Active

Mon, 22 Jun 2026 00:00:00 +0000

Introduction

Active is an easy Windows box and one of the best “first real Active Directory” machines on the platform, because it teaches two techniques you will use on almost every AD engagement: recovering a Group Policy Preferences (GPP) cpassword, and Kerberoasting.

The chain is short and entirely credential-driven. There is no SSH, no WinRM, no RDP, so from the very start we know we are not getting an interactive shell the easy way; everything happens over SMB and Kerberos. Anonymous SMB access lets us read the Replication share, which is an exposed copy of SYSVOL, and buried in it is a Groups.xml file with an encrypted password. Microsoft published the AES key that encrypts these years ago, so decrypting it is instant, and it hands us the svc_tgs account. From there, the Domain Administrator account has been misconfigured with a Service Principal Name, which makes it Kerberoastable: we request its service ticket, crack it offline, and log in as Administrator.

Impacket on appl3b0y

Active

Introduction