**HackTheBox - Forest โ€” Transcript & Summary | SozAI** Source: https://sozai.app/transcript/hackthebox-forest/ IppSec walks through the HackTheBox Forest machine: Active Directory enumeration, anonymous LDAP/SMB access, AS-REP roasting, then BloodHound-guided privilege escalation to DCSync. ## Key Takeaways - Active Directory machines require chaining several techniques (anonymous enumeration, AS-REP roasting, BloodHound pathing) rather than running a single script. - Anonymous LDAP and SMB null sessions can expose valuable domain information even without credentials. - BloodHound is essential for discovering privilege escalation paths through group membership and ACL abuse. - Kerberos requires accurate time synchronization; clock skew must be addressed before ticket-based attacks work. ## What the video covers - Introduces HackTheBox Forest as a medium-difficulty Windows Active Directory machine with no web server. - Begins with nmap scanning (default scripts and full port scan), staggering scans to avoid conflicts and overloading the target. - Explains TTL-based OS fingerprinting: Windows ~128, Linux ~64, network infrastructure above 128, with caveats. - Enumerates SMB (anonymous session, no shares) and DNS, noting reverse lookup issues. - Uses ldapsearch with anonymous bind to dump the domain naming context and query user objects, including timestamps and account metadata. - Discusses converting Windows timestamps and using LDAP data to plan password spraying. - Covers AS-REP roasting against accounts without Kerberos pre-authentication to obtain hashes, then cracking them with hashcat and rule-based wordlists. - Uses RPC enumeration and tools like rpcclient/PowerShell to gather group and privilege information. - Runs BloodHound with Neo4j to map attack paths, identifying a chain that allows creating a user, adding it to a privileged group, and granting DCSync rights. - Addresses Kerberos clock skew issues and explains SIDs (512 Domain Admins, 513 Domain Users, 520 Group Policy Creator Owners) and golden ticket concepts. ## Chapters 1. 00:00 Introduction to Forest and Its Challenges 2. 03:14 Nmap Scanning and OS Fingerprinting 3. 07:14 SMB, DNS, and Initial Service Enumeration 4. 14:00 Anonymous LDAP Enumeration 5. 25:00 AS-REP Roasting and Password Cracking 6. 46:40 BloodHound Analysis and Privilege Escalation Path 7. 70:00 Golden Tickets, SIDs, and Kerberos Clock Skew 8. 90:00 Troubleshooting and Wrap-up Answers ## Questions about this video Why does the video say Forest is a medium-difficulty machine? IppSec explains it is unique because it has no web server and is pure Active Directory, so there is no obvious prerequisite knowledge. It also requires multiple chained steps, such as an SMB null session, AS-REP roasting, and a BloodHound-discovered attack path, rather than a single script. How does the presenter use TTL values to guess the target operating system? He notes that Windows defaults to a TTL of 128, Linux to 64, and networking equipment typically starts above 128. Each router hop decrements the TTL, so the observed value helps infer the OS, though he cautions that values below 64 do not always mean Linux. What is the purpose of the BloodHound step in this machine? After gaining a shell, BloodHound reveals an attack path where a user can be created, added to a privileged group, and then granted DCSync privileges, which allows dumping domain credentials. ## Full Transcript โ€” Download SRT & Markdown 00:00 Speaker A what's going on YouTube is that can be doing forest from hack the box which was mark doesn't easy I think it's medium mainly for two reasons number one it's super unique in the sense that there's no web server 00:10 Speaker A it's just straight-up Active Directory so you may spend your wheels a lot on this one just because there's no real like prerequisite to doing this machine it's just all new technology number two there's a lot of chains in this box 00:22 Speaker A which means you can't just run a script and then get a result for instance the very first part is doing an AS rep Bruce twitch allows you to steal the hash of an account that's configured with Kerberos pre authentication but you 00:34 Speaker A can't just run that script because you don't have credentials into Active Directory you have to know to do a SMB nul session attack to gain like anonymous access into a tea and that's just something that's super common and 00:46 Speaker A environments however and map or something else doesn't really tell you to use this attack so it's just kind of intuition and then once you get a shell on the box you have to do bloodhound to see there's a like to hop attack into 01:01 Speaker A Active Directory with allowing you to create a user adding it to a group and then from that group that account can give the privilege to do DC sync into active directory so with all that being said let's just jump in and do this box 01:15 Speaker A as always we can begin with the end map so - SC for default scripts as via memory versions Oh a and I don't have the directory created so let's make derp and map and now we can do Oh a and map 01:27 Speaker A and we'll call the scans forest and the IP address which is 10 10 10 161 I'm also gonna add a dash V because I want to see the open ports as I as it displays them and I'm also going to do 01:41 Speaker A sleep 302 wait five minutes before I run the next command which is an nmap - P - to do all ports I can do - Oh a for the file and map force - all for its 10-10-10 161 and I also want to do this 02:01 Speaker A with a dash be the reason why I want to wait about five minutes is I hate running - and map simultaneously because well they could conflict and you get bad things we already see some type of delay being increased 02:14 Speaker A because of drop probes so we don't want to hammer the box the very first port actually let's just go check out the website so 10-10-10 161 and nothing responds so it looks like we may not actually have a website so let's 02:34 Speaker A start off with the very first port 4 4 5 so SMB client - el 10 10 10 161 and nothing so let's go to cherry tree forest notes SMB anonymous success no shares so the next thing we have is 53 02:59 Speaker A this is going to be DNS we can try making the box we cats hostname with nslookup type server 10 10 10 161 to send the request there and then there's two reverse lookups so one 2700 one is localhost we can try 03:14 Speaker A 0 0 2 sometimes people configure that and then we can make it look up itself and there's a connection down nope so it looks like maybe there's some DNS recursion or something going on some type of issue that where it can't look 03:31 Speaker A up itself we can confirm it is a Windows box because of the TTL windows default TTL is 128 every time a packet traverses the router this decrement by one because TTL stands for a time to live and Linux 03:46 Speaker A is default is 64 so if I ping myself let me get 64 and a Cisco router is going to be I think 255 so if you see it above 128 chances are it's some type of networking infrastructure if it's 04:02 Speaker A between 64 and 128 it's windows it is below 64 chances are it's Linux additionally just because it's not above 128 don't think