fixing mistyped commands
Chapters
- 00:00Introduction to the Active machine
- 01:14Nmap scanning and service identification
- 02:41Enumerating SMB and DNS
- 04:06NSE scripts and deeper SMB scanning
- 05:54Finding groups.xml in the Replication share
- 07:28Decrypting the GPP password
- 09:48Querying Active Directory and BloodHound collection
- 12:06Kerberos attack and cracking the administrator hash
Full Transcript — Download SRT & Markdown
Speaker A
the file server we discovered the group policy scripts which contains a groups XML file and groups dot XML is Windows owed way to handling local accounts to the group policy since I believe Windows 2012 Microsoft doesn't allow it but
Speaker A
never now and then you come across a server that just has old group policies that ding cleaned up from that group start XML we get low privileged user on the domain without any interactive rights however we can just query Active
Speaker A
Directory for interesting information such as local users access to file shares as that low privileged user and we can also do things like run bloodhound which helps us enumerate the Kerberos table users Kerberos is an attack where I think it's if pre
Speaker A
authentication is enabled for the account then you can just clear the Active Directory get the hash for the account then you can crack that hash and if you crack it you get that access to that user through a bloodhound we
Speaker A
discovered the administrator user was Kerberos table and we crack his hash and get admin to the domain so let's jump in and do this box as always we store for the N map so n map - SC for D for
Speaker A
scripts SV enumerate version 0 a I'll put all formats planning and map directory and call it active then the IP address which is 10 10 10 100 this can take some time to run so I've already run it looking at the results when you
Speaker A
see a whole bunch of ports open the very first thing is DNS is open on port 53 it is running Microsoft DNS version 6-1 70601 70601 is the key thing there meaning it's a Windows 2008 r2 box or
Speaker A
Windows 7 service pack 1 if was in the 9000 range there would be Windows 2012 or Windows 10 I believe and if it was above 9000 s then it's a Windows 2016 so nmap does identify this entire string as
Speaker A
Windows Server 2008 r2 Service Pack 1 the next thing we see is Kerberos listening on port 88 and soon as you see Kerberos I do look for LDAP and upon saying DNS Kerberos and LDAP I assume I'm on a Windows Active Directory box we
Speaker A
can see odep is giving up its domain name as active HDB so I'm gonna edit my host file real quick and we're gonna add active HTTP here and I'm also just gonna add HTTP so both of those go to 10 10 10 100 and
Speaker A
then at the Kerberos check we do see the server time is 2 that what the time is so we should make sure a box is within a minute of this time and then let's see what else do we have here we have SMB
Speaker A
open on port for 4 or 5 only enough we don't see any shares open and generally you should see shares on a domain controller like sis wall at least listing them because I believe you have to have some anonymous shares open for
Speaker A
Active Directory to work or at least that's the default configuration so that's odd I'm gonna poke at SMB a little bit more but first I am curious what the hostname of this box is we have the domain as active htb but we don't
Speaker A
know what the actual hostname is so I'm gonna do a nslookup we're gonna set the server to 10 10 10 100 I'm gonna ask the server who is one 27001 it's just gonna respond with localhost so next thing we can do is ask the
Speaker A
server who is server 10 10 10 100 and it looks like we're gonna get a timeout so I'm going to do DNS recon and we're gonna scan the entire 10 subnet so we'll do dash D to set the domain and
Speaker A
that will be 10 10 10 100 and then - are the range so 1000 0 / 8 and we'll just let this run the next thing I want to do was poked at SMB since we saw a port for
Speaker A
4 or 5 open it and I thought we should see some open shares so let's look at what NSE scripts are ran with nmap so we do locate - R and specify all files that end with NSE and this lists all the nmap
Speaker A
scripts the next thing we want to do is execute a command against every result so we do X args and then grep for categories and this is gonna show us all the NSE scripts and what categories they belong into so we had done a nmap scan
Speaker A
for what was it default and version and then we've also specify SMB default version and then on that let's grep for SMB like this so we can see the for M map scripts that were rim or is SMB OS
Speaker A
discovery SMB security mode SMB to security mode is an SMB two time and we just look at all our and map scripts for SMB we can see there's a whole slew of them so let us go and look at if instead
Speaker A
of doing default inversion we did default version and safe and we can see doing safe is going to allow us to see SMB LS SMB and new services so we could just get a lot more so let's do and map
Speaker A
- - script safe - P 4 4 5 10 10 10 100 and see what this returns well that goes I'm going to go back and look at the DNS recon and we'll also just rename this window - DNS recon and this should
Speaker A
finish relatively soon and this is why I always preload the nmap scripts because this does take some time sometimes so we'll check with the time Oh looks like it's close to finished it's undergoing script scan now so hopefully it'll be
Speaker A
