Forest — HTB Writeup | The Hack Sparrow

Executive summary — Forest is a textbook Easy Active Directory Windows box: anonymous enumeration of the domain, AS-REP Roasting of svc-alfresco (no Kerberos pre-auth), WinRM access, and an ACL-abuse escalation — membership in Account Operators plus WriteDACL from the Exchange Windows Permissions group — to grant ourselves DCSync and dump the Administrator hash. An AS-REP → WinRM → BloodHound/ACL → PowerView/DCSync → PtH path.

Platform	Hack The Box
Operating system	Windows (Active Directory)
Difficulty	Easy
Status	Retired
Target IP	`10.129.8.78`

Attack map

[53/88/135/139/389/445/464/593/3268/5985] Active Directory (DC) · anonymous SMB enumeration
   │  netexec --users → Administrator, svc-alfresco, sebastien, lucinda, andy, mark, santi...
   ▼
[AS-REP]  svc-alfresco without Kerberos pre-auth → GetNPUsers → $krb5asrep$
   │  john + rockyou.txt → «s3rvice»
   ▼
[WINRM]  svc-alfresco (Evil-WinRM)  → user.txt
   │  BloodHound: svc-alfresco → Account Operators (creates users) + Exchange Windows
   │  Permissions (WriteDACL over the domain)
   ▼
[ACL ABUSE]  create htbuser → add it to Exchange Windows Permissions →
             PowerView Add-DomainObjectAcl -Rights DCSync
   ▼
[DCSYNC]  secretsdump with htbuser → Administrator NTLM hash → Pass-the-Hash → root.txt

1. Environment setup

As with any Active Directory box, the first step is resolving the domain name. We add the DC to /etc/hosts so Kerberos/LDAP tooling can resolve it correctly:

sudo nano /etc/hosts
# add:
10.129.8.78 forest.htb.local htb.local forest

HTB IPs change between resets, so it's worth double-checking the current IP before starting.

Resumen ejecutivo — Forest es una Windows Easy pero de Active Directory de manual: enumeración anónima del dominio, AS-REP Roasting de svc-alfresco (sin preautenticación Kerberos), acceso por WinRM, y una escalada por abuso de ACLs — pertenencia a Account Operators más WriteDACL del grupo Exchange Windows Permissions — hasta concedernos DCSync y volcar el hash de Administrator. Recorrido AS-REP → WinRM → BloodHound/ACL → PowerView/DCSync → PtH.

Plataforma	Hack The Box
Sistema operativo	Windows (Active Directory)
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.8.78`

Mapa del ataque

[53/88/135/139/389/445/464/593/3268/5985] Active Directory (DC) · enumeración anónima SMB
   │  netexec --users → Administrator, svc-alfresco, sebastien, lucinda, andy, mark, santi...
   ▼
[AS-REP]  svc-alfresco sin preautenticación Kerberos → GetNPUsers → $krb5asrep$
   │  john + rockyou.txt → «s3rvice»
   ▼
[WINRM]  svc-alfresco (Evil-WinRM)  → user.txt
   │  BloodHound: svc-alfresco → Account Operators (crea usuarios) + Exchange Windows
   │  Permissions (WriteDACL en el dominio)
   ▼
[ACL ABUSE]  crear htbuser → meterlo en Exchange Windows Permissions →
             PowerView Add-DomainObjectAcl -Rights DCSync
   ▼
[DCSYNC]  secretsdump con htbuser → hash NTLM de Administrator → Pass-the-Hash → root.txt

1. Preparación del entorno

Como en cualquier máquina de Active Directory, lo primero es resolver el nombre de dominio. Añadimos el DC a /etc/hosts para que las herramientas de Kerberos/LDAP lo resuelvan correctamente:

sudo nano /etc/hosts
# añadir:
10.129.8.78 forest.htb.local htb.local forest

Las IP de HTB cambian entre resets, así que conviene comprobar siempre la IP actual antes de empezar.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.