it's networking infrastructure for instance I used ubiquity at home and it runs by otta OS which is essentially Linux so it's 64 04:22 Speaker A TTL I also have FreeBSD running on this IP address on my network and it's TTL is the same so just because it's below 64 don't automate automatically think Linux because a lot of things run Linux I'm sure like echo 04:38 Speaker A and all the other IOT device will be below 60 for the next port we have is l2 RPC things but LDAP s Kerberos this is global catalog I believe this is regular LDAP I don't know what that is for 64 04:57 Speaker A what is port for 64 something with a domain controller and it's talking to 3268 so probably something to do with global catalog 593 this is some weird saying RPC over HTTP so let's just look at LDAP next because that essentially 05:23 Speaker A has a decent attack surface so go back to Cherry Tree DNS good not lis cursed name so let's go and load app search dash H 10 10 10 161 oh it's doing md5 authentication we don't want that oh wait a second ok so I use dash H 05:54 Speaker A because dash H means host and at a habit I did - 8 for help and actually you can't have the same flag do two different things obviously so when i do - h that second time it causes LDAP search to fail which then 06:06 Speaker A prints the help so I guess you can have the same argument do two things but we want to do - X simple authentication so 10 10 10 161 - X and now let us do scope base I think naming context and this will get 06:30 Speaker A us the DN if you don't know this I have gone over it a few times if you just go to like EPS a crocks type in LDAP go near the bottom because these are sorted by date I generally explained 06:43 Speaker A things best the first few times and then I stopped explaining it so definitely check go take a look at why puffy lightweight or a sizzle maybe CTF CTF was a hard box I don't know how well I explain that but let's 06:56 Speaker A just keep going actually by hack the box Anders it was insane so - B for base and we can put this in essentially this means HDB dot local think of everything as folders and these are different types of folders so 07:14 Speaker A I forget what DC stands for but I figure what they all stand for actually we can just pipe this - I guess LDAP - anonymous delt and this is all the LDAP information of what we can query so you 07:34 Speaker A got tons and tons of information if we want we can like Kat LDAP anonymous grep - I and I know I could do grep first and then the phone name but I like doing it this way so what might searching for it 07:49 Speaker A is at the end so I just hit up and then can backspace out I want to move the cursor C N equals we can do member member of and we can get a bunch of groups I'm sure maybe if we do like user 08:06 Speaker A we can get user names or something but if you use LDAP you can do a better job and just query it so what comes after it LDAP if we or after that is going to be a query we did I can't find it 08:27 Speaker A essentially you do LDAP and then this is the like searching scope what you want to look in and then you can do a query so we're gonna do object class is equal to person and this will dump only the 08:45 Speaker A things that have the object class of people so we can look at the very first one Santi Rodriguez you can see has class is person we can also do organizational person or user so let's see when he was created and he was 09:05 Speaker A created 2019 September 2nd 2000 1909 20 let me break this out sometimes it's hard to eyeball I don't know what that this piece is maybe this is our yeah there we go so hour minute second so that's when he 09:36 Speaker A was created in 2019 we can also see the login count how many successful logins he had and let's see what else is there potential email addresses bad password attempts voice password last set there it is astral last set and this isn't a punk 10:01 Speaker A Windows has a really odd timestamp it doesn't obey epochs so if we google like windows timestamp to human we get this out app in Active Directory timestamp convert eighteen digit up human and we get the password reset Friday September 10:19 Speaker A 20th 2019 so all this information is super handy when it comes to like doing password sprays Sam account type is what the account name is what was I going to say Sam account name is the user name so 10:39 Speaker A we can just put this at the end and now our query is only gonna do this so after like search scope or whatever this is base query and then your filters what you want to see so if I do like Sam 10:52 Speaker A account name and email is email one we can do Sam account type I know that's one so we can see it only pulls out what we want so I'm gonna do Sam account name and grab Sam account name because I want to 11:13 Speaker A do a password spray so we can also change the object class from person to user and it is the same thing so direct this actually before you direct it to a file let's do all print to so we only 11:32 Speaker A grab this second piece and then we can do user with LDAP to remind us where we got the users from and I'm going to delete everything actually let's explain what I'm deleting requesting that's obviously not one guest don't need to 11:52 Speaker A brute-force guests and then these accounts that end in the dollars or machine accounts that which means Active Directory generate themselves not gonna crack those passwords and then these are a bunch of things generated by exchange not gonna crack those passwords so we're 12:08 Speaker A left with five user accounts so that looks good so before we do a crack we need to specify a word list and I don't want to use rock you because if we do users share word list Rock you text we 12:24 Speaker A have a lot of possibilities this could be so I'm going to do VIP W list text and we're gonna make our own so I always like putting the months because users always like using months and passwords so January February March April May June 12:44 Speaker A July August September October November December I think that's in the correct order looking down here we have twelve so I got all the months whether in the correct order or not that is to be determined password we don't have to do 13:08 Speaker A things like that because we're gonna generate this on our own in a second so we'll just leave that there forest which is the name of the box HDB secret and we should do like autumn fall spring winter summer so we got 22 13:30 Speaker A passwords that should be fine so one thing we're missing from this password list is the year so what I'm going to do is add the year to the end there's a hundred ways to do this I always do for 13:43 Speaker A loops because well it's just easier to remember probably not the quickest but echo I and echo I 2019 and for good measure let's echo I 2020 there we go and I'm also going to echo I actually yeah that 14:12 Speaker A should be fun so we can do this to T and then move T to PW list if you can't a file so if we see ppw list to T if we're cutting a file and then direct something over top of it it wipes out the file so 14:36 Speaker A always be careful with that so now we have 66 passwords but I mean honestly this isn't going