https://ctf-hallllow.blog/tags/asrep-roasting/ Recent content in Asrep-Roasting on hallllow Hugo en-us Thu, 08 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/forest/ Thu, 08 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/forest/ HTB Forest (Easy). A read-only domain controller leaks its user list over an SMB null session. One account, svc-alfresco, has Kerberos pre-auth disabled, so we AS-REP roast it, crack the hash, and log in over WinRM. BloodHound then reveals an ACL path to Domain Admin: GenericAll on Exchange Windows Permissions grants WriteDACL over the domain, which we turn into DCSync rights and dump the Administrator hash.