finished in the end map has now finished and we don't really get much more information we see SMB a new service is failed and wants us to use - D - debug and outside of that everything else is
Speaker A
just saying SMB v2 is required so there's nothing else that nmap really tells us if we wanted to we could debug this SMB a new services with a map - - script then - p4 4 5 and specify 10 10
Speaker A
10 100 and then - d4 debug and we'll see that this fails it right after trying to establish a SMB v1 connection so it looks like this script just doesn't support SMB v2 after this I decided to just use like SMB client - capital L -
Speaker A
list shares and then we can just 10 10 10 100 and then when asked for a password just hit enter it's gonna do a null authentication also known as anonymous authentication and we can see all the shares that are allowed so this
Speaker A
is what we're expecting to see because it's domain control we should see things like IP see dower and sysvol so there is a tool called a Noom for linux if we specify an IP we will get a bunch of
Speaker A
information I generally don't like using this tool because to me it feels like this tool just hasn't been updated a long time maybe it has but it does a lot of things that just normally error out nowadays the tool I like running is
Speaker A
called SMB Matt and then we can specify - h4 host and - 10 10 10 100 and then this just lists all the file shares and then what permissions we have because if we had tried to SMB client 10 10 10 100
Speaker A
slash users and hit enter we get anonymous login was successful but access denied if we try that with like the replication directory we get an anima slog and successful and a prompt we go back to our noon for Linux we can
Speaker A
just see this isn't the most user friendly output we have getting printer info failed recycling or IDs groups just a bunch of information with tons of denied we see the file shares here it doesn't tell us what is open or closed
Speaker A
so I just don't really care for a noob for Linux compared to SMB map there are other features of SMB map if we do dash H we can see we can download files we can search the files contents for things
Speaker A
so we could search all files with some that contains password we can do - capital a and this will look for files with foul names so it actually recursed is through all the directories so if you do - capital r it recurs through every
Speaker A
directory if you do lowercase R and just list the route if you have admin user you can do dash X to execute commands so I just like that a little bit more so we can try SMB map - our
Speaker A
replication and then - H 10 10 10 100 and this will list the contents of the replication directory and if we look through this well we will see groups XML and that is a group policy file where local account information is stored if
Speaker A
you want to push out a local admin before Windows 2012 people generally would do it in group policy Microsoft has removed that I think in 2012 maybe was removed in 2008 probably 2012 since this is a Windows 2008 box but since
Speaker A
2012 this has been removed and now microsoft recommends using laps I think that's local account policy something but that's random passwords per account doing it in group policy and this file is readable by everyone and it's stored in a reversible format so we
Speaker A
do - capital a groups XML and then - Q is gonna be quiet so it's not going to list every single file it's just going to tell us if it ends up downloading something and here we go we have match
Speaker A
found and it's downloading the file groups XML we do LS it's not in our working directory so I'm going to do update DB to update my locate command because there's now a new file I'm going to locate groups XML
Speaker A
and we can see SMB map stores things in user share so if we do a less against this we can see this is for the account active HDB backslash SVC TGS and C password this is the encrypted password
Speaker A
so we can just do GP p - decrypt specify that string and we get the password is GP p still standing strong 2018 or 2 K 18 if you don't have any of these tools these were all just in
Speaker A
Callie's repo so if I do AB search GPP decrypt it should come back and say that's there and then we could also do SMB map so that is how you install them just do app install and then the tool
Speaker A
name so we now have cadential x' so I'm going to do V creds and the user was SVC underscore TGS so do this basis in SVC underscore TGS just for documentation purposes and if we wanted to do this
Speaker A
without SMB map the easiest way I find is SMB client / / 10 10 10 100 backslash the share which is replication and then we can do a.m. get star and if we just do that we get no such file listing so
Speaker A
we'll have to set recurse to on and then if we do that it's going to give us a bunch of annoying prompts so let's redo this set recurse to on and set prompt to off and just do em get star and now it's
Speaker A
going to download every file so if we do CD active HD b we can do fine dot and we can also specify - type F and we can see the group policy file this way as well so now we have users on this box so we
Speaker A
can do things like get ad users dot PI and this is part of in packet if you don't have it get impacted off of github you may be able to install it from the Kali repo impact it's one I like doing a
Speaker A
manual install on and then do pip install - our requirement text and setup I install I believe is the install instructions but install and packet and then you can probably do get 80 users pi - H for help and then we can specify we