to really be any users password I'd laugh if it was so weird you hash cat - - force this is going to make sure we 14:54 Speaker A don't need to use a GPU then - - STD out to say pipe it to standard out so we can see everything it's doing put in the word list which is just PW list and then rule file so user share hash cat rules 15:10 Speaker A and then best 64 dot rule so what this is going to do mutator password and do a bunch of cool things the one thing I'm seeing it not do is add exclamation points grep and every good password that requires a symbol has 15:29 Speaker A an exclamation point so let's add that so go back to our for loop for I and whatever and we're just going to do echo I then echo I bang cat T now we can see PT to PW list and then hash cat to do 15:51 Speaker A this and we got a lot if we do WC - L 10,000 passwords and we could also chain word list so use it share hash cat rules and we could do toggles 1 and this is going to toggle various upper cases so 16:14 Speaker A there should be some like that weren't before so like that double use now capital probably wasn't before ending whatever and whatever you do like the toggles you're going to have a lot of duplicates so if we do but multiple 16:32 Speaker A rules because some of these may be already invest 64 so we're down to 52 thousand passwords and that is a lot of passwords to do a network brute-force so let us type that over to auch and say length is 0 like that so what this is 17:02 Speaker A going to do is it's going to take the length of the very first thing which is this if there were two words and we did dollar one it would take that thing and we're saying when that is greater than 8 17:16 Speaker A so what this does it only gives us passwords that are greater than 8 is this greater than equal let's echo - n WC - c9 so let's do 7 okay now if we type this - WC - L it got rid of 10,000 17:39 Speaker A we do 8 how many is that yeah this will be fine 40,000 it's a lot to brute-force with I don't like doing that - I guess we can try this that is a lot of things to brute-force but oh well 18:03 Speaker A cut that to tee a pipe at the tee cat t CPT PWS text sure before we do a brute-force we should always be kind and do our best to make sure we don't lock in account now we could pick one of the 18:27 Speaker A accounts and then just try it and see if it locks as like lockdown but that's a very mean thing to do we do crack map exec first SMB and then - - pass Paul for password policy 10 10 10 161 pass 18:48 Speaker A Paul comes after like that and now it's trying to extract it doesn't look like it's going to work and you may have done like Inu for Linux against this box it works most likely we can try it but I 19:11 Speaker A hate using a noob for Linux so we can go over and look at it the main reason I hate it is it hasn't been updated Oh forever and it's just a wrapper to run a bunch of things in written in Perl so if 19:27 Speaker A something breaks in it you won't really know what's being like working so when that doesn't work I do this and do crack map exec with password policy and specify blank use name blank password to do a knoll authentication attempt and 19:43 Speaker A this will generally work on a lot of domains that have been upgraded from like 2003 because Windows when you install a domain now doesn't let north on occasion this works in domains that have been upgraded because back in Windows 2003 anonymous 20:00 Speaker A users had this privilege and that's why an ancient tool like a noon for Linux is working we see it actually dumping Oh stuff out of our PC so we can do this I can show you how that's working but 20:14 Speaker A essentially it's a super old thing that Windows was configured whenever you upgrade from like 2003 2008 because you may have required that functionality because it was there they don't remove it so the anonymous users is in the pre 20:32 Speaker A Windows 2000 compatibility group if you remove that it'll fix this to kind of show you I do have a domain on my home network that this most likely will not work on because this is just a vanilla install of 2016 so 10 3005 you don't 20:50 Speaker A have access to this because it's my home network but we can see this attempt did not work if I specify the username and password that is razorback so this will be a member the can't oh I thought that 21:12 Speaker A was it oh I type it the username there we go so you can see in a fresh install of Windows 2016 you need to have credentials that Nala 10 ocation doesn't work so if you ever see this working know that it's big wolf 21:32 Speaker A Oh God team ox attached there we go if you ever see this working know to put in the report that no loss indication allows domain enumeration and you can get a bunch of information god this Inu for Linux is ugly because again it's a 21:56 Speaker A super tool bunch of error messages does wrap is for a lot of things so when this works you can kind of look at what it's doing so I know this is doing RPC client - you nothing 10 10 10 161 but no password and we 22:16 Speaker A login we can do Enuma dumb users and enumerate everything just to show you if we didn't do this and specified anonymous login by just hanging enter we get login failure so you have to do nothing so he knew users 22:39 Speaker A and we get the usernames actually we get one we don't have before do we have we've seen it before 1 2 3 4 5 yeah we did so we got a new one SVC alfresco there is if we hit tab 22:59 Speaker A twice and look at all the commands you can do query user and query user groups so video query user groups on SVC alfresco iam dumb users got yes query user group oh we specify the rid we can see it's in two groups whatever to a one 23:35 Speaker A and 47c is we can do query group and look at what the group is that is domain users and the second one is service accounts so SVC stands for service account we can also do query user as we 24:01 Speaker A see a fresco which is this red and we can see everything password last set account login time which was 923 passer last set was today and must change password is way in the future like if this server is still mine 24:24 Speaker A and then that would be amazing but yeah that is there a PC client um where was I oh we were doing crack mapping Zack so look in the password policy you saw account lockout threshold of zero so we 24:45 Speaker A can now safely brute-force things so if we just do - you and do LDAP anonymous Dell and - P user with LDAP and before I kick this off I guess you kind of go through this if you want to you can do 25:04 Speaker A this on your own I don't want to go through this because of all the error message is making this ugly there's the password policy from this tool but I think this use like Pauline um I think is what you knew from Linux 25:19 Speaker A uses same exact thing q - P 10-10-10 161 maybe - d HD B dot local yeah it's doing something I forget how it works but do we do a space food this yeah not exactly sure but that's why I use crack map exec it's a much 25:50 Speaker A friendlier syntax but he stopped talking because I forgot what I was doing oh we're gonna crack but I wanted to look at as we see a fresco why did you not exist you walked