Forest

Platform: HackTheBox | Difficulty: Easy | OS: Windows Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Forest (Windows, attack surface: Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name) (389), Microsoft Windows Kerberos (server time: 2024-01-02 08:19:47Z) (88), Microsoft Windows RPC (135), Microsoft Windows netbios-ssn (139)). Foothold via smb; privilege escalation to root. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC 10.10.10.161 --min-rate 1000 -Pn

Enumeration highlights

• Detected OS: Windows.
• Open services: http (47001), http (5985), kerberos-sec (88), kpasswd5? (464), ldap (3268), ldap (389), mc-nmf (9389), microsoft-ds (445), msrpc (135), msrpc (49664), msrpc (49665), msrpc (49666), msrpc (49667), msrpc (49671), msrpc (49677), msrpc (49682), msrpc (49697), msrpc (49709), ncacn_http (49676), ncacn_http (593), netbios-ssn (139), tcpwrapped (3269), tcpwrapped (636).
• Scan used: nmap -p- -sV -sC 10.10.10.161 --min-rate 1000 -Pn.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sV -sC 10.10.10.161 --min-rate 1000 -Pn
Starting Nmap 7.93 ( https://nmap.org ) at 2024-01-02 00:12 PST
Nmap scan report for forest.htb (10.10.10.161)
Host is up (0.022s latency).
Not shown: 65512 closed tcp ports (conn-refused)
PORT      STATE SERVICE      VERSION
88/tcp    open  kerberos-sec Microsoft Windows Kerberos (server time: 2024-01-02 08:19:47Z)
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
389/tcp   open  ldap         Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: HTB)
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http   Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap         Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf       .NET Message Framing
47001/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc        Microsoft Windows RPC
49665/tcp open  msrpc        Microsoft Windows RPC
49666/tcp open  msrpc        Microsoft Windows RPC
49667/tcp open  msrpc        Microsoft Windows RPC
49671/tcp open  msrpc        Microsoft Windows RPC
49676/tcp open  ncacn_http   Microsoft Windows RPC over HTTP 1.0
49677/tcp open  msrpc        Microsoft Windows RPC
49682/tcp open  msrpc        Microsoft Windows RPC
49697/tcp open  msrpc        Microsoft Windows RPC
49709/tcp open  msrpc        Microsoft Windows RPC
Service Info: Host: FOREST; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: required
|_clock-skew: mean: 2h46m50s, deviation: 4h37m10s, median: 6m48s
| smb-os-discovery: 
|   OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
|   Computer name: FOREST
|   NetBIOS computer name: FOREST\x00
|   Domain name: htb.local
|   Forest name: htb.local
|   FQDN: FOREST.htb.local
|_  System time: 2024-01-02T00:20:40-08:00
| smb2-security-mode: 
|   311: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2024-01-02T08:20:37
|_  start_date: 2024-01-02T08:15:25

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 82.16 seconds

1. Based from the nmap results, the machine runs a web application on port 5985 and have public smb share.

Privilege Escalation

User -> Root/Admin

Moved laterally to the svc-alfresco account (ASREPRoast), then abused the Exchange Windows Permissions group's WriteDACL over the domain to DCSync the Administrator hash and own the domain.

Flags

Lessons Learned

1. asdasdad