Speaker A
want - all and the target is going to be active HT b and then let's see - tcpip 10 10 10 100 and that's active DHT b / SVC underscored TGS and the password was g PP still standing strong
Speaker A
so that's why I always put passwords and files because it just makes it easy we have an error message I don't know what that was about that should have worked it's not shy the whole name oh wait did
Speaker A
I have - usually there before I don't think I did let's see - user oh no - user is specifying a single user to get information from so let's see does just want to use name at the end domain should be specified
Speaker A
active HT be okay so for this it is very picky about how the arguments are it wants the user name to be at the end so we ran this command oh no they work that time I'm not sure
Speaker A
exactly what happened before let's see do I still have my history oh I must have pasted it invalid password to get that error message yeah so I must have just fat-fingered the password a fat thing of the paste command so we just
Speaker A
have four users on this box SBC TGS administrator guests and the Kerberos user we could try like a PS exec and if we're admin on the box PS exec will work so we can do PS exec active dot h TB SVC underscore at TGS at 10 10
Speaker A
10 100 put the password in and I've copied the Kerberos thing to my clipboard so let's copy this do that PS exec command again and it still fails because none of the shares are writable because we are not a admin user we could
Speaker A
go back and look at SMB map again because we do have credentials so we can specify - you active dot h DB / sv c TG s - p the password GP p still standing strong - k18 and then - H 10 10 10 100
Speaker A
and failed let's try double backslash do I have the password wrong let's just copy it go up and paste this in failure let's do SMB map - H is it like a domain flag so where is user specified up here
Speaker A
- D is the domain name so let's try - u sv c TGS and we'll do - D active HD B and there we go so now we have access to a few more shares we could do the same
Speaker A
thing we did last time with - R and specify users and now we're going to list all the files this user has access to and we could go through all this the only real key thing is getting that user
Speaker A
that text file everything else is just default on the box so we have a user we can't PS exec because he's not an admin we could try things like checking PowerShell remoting but generally the first thing I do with user creds is try
Speaker A
to bloodhound the box and to do that we have to kill our VPN session because I'm gonna launch a VPN session on Windows because just doing things from Windows sometimes is easier than doing things from clinics so let's switch over to our
Speaker A
Windows box and we will connect to the VPN so I have Open VPN installed on my windows box as well connect and it's going to load the hack the Box VPN if I do a ping against 10 10 10 100 which is
Speaker A
active to verify we are connected we do get responses back so the next thing I want to do is a run as slash net only and what this does is just creates a session doesn't validate the user against the local box it just always
Speaker A
accepts it and then Microsoft tries to do it's single sign-on magic passing ntlm hashes it used the one you specified and the net only thing so we could verify this by just doing slash user please subscribe and then run
Speaker A
command and enter and it opens up a new session saying we're running as please subscribe and that user does not exist on my box so if we do net user we see please prescribe is certainly not there so let's do the same
Speaker A
thing except for the user specify active HT be back slash SVC underscore TGS and for the password specified GPP still standing strong to k18 so now we have running as active eh to be that user and we can verify by doing a dir against 10
Speaker A
10 10 100 slash users and we get a file listing because we were authenticated if we try the same thing against a other window where we were not authenticated will get using that password is incorrect so from here we
Speaker A
should be able to just drawn bloodhound against the domain since we got that token to authenticate against their main so let's go back to our Linux box go over here and let's set it to copy bloodhound so the first thing I want to
Speaker A
do is go in bloodhounds directory do get pull and if you've never used bloodhound before check out the real video or AEL because I go into setting all this up but we'll go into in jesters and do Python - em simple HTTP server go back
Speaker A
to a Windows box and let's download this so let's download 172 1610 182 that is my Linux is boxes IP address if we do if config we can see EADS ero is that IP so let's download this file save it in
Speaker A
downloads and here I can do CD users upset downloads and now we got show pound so if we do shut pound - H we can see what file options we have we'll want to do collection method all we all set
Speaker A
to specify the domain name and then we'll also want to specify let's see probably the domain controller with specifying domain name and domain controller because the machine we're running this from is not the main joined so bloodhound won't know how to pull it
Speaker A
without that so - see all - D active HDB - - the domain controller 10 10 10 100 and we get LDAP connection test failed can't contact domain so I'm gonna do test net connection might not in PowerShell