out or something here's the account I think this is just 26:14 Speaker A the oh you he's in because I don't see like a password last set this isn't all the stuff and he's not in anywhere else Sebastian's in here and his account gives me a lot more information so there must be something some anonymous LDAP 26:35 Speaker A probably doesn't have access to the owe you that the service account is in that's probably it so we can do this and say SVC - al fresco and we'll write this to user list out because it's no longer from LDAP so 26:54 Speaker A crack map exec SMB 10-10-10 161 - you use a list dot what did I just call this user list dot out and - P for password list let this go and it's going to fail for a long time but this is gonna be 27:19 Speaker A good recon to have going in the background so exit this we can rename this window to crack map exec and check on it every now and then there's also a flag you could do to stop upon success but I'm not going to worry about that 27:35 Speaker A and map has finished and we see pretty much nothing now yeah I don't think it's showing us anything about what is it no authentication I don't think ed map tells you that just something you should test on your own so 28:03 Speaker A while that's running let's go and look at impact tools because I don't know what else to really do so locate an packet drop for example and we want to go user shared duck Python 3m packet examples ok and a full port scan 28:25 Speaker A finished so we can exit this window so let's see eighty exact eighty is a command for a scheduled job so I'm guessing this is just going to give scheduled tasks decom is another thing for lateral movement DP API this is like a password encryption 28:51 Speaker A utility and windows so that doesn't sound too useful I don't know what he sent Yuto is so let's just go down he sent you till storage engine utility probably nothing get eighty users um we already have the eighty users so we 29:06 Speaker A probably have to get architecture there's gonna tell us if it's 32 a 64-bit get NP users this is I think reversible encryption - eh yeah for users that do not require Kerberos pre authentication so we can use this tool 29:29 Speaker A get NP users and we want to specify - DC IP 10-10-10 161 - request and we have to give it a target we'll give it h TB dot local if we do slash because it expects like domain / username and then at IP 30:02 Speaker A address or if you do dcpip you don't have to give it an IP address and we get the service accounts thing password last set last login so let's go and we can change this format to hash cap so - 30:22 Speaker A format hash cap and let's go and crack this so I'm going to go over to my cracking rig which I call the Kraken and the reason why I do this is because cracking is a very CPU intensive thing 30:39 Speaker A and I don't have much CPU resources tied to my VM and I don't want to do this on my host because I dropped frames and etc so I have a separate machine I use for cracking and it doesn't hurt that has a 30:50 Speaker A bunch of GPUs so we can do V will do hashes / sv c al fresco and paste this in and then we have to what is it hash cat example hashes grep - i KR b and what we have is I believe a a s rap 31:28 Speaker A 23 is what we have but we can double check ok bas rap service alfresco 23 so that's what we have so we can do copy this and do less search go up and that is 18 200 so now we can crack the hash 31:55 Speaker A so let's execute hash cat I can type - mmm 18-200 the hash was hashes / sv c al fresco and then the word list users share nope opt word list rokkyo that's why i have it stored in this machine and we can do - therefore 32:17 Speaker A rules and for cracking I always like doing inside Pro first so that looks good starting up while that goes we can look back over here and it only tried cracking one user a V use a list dot helped I'm not sure why it stopped after 32:44 Speaker A the first one I guess we could loop this and get it working maybe play around with at the end of the video file remember but otherwise I'm sure you can figure it out on your own or just loop 33:01 Speaker A around it because we got lucky and crack this hash so we can do copy exit CD htb boxes forest the creds SVC at fresco and service so to crack map exec - you SVC alfresco - p service and specify SMB 33:40 Speaker A 10-10-10 161 and it logs in but it's not orange and doesn't say pwned so we probably won't get anything we could I think do - - shares and this will list all the shares I believe it may be like 34:05 Speaker A Cherie new more something there we go so we have access to IPC sisal and net login so let's see is there a group impacted script get like Group Policy password so let's go CD back into impacted examples grabbed - I GPP star 34:37 Speaker A policy let's see Linux system all extract Group Policy password so let's see if this has it this wall [Music] this has been on a previous hack the box machine so I'm guessing maybe not I'm not sure I did before Group Policy 35:13 Speaker A password so going back to the pastor disclosed via so we use powerup before so this is using Empire so if you want to look at Group Policy password we explain it in this box I'm going to put it on the notes of things I did not do 35:33 Speaker A and we'll move on because I'm not sure how to do that on Linux if I come to a dead end I will go back to that and look so let's see go to nmap last for said map there is that RPC over HTTP we could 36:00 Speaker A look into but let's go to forest all ports and we have 5985 which is win RM so powershell remoting let's try that opt evil win RM huh evil win RM - eh - you SVC alfresco - ps3 RV like that - i 36:32 Speaker A 10-10-10 161 suite we were on the box so dir CD sebastian dir can't dir SVC a fresco desktop that's what user dot txt is we can't go into administrator we can but will get denied nothing here so let's run Linda new so they're not let a 37:13 Speaker A new habit win peace make to SMB and then we will see P let's go see the up privilege escalation awesome sweet and find grab exe and ends with the XE so we can copy see something out of releases 37:39 Speaker A guess we could do off you skater releases but this should be fine so CP this to HC be boxes forest SMB go into that directory and we have to start it server so impact it SMB server will call 38:02 Speaker A this please subscribe the directory Warner share which is our current directory so I just do PWD SMB to support user hip sac password support me on patreon okay so now we'll have to do a net use or get a new PS drive so in 38:34 Speaker A order to do that we're going to put the password and a credential object so pass is equal to convert to secure string support me on patreon and then as plain text force I think that's correct yep so now we can do cred is equal to new 39:01 Speaker A object system management automation PS credential and a user is IPSec and the password is pass there we go so now we got a credential object so now we can do new PS Drive name EPS AK PS provider file system credential 39:32 Speaker A cred and the root of this drive is 10 10 14 - I think that's my IP if config tun 0 that is my IP and the share is please subscribe did