Machine IP: 10.10.10.161
OS: Windows Server 2016 (Domain Controller)
Domain: htb.local
Difficulty: Medium
Before touching the target, ensure you have: forest hackthebox walkthrough best
| Port | Service | State | Observation |
|------|---------|-------|--------------|
| 53 | DNS | Open | Domain: htb.local |
| 88 | Kerberos | Open | Key Distribution Center |
| 135 | MSRPC | Open | |
| 139/445 | SMB | Open | NetBIOS |
| 389 | LDAP | Open | Anonymous bind allowed? |
| 5985 | WinRM | Open | Potential for remote execution |
| 9389 | .NET Remoting | Open | | Forest – HTB Walkthrough
Machine IP: 10
However, a more straightforward approach involves using Impacket to execute a command as root. Exploitation Path : Create a new user on the domain
The Vulnerability: Your user (svc-alfresco) is likely a member of the Account Operators group, which has permissions to create and modify users. Exploitation Path: Create a new user on the domain.