HTB - Active
TL;DR - A Domain Controller exposing a Replication share over anonymous SMB leaks a Groups.xml containing a GPP-encrypted password. Microsoft published the AES key for GPP, so it decrypts offline to the svc_tgs credentials, which open the Users share and user.txt. The Administrator account has an SPN registered, so a Kerberoast against it yields a TGS hash that cracks with rockyou, giving full domain compromise. Recon Starting with a full nmap scan on the host and saving the results to a file: ...