I do this right the first time yeah we did we connected so in a few 39:58 Speaker A seconds we should get a prompt back and when we do we can go into the IPSec drive and then run wind peas and I'm going to copy this while we're waiting because this is going to be handy if we have a looser 40:20 Speaker A shell or start a new one ok and get the last one so CD if sec dir dot slash win peas dot exe to execute ax oh we probably should have done - H and an actual option and it looks like it's 40:52 Speaker A working let's see ok that looks good go back to crack map exec don't get anything on this user but let's ignore this and go name this - shell - and we can put this actually yeah we'll rename this to show 1 and let's go on to this 41:21 Speaker A box so up what is it evil win RM evil win RM - you upset - not it - you SVC alfresco - P service - i 10-10-10 161 check this hasn't finished let's go back here grab a password run it have the 41:51 Speaker A credential boom paste and we're gonna call this hip SEC - every now and then like when I have multiple sessions using the same like drive name and PowerShell things have acted wonky so I always try using different names and this is finished so 42:13 Speaker A we're good oh sweet it checked group policy for us so it's not there boom done go to the top and we'll go down laps is not installed helis a protection credential good these two things you need admin to 42:38 Speaker A exploit cache logins when domain users log in and may store it and a DCC to hash I believe but again you need admin to extract those so I'm not really concerned about cache logins that's just huiling anything with name not 42:54 Speaker A interesting no AV detected we do hello that's cd-rom not drive we have mission to write in C : so if we have any like unquoted service paths we can probably take advantage of it because we can create the direct 43:12 Speaker A probably C : program DX e so unquoted service path is probably a good way to prevent machine current user auto log-in credentials found not displaying them so maybe it just sees the default demand that I have no idea why it's saying that 43:30 Speaker A not too helpful hey I found it not gonna tell you it I don't know what that's saying going down we have DNS not an interesting firewalls disabled bunch of things that looks through guessing these are read protected there's no way we can 43:54 Speaker A just cap copy this normally anything in this config directory is read protected so in order to get it to it you either have to be in like safe mode use shadow files or like ninja copy to interact with NTFS directly so we can try copying 44:09 Speaker A it but access is denied yep so can't do it that's just shell - so what else can we do this is a domain controller so let's do bloodhound bloodhound github we could download it from within our Kali but bloodhound gets updated pretty 44:31 Speaker A regularly so I always like just pulling it so CD SMB oh look into a CD opt arm - RF bloodhound I'm going to eat my old copy and then just pull the new one and this has the exe s precompiled so if we 44:56 Speaker A grab fig exe we have it it doesn't have the actual like bloodhound application so we'll have to download that separately HDB boxes forest SMB so if we just go over to the releases we can download it W get like 45:23 Speaker A this and we can unzip bloodhound Linux x64 and before starting bloodhound you have to start neo4j so I do neo4j console actually let's say I forgot what I set my neo4j password to or I just installed it so if we locate neo4j grep 45:53 Speaker A for off we delete this file this is going to delete essentially your password file and now when you start up near 4j you will go to the web port it says and then you can reset the password so the 46:12 Speaker A default credentials is I think neo4j for the username and password however it forces a password at next login so if you just try studying neo4j and then running bloodhound it's gonna fail authentication because you need to change the password so that's what I'm 46:29 Speaker A doing now go here neo4j and we put in your password I'm just gonna do neo4j we'll call it bloodhound I think I mistyped that no I do not unless I mistyped it twice which will be really interesting and like 30 seconds 46:56 Speaker A while I try Ascenta cating so we execute bloodhound with no sandbox and the password is bloodhound well again success and let's see oh we can actually run bloodhound yet did we we copied char pound to this directory I 47:27 Speaker A think but did not run it so dot slash shut pound XE - seol and this is gonna do all collection methods together doesn't take too long if you go to the bloodhound wiki it says and see where as 47:53 Speaker A you said building dev let's get out of the wiki it's probably on the main page oh well I'm not done yet let's see wiki I'm getting started blowdown that's not it save for query gallery that's running custom site for queries if you did - H 48:36 Speaker A for help it'll show everything so while that's running let's go import it I clicked the wrong thing okay thank God never know what's gonna open up when you click the wrong icon HCB boxes forest SMB we take the bloodhound and we drop 48:57 Speaker A it you got a little loading bar right over here while that loads we can go here and just look at the options so collection method you have them right here group local whatever stealth if you want to be stealthy could specify the 49:15 Speaker A domain change the zip file name may be good because there may be some type of learning based upon the zip name something bloodhound zip so if they have like sis Mon installed and you see bloodhound in a foul name may trigger an 49:35 Speaker A alert so you may want to change things like that also you can put a encrypted zip password or is it encrypted zip so we put a password on it so someone grabs that zip they can't just pull all the 49:49 Speaker A domain information which is definitely a good thing to do but it should be done importing we have finished processing the files the first thing I like doing is setting what I have owned so you can do SBC alfresco SVC alfresco ok 50:08 Speaker A mistyped it right-click it and mark user as owned so we can do query users you can say show paths from Kerberos table users and oh good roast is only detecting that okay sometimes the demo gods don't work show 50:28 Speaker A path from Owen principles and they select who you have earned and it builds you this little nice graph so we can see alfresco is a member of service accounts service accounts is a member of privileged IT Kovich IT is a member of 50:47 Speaker A account operators and there's a exchange what nslookup e XE h o1 h CB dot local server 10 10 - 10 161 exch r1 HT b local so this was part of a different domain 10 10 10 7 so interesting if we ping it 51:25 Speaker A paying windows whooping - n that's probably - c 10 10 10 seven yeah destination unavailable hey actually got that right so exchange once upon time was active but no longer count operators as generic all over exchange windows permissions which has right dackel - HD 51:51 Speaker A b dot local so service accounts is a special group in windows lets you