Forest 212
RETIRED MACHINE
Windows
Easy
Forest
Windows
Easy
4.6
MACHINE RATING26077
USER OWNS20653
SYSTEM OWNS12/10/2019
RELEASEDMachine Synopsis
Forest is an easy Windows machine that showcases a Domain Controller (DC) for a domain in which Exchange Server has been installed. The DC allows anonymous LDAP binds, which are used to enumerate domain objects. The password for a service account with Kerberos pre-authentication disabled can be cracked to gain a foothold. The service account is found to be a member of the Account Operators group, which can be used to add users to privileged Exchange groups. The Exchange group membership is leveraged to gain DCSync privileges on the domain and dump the NTLM hashes, compromising the system.
Machine Matrix
