Forest

https://app.hackthebox.com/machines/Forest

Machine: Forest
Difficulty: Easy
OS: Windows

---

Table of Contents

• 01 — Reconnaissance (Full Port Scan & Domain Controller Identification)
• 02 — DNS & SMB Enumeration (Null Session)
• 03 — RPC Null Session User Enumeration (enumdomusers)
• 04 — AS-REP Roasting (svc-alfresco — No Kerberos Pre-Auth)
• 05 — Hash Cracking & User Flag (Evil-WinRM as svc-alfresco)
• 06 — ACL Abuse (Account Operators → Exchange Windows Permissions: GenericAll & WriteDacl) → DCSync Attack & Administrator Hash Dump
• 07 — Privilege Escalation to Root (Pass-the-Hash as Administrator)

---

01 — Reconnaissance (Full Port Scan & Domain Controller Identification)

Identified the target as a Windows system through a port scan.

Through a scan of the main ports, confirmed the server version (Windows Server 2016), the domain name, RPC, and more.

---

02 — DNS & SMB Enumeration (Null Session)

Enumerated the DNS on port 53. As a result, confirmed the DC (Domain Controller) that handles the domain and zone transfers.

The SMBMAP scan did not identify any notable credentials.

---

03 — RPC Null Session User Enumeration (enumdomusers)

Ran RPC enumeration through a null session → the DC returned domain users without any MS-RPC credentials. Identified the SM-*, Admin, Guest, Sebastian, Lucinda, and svc-alfresco users.

---

04 — AS-REP Roasting (svc-alfresco — No Kerberos Pre-Auth)

The next step is AS-REP Roasting. If any one of these accounts has the “Do not require Kerberos pre-authentication” option enabled, the DC will hand us that user’s encrypted AS-REP response without any credentials (username/password). We can then take that response and attempt offline password cracking.

---

05 — Hash Cracking & User Flag (Evil-WinRM as svc-alfresco)

Only the svc-alfresco account has Pre-Authentication disabled, so it is the only account on which AS-REP Roasting can be performed.

That $krb5asrep$23$... data is an AS-REP hash that can be cracked offline.

The next step is to crack it using Hashcat.

First save the hash to a file, then run the attack with the rockyou wordlist using Hashcat’s 18200 mode (Kerberos 5 AS-REP, etype 23).

Cracked password: s3rvice

Accessed via WinRM with the cracked password and obtained the user flag.

---

06 — ACL Abuse (Account Operators → Exchange Windows Permissions: GenericAll & WriteDacl) → DCSync Attack & Administrator Hash Dump

The privilege escalation chain confirmed with BloodHound is as follows.

svc-alfresco → Service Accounts → Privileged IT Accounts → Account Operators

• Account Operators has GenericAll over the Exchange Windows Permissions group.
• The Exchange Windows Permissions group has WriteDacl over the domain object.
• Therefore, we can grant ourselves DCSync rights, replicate (DCSync) the Administrator’s password hash, and then log in as Administrator with that hash.
• After that, we can read root.txt.

Install bloodyAD.

Chained the process of adding svc-alfresco to the Exchange Windows Permissions group to inherit WriteDacl, granting ourselves DCSync rights, and then dumping the Administrator hash with impacket-secretsdump.

---

07 — Privilege Escalation to Root (Pass-the-Hash as Administrator)

Performed a Pass-the-Hash attack with the dumped Administrator hash to connect via Evil-WinRM and obtain the root flag.