Forest

Tue, 23 Jun 2026 00:00:00 +0000

Introduction

Forest is an easy Windows machine, but it is easy only if you already speak Active Directory. There is no web app, no CVE, no memory corruption. The whole box is a chain of AD misconfigurations that you unlock by reading enumeration output and by trusting what BloodHound draws for you.

The path looks like this: the domain controller allows an anonymous RPC session, which leaks the full list of domain users. One of those users, svc-alfresco, has Kerberos pre-authentication disabled, so we AS-REP roast his hash and crack it offline. That shell drops us into a domain where svc-alfresco sits (through nested groups) inside Account Operators, giving him control over the Exchange Windows Permissions group. That group holds WriteDACL over the domain object, which is the textbook road to DCSync and, from there, the Administrator hash.

Dcsync on appl3b0y

Forest

Introduction