create accounts and put them in different groups so if we do service account group windows know what is it no account Freitas service account is what he 52:18 Speaker A created account operators this is what I was meaning to say that's not it maybe this maybe we can just read what Google said I can operate of grants limited creation to a user members of this group can create a modifying most 52:41 Speaker A types accounts including those and users local groups and global groups and if you go to the page you'll say it can't do administrators backups etc see count operators let's see members of counter operators cannot manage the administrator user 53:04 Speaker A account the users of administrators or server operators account operators backup operators or creditors so these are groups we can't add people to but if it's not one of those we can so we can add someone to this exchange windows 53:18 Speaker A permission group and we can also create accounts so because it's htb i don't want to modify this account and mess it up for everyone so let's go create our own user so I'm going to do net user if 53:32 Speaker A SEC and the password of please subscribe or do add and domain passwords longer than 14 characters ok please sub ok so now we have used our account operators to create a user called hip sac we have to add them to this exchange windows 54:00 Speaker A permission groups so let's do net group exchange windows permission zip permissions it is so we see there's no members so we can do slash add hip sack look at it a nip sack is now a member and if you do help you need to abuse 54:31 Speaker A info and read it they use Power View to do this I just did it through the net use command because that's generally how I add users it's simple and easy to remember so we got this right tackle over HTTP local and if we go to abuse 54:51 Speaker A info we can see we're adding a domain object ACL the rights DC sync so this is out of a tool called Power View most of these are or anything in blood how I think tells you a Power View I'm 55:06 Speaker A guessing that's gonna be updated soon to go to whatever their dotnet stuff is but for now let's go grab Power View power up see power sploit recon power veal okay Paris plate deprecated we probably want to grab either the master or the 55:41 Speaker A dev branch master last modified December 2016 dev is 2018 I'm gonna try the master first there's some syntax changes and stuff between the two and I think bloodhound expects you to have the regular so I don't know what version I 56:06 Speaker A have but I'm just gonna wipe it get clone go into power sploit and we can do I think it's recon its power of you here find crap - I power view it is I just can't read oh it was in green for some 56:34 Speaker A reason I just discredited it I read it Victor htb boxes forest dub dub dub copy this there okay CDW dub Python 3 - m ec you got server port 80 IX new object net dot web client download string HTTP 10 1014 to slash 57:10 Speaker A power view ps1 looks good hit it that's good so let's go here the credentials we already have here so we can just do this this is please sub the user are they saying okay so whoops will do htb hips act like 57:40 Speaker A that pass cred and then we run this I'm just going to do lowercase e don't think that matters target identity this is htb local okay not recognized as a command so we want the dev so we can grab - I what is it 58:25 Speaker A add domain on Power View not there so let's I'm - RF power sploit get clone - be dev to download the dev branch power view recon CP power view - the same directory we'll go in show number two 58:54 Speaker A and we can copy that ie X command and the reason why I'm doing this is I'm not a hundred percent positive I reload this if it'll like screw anything up because there's probably a lot of changes between the two versions of Power View 59:24 Speaker A and I mean it's just much cleaner to start from a fresh environment so copy this there's one thing I don't like about this command is it's not saying what the target user is we got this target identity but that is just 59:49 Speaker A specifying test lab local which is a domain so we'll see so the tool I'm gonna use to dump everything is called secrets dump so secrets dump pie and that's another impact utility so we can go back to the user share place CD and 60:21 Speaker A run secrets dumped up pie and we specify think just htb hip sack at 10 and 10 161 into your colon the password so please sub and I think you have to do the fully qualified domain HTTP local and it failed we never got 60:52 Speaker A the show back do this again copy come on do this okay and what we're going to do is Google this see if there's other syntax add domain object ACL rights DC sync see here ix get domain users DC sync target identity 61:44 Speaker A it's doing it in the LDAP format and principle identity that's what I want so let's try adding principle identity principle identity epic and that returned it's looking better did not work let's see the other thing they did was DC equals h TB d c equals local is 62:25 Speaker A that how they specified yep try this write it again and we got dumped sweet so we got the local administrator password kept I can click it I'll just wait for it to finish so we have all the hashes to all the accounts 63:00 Speaker A we can grab it and I'm gonna output this to hashes dot out and well that goes crack map exact SMB 10 10 10 161 - you administrator I think - h / hash is a capital h hash - capital H is hash Oh 63:41 Speaker A crack mapping guy does not like this being the same directory make ta lol go in there run the same command that's actually funny we can see he has been poned so if we just do PS exec we will 64:04 Speaker A be able to pop this so yes exec do we have impacted - PS exactly do it - go into the directory ok PS exact PI user shared by thumb 3 I truly just add this to my path yes exact I administrator Oh 10 10 10 64:31 Speaker A 161 if I put the hash colon the hash put the hash yes exact I H another's way - hashes and once the LM and then : ntlm this is more just a regular expression thing so it doesn't matter what you put for the 64:55 Speaker A LM it doesn't have to be that like a a d3 3b thing which is a blank and LM hash I believe blank LM hash ad 3b yeah ad 3 B 4 3 5 B 5 1 yeah so that's the blank 65:13 Speaker A LM hash what you generally see but we're now as administrator and CD users administrator and desktop root dot txt so that is the Box one thing we can do that may be fun is where do I save I'm 65:49 Speaker A probably in like a weird directory hashes dot out is here we can't hashes dot out we can probably grap it for like three colons there we go auch - f print before I think his ntlm hashes 31 d6 that's a blank one - root 66:23 Speaker A HCB actually we can just copy this since it's all on the screen and we could go back to the Kraken and see if any crack so CD hash cat the hashes ntlm forest paste actually whenever I crack hashes 66:47 Speaker A one thing I like doing is specify the user so if we do print 1 : 4 put the : and quotes we got username : the hash and I don't need actually yeah let's grab everything because I want the 67:12 Speaker A