Speaker A
I'm not PowerShell let's do that dir command to make sure we still got a ticket 10 10 10 100 slash users we do so let's do test net can action computer name 10 10 10 100 - port 389 which is LDAP and it's testing and
Speaker A
we get TC piece test exceeded true so the port is listening next thing I'm going to do is let's copy this bloodhound command and paste it let's open up Wireshark go to my VPN adapter let's make sure I'm seeing
Speaker A
traffic okay so I'm seeing all the traffic I'm connected to I'm sniffing the right adapter so now let's run that pound command again and we're not getting any response we're not seeing anything happen so let's go into our
Speaker A
network configuration this change adapters and now let's set our DNS server to be 10 10 10 100 and see if this makes any difference because I'm guessing it's going out DNS of our main neck and not our VPN neck do this again
Speaker A
I don't see anything we can kind of validate that by just doing an NS look up and we see the server address is 172 16 10 1 so let's try changing this mix IP address to be DNS is 10 10 10 100 so
Speaker A
my DNS should always go out and use active as the DNS server running this again and we're still not sending any requests down oh there we go so now we're doing a bunch of requests is this it up local I think
Speaker A
working I'd expect to see more network traffic though so we'll give this some time to see what happens there we go we stirred an enumeration of active htb and I guess we're sure it's just not seeing it or it's just going extremely slow
Speaker A
let's see stop connect this one start it says it's done and compressed files so I'm gonna stop doing Wireshark I'm not sure exactly what was happening maybe I was sniffing on the wrong interface by going to downloads I do see a dot zip file
Speaker A
that says boy down ran so it looks like everything's good so let's copy this back to my box and we have it copied here I just had done some VMware magic and pause the video to copy the file
Speaker A
it's just easiest to copy by copying to my host then copying it to this VM so I have the file in slash root you can see bloodhound zip so the first step to running bloodhound is we got Stewart
Speaker A
neo4j and then we can just do oh it went to the background sweet hop bloodhound and then bloodhound - Linux x64 execute bloodhound and then we'll get this big screen and if it's white just press f5 to refresh or maybe it's control our
Speaker A
control artery fresh and should come there we go and we're in bloodhound so let's go here drag and drop the file into bloodhound and now it's processing and once this finishes processing we should be able to just do standard
Speaker A
searches and find what we want so the first thing I do is type like SBC TGS and the target node domain admins and we don't have any data return for that query so let's go look at what else we
Speaker A
have see common queries let's try to find shortest paths to domain admins we just got that administrator user we can shortest path on Kerberos table users select domain active htb and it's saying the user administrator is Kerberos table
Speaker A
which means we should be able to do get user SPN I think yeah get users SPNs and this is another impact tool so if you don't have it go install impact and let's do - requests so we're going to do
Speaker A
all users we could do request - users specify administrator then we want to specify - DC IP 10 10 10 100 and then the last thing we want to specify is the user name and it looks like it's just at
Speaker A
the end as target so targets domain slash user so active HDB SVC underscore TGS and password is GPP still standing strong - k18 and it's taking a while oh I have to disconnect the VPN so go to windows disconnect this go back to my
Speaker A
Linux and let's connect this Open VPN okay and while we're waiting for it to connect let's just put this in a clipboard okay so run this again specify the password and now we have Kerberos stood the administrative password we can
Speaker A
see krbtgt s 23 so if we go in Google hash cat example hashes and once this loads we'll be able to search for TGS 23 and see what format we want so it's mode 13 100 KB TGS 23 I think
Speaker A
there's a few other that hash Katmai craft nope just that one so let's go back to a terminal copy this I'm going to SSH into my cracking machine you could just do this from the VM I don't because I don't like cracking from a VM
Speaker A
and it's also very laggy when I'm trying to record a video while cracking on the same machine so that's why I always do it remotely and I have it in the hashes file let's call this active HDB paste
Speaker A
this and now we can do hash get em 13100 hashes active HDB and the word list i'm going to use is just Drock you and i mistyped it I didn't do dot slash so now once this initializes it should crack
Speaker A
relatively quickly there we go we have the password as Ticketmaster 1968 so I can go back and we can do PS exec active eh TB was it / Ticketmaster at 10 10 10 100 password about that activity should
Speaker A
be slash administrator and then put the password as Ticketmaster and now we are running a system so we can go into users administrator desktop and get the flag if we wanted to so that is the box hope you guys enjoyed it take care and I will
Speaker A
see you all next week
Topics:HackTheBoxActive DirectorySMB enumerationGPP groups.xmlKerberoastingBloodHoundnmappenetration testingprivilege escalationCTF walkthrough
