DarkZero — HTB Writeup | The Hack Sparrow

Executive summary — DarkZero is a Hard Active Directory box with two domains connected by a trust relationship, in a multihomed, split-horizon-DNS setup. In assume-breach mode (john.w) we attack MSSQL on DC01: although john.w has no privileges for xp_cmdshell there, a misconfigured linked server runs our queries on DC02 (external domain darkzero.ext) as the more privileged dc01_sql_svc account. With RCE on DC02 we pivot with Ligolo-ng into the internal network, set up a stable Meterpreter shell, escalate to SYSTEM via CVE-2024-30088, and — as SYSTEM — capture DC01's machine-account TGT mid-flight by coercing its authentication against DC02 (Rubeus + xp_dirtree). That ticket enables a DCSync against the real domain and Pass-the-Hash as Administrator.

Platform	Hack The Box
Operating system	Windows
Difficulty	Hard
Status	Retired
Target IP	`10.129.16.247`
Vector	MSSQL linked server → internal pivot → Kerberos ticket theft

Attack map

[1] Recon -- 1433 MSSQL + DC ports; DNS reveals an internal interface 172.16.20.1 (multihomed)
        |
[2] MSSQL (john.w) on DC01 -- enum_links -> DC02.darkzero.ext (linked server)
      xp_cmdshell denied on DC01, but use_link DC02 + enable_xp_cmdshell DOES work
      (the linked server uses dc01_sql_svc, more privileged)
        |
[3] Ligolo-ng -- agent uploaded via xp_cmdshell/certutil -> tunnel into 172.16.20.0/24
        |
[4] Stable Meterpreter (xp_cmdshell + certutil + msfvenom) -> darkzero-ext\svc_sql
        |
[5] CVE-2024-30088 (authz TOCTOU) -> NT AUTHORITY\SYSTEM on DC02  ->  user.txt
        |
[6] Rubeus monitor (as SYSTEM) + xp_dirtree \\DC02.darkzero.ext\test from DC01 ->
      captures DC01$'s (machine account) TGT mid-flight
        |
[7] ticketConverter -> KRB5CCNAME -> secretsdump -k -just-dc -> darkzero.htb NTDS
      +-> Pass-the-Hash as Administrator  ->  root.txt

1. Reconnaissance — the hidden network

nmap -p 1-65535 -T4 -A -v 10.129.16.247

Relevant ports: 1433 (MS-SQL), 88 (Kerberos), 389/636 (LDAP/LDAPS), 5985 (WinRM), 445 (SMB). Port 1433 stands out: SQL servers often carry elevated privileges and interesting configurations like linked servers.

dig @10.129.16.247 ANY darkzero.htb

The DNS answer reveals two interfaces: 10.129.16.247 (external, the one we can reach) and 172.16.20.1 (internal, hidden). This is a multihomed host: one network card per segment. We're in the front room, but there's another one behind it.

echo "10.129.16.247 DC01.darkzero.htb darkzero.htb" | sudo tee -a /etc/hosts

crackmapexec smb 10.129.16.247 -u 'john.w' -p 'RFulUtONCOL!' -d darkzero.htb

Authentication succeeds, but only default shares are visible — need to dig deeper.

Resumen ejecutivo — DarkZero es un Hard de Active Directory con dos dominios conectados por una relación de confianza, en una arquitectura multihomed con DNS de horizonte dividido. En modo assume-breach (john.w) atacamos MSSQL en DC01: aunque john.w no tiene privilegios para xp_cmdshell ahí, un linked server mal configurado ejecuta nuestras consultas en DC02 (dominio externo darkzero.ext) con la cuenta más privilegiada dc01_sql_svc. Con RCE en DC02 pivotamos con Ligolo-ng a la red interna, montamos una shell Meterpreter estable, escalamos a SYSTEM con CVE-2024-30088 y, ya como SYSTEM, capturamos en vuelo el TGT de la cuenta de máquina de DC01 forzando su autenticación contra DC02 (Rubeus + xp_dirtree). Ese ticket permite un DCSync sobre el dominio real y Pass-the-Hash como Administrator.

Plataforma	Hack The Box
Sistema operativo	Windows
Dificultad	Hard
Estado	Retired
IP objetivo	`10.129.16.247`
Vector	MSSQL linked server → pivote interno → robo de tickets Kerberos

Mapa del ataque

[1] Recon -- 1433 MSSQL + puertos de DC; DNS revela interfaz interna 172.16.20.1 (multihomed)
        |
[2] MSSQL (john.w) en DC01 -- enum_links -> DC02.darkzero.ext (linked server)
      xp_cmdshell denegado en DC01, pero use_link DC02 + enable_xp_cmdshell SI funciona
      (el linked server usa dc01_sql_svc, mas privilegiado)
        |
[3] Ligolo-ng -- agente subido via xp_cmdshell/certutil -> tunel a 172.16.20.0/24
        |
[4] Meterpreter estable (xp_cmdshell + certutil + msfvenom) -> darkzero-ext\svc_sql
        |
[5] CVE-2024-30088 (TOCTOU en authz) -> NT AUTHORITY\SYSTEM en DC02  ->  user.txt
        |
[6] Rubeus monitor (como SYSTEM) + xp_dirtree \\DC02.darkzero.ext\test desde DC01 ->
      captura del TGT de DC01$ (cuenta de maquina) mid-flight
        |
[7] ticketConverter -> KRB5CCNAME -> secretsdump -k -just-dc -> NTDS de darkzero.htb
      +-> Pass-the-Hash como Administrator  ->  root.txt

1. Reconocimiento — la red oculta

nmap -p 1-65535 -T4 -A -v 10.129.16.247

Puertos relevantes: 1433 (MS-SQL), 88 (Kerberos), 389/636 (LDAP/LDAPS), 5985 (WinRM), 445 (SMB). El 1433 destaca: los servidores SQL suelen tener privilegios elevados y configuraciones interesantes como los linked servers.

dig @10.129.16.247 ANY darkzero.htb

La respuesta DNS revela dos interfaces: 10.129.16.247 (externa, la que alcanzamos) y 172.16.20.1 (interna, oculta). Es un host multihomed: una tarjeta de red en cada segmento. Estamos en la habitación de delante, pero hay otra detrás.

echo "10.129.16.247 DC01.darkzero.htb darkzero.htb" | sudo tee -a /etc/hosts

crackmapexec smb 10.129.16.247 -u 'john.w' -p 'RFulUtONCOL!' -d darkzero.htb

Autenticación válida, pero solo con acceso a los shares por defecto: hay que profundizar.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.