administrator included so copy this now as CH to the crack in V hashes for CD hash cat V hashes forest - ntlm paste and I guess we can leave everything so if we do hash km 1000 which is the ntlm 67:42 Speaker A hashes forest - ntlm opt word list rock you rules inside pro it's going to fail because it's gonna say like unrecognized hash length however if you specify the - - users or - - user it's going to essentially do that awk and take 68:10 Speaker A everything after the first colon and this becomes super handy well there's a weird one that cracked PL o k m IJ that's a weird keyboard walk but check that one so we don't know exactly what this guy is and if you didn't do like 68:34 Speaker A that - - users you won't be able to do this you can do get rid of everything and just do - - shell and it specifies everything specifies the user if you didn't have this in your pot file so we 68:50 Speaker A can get rid of it real quick it will just show you what cracked so Santee's password is this keyboard walk so in the future if you're doing a machine from mr. Benn maybe you can try brute force saying keyword walks and surprising him 69:03 Speaker A because maybe he likes them but was I gonna say cat hashes forest - ntlm Oh F print - so if we just have the thing of hashes with no user names in it and we do this show command we can 69:33 Speaker A get rid of this use a flag cat hashes oh crap I did what I said earlier I Canada file and directed it to itself so it wiped it I lose more files that way than anything else but you can see 70:01 Speaker A if you just had two hashes you don't get the username in here it's not as immediately useful so that's that let's see I guess we could so golden ticket because we have do we have krbtgt I do so I guess we can show go on a ticket so 70:37 Speaker A I'm gonna take a break and get some water and then we'll do a golden ticket and I'll call it a day okay I'm back so let's do is a golden ticket normally I do this from mini cats we're going to 70:49 Speaker A try doing it stall from Linux I'm just gonna Google golden ticket from Linux and the first one is a cheat sheet so let's try this go brute let's brute forcing now this is all Kerberos stuff good by roasting so 71:09 Speaker A this is the most common Kerberos is user SPNs we did a s rep roast so we didn't Kerberos before if I said that mister we did a a s rep rose and that actually is not shown in bloodhound 71:23 Speaker A as we learned so maybe we should look into always running this script if you're one that likes to do Kerberos thing which is get user SPNs so two different things should don't run them both but looking okay using a ticket within Linux okay so we 71:45 Speaker A use nope that's not it golden ticket is what we want so we're going to run this ticket or PI export kb v CC name and then run PS exec so let's go back here let's copy this krbtgt and this is the 72:03 Speaker A signing key windows uses to sign tickets so this was what less to spoof it I'm just going to copy care be TGT we need the domain Sid so let's just go over to shell 2 and we can do get ad I think 72:28 Speaker A domain HDB dot local is this going to work there we go domain Sid is here SID there we go and that should be the hard part's so it's doing domain and username username actually doesn't matter because we're creating our own ticket so I want to use 72:55 Speaker A one that doesn't exist and the one thing it's not doing that may be confusing if you're just looking at this is it's taking a lot of automatic defaults so we go locate and packet grab example we go in here and 73:18 Speaker A look at ticket er one let's just search for groups so this allows us to customize things in this group's extra seeds etc extra Sid is like when a user is migrating before between domains for a brief period I 73:38 Speaker A think he has two different SIDS and essentially that so if you're migrating the user and he has an active ticket the tickets accepted on both domains so if he's active he doesn't lose his current connection if you didn't have that then 73:51 Speaker A his connection would drop in all shares were not work until he real augs in with the new domain so that's why extra sit is a thing I believe I haven't looked at that since probably last year so that is 74:08 Speaker A my understanding of it so if we look at this parser ad or you can make groups defaults 512 I believe is domain admin I don't know what these other ones are if we go to Google Microsoft well unknown 74:23 Speaker A SIDS there we can search for this so this is explaining all that Sid information and I'm sure it's on EPS Ekta rocks but 512 is gonna be domain admins 513 it's gonna be domain users 520 this is Group Policy 74:49 Speaker A creator earner 518 I think it's backup 518 schema admin 519 is enterprise admin so it's adding us to all these groups so any ticket we have will have those groups added to it and the domain isn't going to validate the ticket because the 75:12 Speaker A ticket is signed by the domain so he passed this ticket to a computer it's like well it's signed by the domain I don't have to validate it because well the domain has already validate by signing it that's how signing works if every single 75:25 Speaker A request was always validated you'd create a lot of latency a lot of extra requests back to the domain so that's why this kind of thing works so let's go back to the cheat sheet and do this ticket fi and T hash is going to be 75:42 Speaker A the ntlm then we have the main CID I believe - domain - CID and we have this the next thing we have is - domain HDB dot local always use the fully qualified domain unless this doesn't work and then 76:09 Speaker A always use they're not fully qualified domain which would just be HTP username will call this totally does not exist as the user I think that's right okay we created the ticket it's got all those groups that we said previously so this 76:33 Speaker A is gonna be like an administrator etc so we export the caerbae 5-cc name to this ticket so putting this in our environment variable okay and then we use BS exec so dot slash PS exact i totally does not exist and we specify h 77:01 Speaker A DB local at 10-10-10 161 Oh - Kay - no - pass it says that right here it's hanging fee Etsy host 10-10-10 161 HT b dot local let's retry this okay so it was using this to look up a domain so 77:35 Speaker A that's why i add in that's e house a clock skew - great so this is probably the first time we have seen on this channel that the time actually does matter so we do forest dot and map we can see the clock skew is 77:54 Speaker A four hours off so the server thinks it's four hours off so it's probably just some standard timezone thing so let's see it's probably got UTC time but it's in eastern or minus seven I don't know what's happening but let's 78:15 Speaker A just change a date date - s we'll try four hours earlier so this will be 10 24 37 and we will breed on this date or try 12 14 18 where you run this there we go so is it skewed in the other way nope 78:59 Speaker A let's do a head map again and map - P 4 4 5 - s c sv 10 10 10 161 so this should get us the clock skew I think her script results maybe not oh it did sweet so we 