Video summary

HackTheBox | Forest [OSCP Style] (TWITCH LIVE)

Main summary

Key takeaways

Technology

Tech / security focus of the stream

  • OSCP-style workflow on Hack The Box “Forest” (Active Directory) The speaker repeatedly frames the session as “OSCP style”, starting with verifying the target machine is online, then moving through a classic chain: recon → service discovery → enumeration → credential abuse → privilege escalation.

  • Environment + practice resources

    • Mentions an Excel spreadsheet listing academy / Hack The Box machines, plus a direct link to access machines and materials.
    • Refers to building/using a Linux-based lab setup (Parrot / “Linux customization course” upcoming).
    • Notes that course content/videos can become outdated on platforms like YouTube, so the academy focuses on continually updated, “evergreen” materials.

Detailed technical content (Forest / Active Directory attack chain)

1) Target discovery and IP handling

  • Uses a ping/ICMP check to confirm the Windows host is online.
  • Mentions an IP “off by one” observation (Linux .1-style range confusion), explained by differences between the attacker’s/scan viewpoint vs. victim addressing.

2) Custom script usage for scanning

  • Introduces and uses a custom pingscript / Python3-style utility to report OS/services (subtitles are messy, but the intent is automated recognition and helper scripts).
  • Uses Nmap for scanning:
    • Scans TCP ports 1–65535
    • Uses fast/stealth-oriented flags (subtitles reference “stealth”, “fast”, and minimizing DNS resolution/output)
    • Exports results in formats suitable for later processing (e.g., XML / console-like output)

3) Service detection and basic Windows enumeration

  • After finding open ports, focuses on common Windows / domain controller-related services:
    • SMB (445)
    • Kerberos (88)
    • RPC/SMB-related services
  • Uses the concept of crackmapexec to identify the system type and concludes:
    • Windows Server 2016 (Standard, 64-bit)
    • Likely domain controller / Active Directory context

4) Null/anonymous SMB probing

  • Attempts anonymous SMB authentication and checks for shared resources.
  • If no shares are found, the workflow shifts to domain-focused attacks rather than SMB share enumeration.

5) DNS / virtual-host style subdomain resolution attempt

  • Notes port 53 (DNS) is open and performs DNS/zone-oriented enumeration / transfer-style checks (subtitles reference transfer-style concepts).
  • Uses /etc/hosts-style mapping to resolve hostnames/subdomains for targeted follow-up requests.

6) Domain controller user enumeration (RPC / SAMR / null auth idea)

  • Uses an RPC client approach to enumerate domain users:
    • Connects with no/weak credentials (subtitles imply “null/guest-like” access for enumeration)
    • Retrieves a list of users
    • Filters usernames using regular expressions to build a user dictionary

7) Kerberos abuse for crackable material (AS-REP Roasting concept)

  • Performs a Kerberos-based attack to request DGT/tickets / obtain hashes for offline cracking.
  • The approach described includes:
    • Selecting users “configured” to allow ticket/hash retrieval without normal authentication
    • Producing a hash suitable for the cracking stage

8) Offline password cracking with a large wordlist

  • Uses a large password dictionary (subtitles reference a rockyou-like list and ~14 million passwords).
  • Performs offline cracking to recover the valid password, then reuses the credentials for further access.

9) Valid credential verification and remote admin foothold

  • After obtaining credentials:
    • Verifies access using remote Windows management interfaces (subtitles reference WinRM)
    • Confirms the user’s group memberships related to privilege, such as Remote Management Users / relevant service account groups
  • Achieves interactive access (subtitles reference remote shell / interactive console).

Neo4j / BloodHound-based privilege escalation pathing

  • Uses BloodHound (subtitles reference “blood house/hound”) and graph tooling:
    • Runs collection and export via a target-created zip/datapoints workflow
    • Mentions Neo4j as the graph backend and the BloodHound GUI/web
  • Core idea:
    • Build a graph of AD relationships (users, groups, sessions/privileges)
    • Identify attack paths from the compromised account to Domain Admin

The described escalation flow includes:

  • Abusing group permissions
  • Creating a new user, adding it to groups using AD management operations
  • Using PowerShell/PowerView-style scripting to set rights (subtitles reference PowerView / PowerSploit-like usage)

Outcome:

  • The attacker account gains the ability to enumerate/administer Domain Admin context.
  • The stream ends with retrieving the user flag / administrator flag in the lab environment.

Conceptual side discussion: Active Directory value/limitations

  • The speaker debates whether Active Directory is “overrated”, arguing:
    • Some smaller companies may not need it
    • AD remains common, but it can be complex
    • Understanding it matters because AD compromise enables broader lateral movement than simpler local-domain setups
  • Notes a “charging for maintenance” viewpoint: organizations still pay to maintain complex AD ecosystems.
  • Emphasizes that compromise paths differ by environment architecture.

Review / guide / course-management highlights (non-technical but product/review relevant)

  • Academy-style learning benefits

    • Claims the academy provides step-by-step courses
    • Content is updated to avoid YouTube’s “expired/not evergreen” issue
    • Encourages leaving reviews/ratings/comments on the academy materials

  • Course pipeline

    • Mentions an upcoming Linux customization course (step-by-step updates)
    • Mentions an introduction to hacking course in development, described as “OSCP-style fundamentals-first”

  • Access model

    • Points/subscription mechanics are discussed (subtitles reference point thresholds for one-day access/subscription redemption)
    • Mentions possible removal/reorganization of social media/video sources to reduce indexing/content-expiration problems

Main speakers / sources (as inferred from subtitles)

  • Main speaker/host: “Tito” (teacher/streamer; runs the academy and explains the Forest walkthrough)
  • Occasional reference: “Diego” (co-organizer/partner mentioned)
  • Tools referenced (not speakers): Hack The Box (Forest), Nmap, CrackMapExec, BloodHound + Neo4j, PowerView/PowerSploit-like scripts, WinRM, and other AD/security utilities.

Original video