79:31 Speaker A are now one hour off so date or I don't understand how this you know what the easy way to do is go here type date 11:34 a.m. and we have 6:25 EDT so let's do date - s this will 80:10 Speaker A be 1734 let's try this skew - great put your on this end map script and we'll see 16 I probably shouldn't be changing this wall running nmap 1511 is it much 18th on the server it is so 4i n 81:09 Speaker A SEC 0 to 24 - echo I done ok so we'll do date - s hi 536 now and then the PS exact we will get this work working eventually one of those was a different air message Oh 236 server not found in Kerberos 82:29 Speaker A database - yes 14:36 okay so that's right not sure why does the air ring let's see domain name tick it oh let's try HD beat up local and Capps server not found in Kerberos database let's Google this error message 83:49 Speaker A before we do that let's just try the main htb the Etsy hearse HT be quiet not found oh this is probably some weird like Kerberos configuration thing see golden ticket take it a dot pi we just went there 84:45 Speaker A let's see take it up i NT hash domain Sid domain administrator so domain Sid will do HTV local administrator it's very possible that the main controllers will validate user names but workstations won't maybe unlikely but possible administrator HDB local 85:34 Speaker A administrator so we're not found v Etsy zof Kampf name server 10 10 10 161 Etsy host let's delete that paying HDB dot local paying HDB paying - on one HCB that local we at sea resolve Kampf 10-10-10 should work don't know what my system is 86:23 Speaker A not registering that be do a type L know I don't the Etsy hearse 10-10-10 161 HT b dot local why is it always the easy things that fail okay exam PS exact k dash n full domain - Kay no pass 87:13 Speaker A Kerberos let's see HP that local administrator see reply the Etsy Kerberos file let's join I even have one hi those like kb5 Kampf oh because I added in my resolved by Kampf I don't have DNS this is just failing all over the place eight 88:09 Speaker A eight eight eight what is this impact it Cobra is off not working so this showing off specify the fqdn of the domain and the command solves of Eliseo we can add dash debug trying to Connect KDC let's just try updating in 89:10 Speaker A packet um app search and packet have to install [Music] don't know which one to install between Python 3 - same packet and in packet scripts I'm just gonna juice the bad option and we're just going to reinstall in packet and not use the repository and 89:37 Speaker A just hope we don't brick anything impac it get clone I definitely would not recommend doing this without like a snapshot or something so if we look we don't have PS exact top I on our path we're gonna do 89:56 Speaker A Python 3 setup I install and hope for the best so now we have PS exec PI in our path so what we can do is locate PS exec draft example oh here it is that's why I want and we can go CD route ACB boxes forest 90:33 Speaker A CP the administrator thing here and we just do PS exact PI - K - no pass HTV dot local administrator at 10-10-10 161 at least we're a full revision up the Etsy hosts stare let's add that debug htb dot local / administrator at 91:25 Speaker A 10 10 10 161 paying 10 10 10 161 let's restart VPN okay that was weird and we still can't clock skew date we are 11 54 okay so ever not found in Kerberos database Oh as far as we're doing IP address so 92:16 Speaker A maybe this is the Kerberos database on the remote server and the boxes name is Forest and we can also do HTV let's try this yeah that's better so impact it once DNS name that took a lot longer to figure out then I care so 92:38 Speaker A now if we do we administrator on the earth one probably local system on the server because we use PS exec I bet if we use W my exact will be administrator Who am I and with system let's do W my 92:56 Speaker A exec so PS exec on the impacted version is always going to be system but now it W my exact we administrator let us do that totally does not exist CP apparently doesn't exist and we can export is equal to this and we can see 93:29 Speaker A if we can make ourselves say where this user okay moment of truth client not found so I don't think we actually can do that in domain controller put kv v CC named totally does not exist c cash let's just do the ticket again 94:18 Speaker A and get a new ticket with the new timestamp to double validate but i'm guessing on domain controllers you can't impact it grep what i want to grip for example CD here so take it a does not exist and we can 94:56 Speaker A export this to does not exist PS exec does not exist at forest it works so I wonder if before that's ticket we had we were doing like not fully qualified domain name because that would definitely affect it so let's do W 95:25 Speaker A my exact come on and ESPN is true just work for PS exact come on maybe it doesn't work on W my exact with invalid user so most n ESPN true ping HT be local we're paying it let's see let's copy does not 96:28 Speaker A exist to HB box is forest go there and run this version W my exactly this is the latest version instead of using the one out of that one directory still has the issue but PS exact doesn't weird wait yeah for a user no usernames or 97:05 Speaker A your system I'm actually confused why w mi exact doesn't work but it's been repeated doesn't work for some reason he has exact does with this probably some type of impact bug I bet if we're in Windows we could get a PS exact session 97:25 Speaker A as a user that does not exist but for some reason using impact we can and the reason for the PS exec working on Windows is because PS exact doesn't always impersonate the service I don't know if that's a flag here a binary name 97:42 Speaker A service name yeah so he is exact on Linux always what to put you as the system user it doesn't have the option to not impersonate to user you logged in as but that'll be the Box hope you enjoyed this last part I 98:00 Speaker A know as frustrating was frustrating for me too but at least now you should know how to do golden ticketing on Linux and some common issues you may run into take care all I'll see you all next week Topics: HackTheBox Forest Active Directory AS-REP roasting LDAP enumeration BloodHound DCSync Kerberos Penetration testing Windows privilege escalation Study this video - [Flashcards from this video](https://sozai.app/tools/flashcard-maker/?from=transcript&id=91422) - [Quiz on this video](https://sozai.app/tools/quiz-generator/?from=transcript&id=91422) - [Crossword from this video](https://sozai.app/tools/crossword-maker/?from=transcript&id=91422) - [Word search from this video](https://sozai.app/tools/word-search-maker/?from=transcript&id=91422) - [Study guide from this video](https://sozai.app/tools/study-guide-maker/?from=transcript&id=91422) Free, made by AI from this transcript. No signup. --- This is the markdown twin of https://sozai.app/transcript/hackthebox-forest/ โ€” the same content, without the markup. Published by SozAI (https://sozai.app). Reuse and quotation are allowed with attribution and a link back. Machine-readable index: https://sozai.app/llms.txt ยท data API: https://sozai.app/api/