> For the complete documentation index, see [llms.txt](https://0xb0b.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xb0b.gitbook.io/writeups/hack-smarter-labs/2026/darkhaven-technologies.md).

# DarkHaven Technologies

Range (Medium) - by Ryan Yager

{% embed url="<https://www.hacksmarter.org/courses/87ee7584-c4bf-4536-9f97-f5431838cff3/>" %}

The following post by 0xb0b is licensed under [CC BY 4.0<img src="https://mirrors.creativecommons.org/presskit/icons/cc.svg?ref=chooser-v1" alt="" data-size="line"><img src="https://mirrors.creativecommons.org/presskit/icons/by.svg?ref=chooser-v1" alt="" data-size="line">](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1)

***

## Scenario

### Objective/Scope <a href="#user-content-objectivescope" id="user-content-objectivescope"></a>

Darkhaven Technologies is a networking organization based throughout the world with locations in NY, CA, Japan, and more. They have segregated their network and would like to a Red Team engagement to see if a user is able to move throughout the different networks.

A Close Access Team has infiltrated Darkhaven Technologies and dropped a machine for you on the internal network that you can connect to through OpenVPN. This machine should allow you to see the entire global network, as it was dropped on a port that is within the global VLAN. The Close Access Team relayed information that they overheard about the Web Portal being worked on at this time.

## Sections

<table data-view="cards"><thead><tr><th></th><th data-hidden data-card-cover data-type="image">Cover image</th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td>web.ext.darkhaven</td><td><a href="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FH1rzuJtFzWNMOz663Tuj%2FWEB.png?alt=media&amp;token=f072f273-fae9-4273-84b3-b901cfce3c08">WEB.png</a></td><td><a href="/writeups/hack-smarter-labs/2026/darkhaven-technologies/web.md">WEB</a></td></tr><tr><td>sql.ext.darkhaven.local</td><td><a href="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FF3PVQ0imgq6YjFBOgVpz%2FSQL.png?alt=media&amp;token=367ad143-95af-4354-b152-5e088714117e">SQL.png</a></td><td><a href="/writeups/hack-smarter-labs/2026/darkhaven-technologies/sql.md">SQL</a></td></tr><tr><td>share.ext.darkhaven.local</td><td><a href="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FiZoIp5o7FSrgAaqNnrac%2FSHARE.png?alt=media&amp;token=9666ef11-7841-4011-9e75-ad331133dba4">SHARE.png</a></td><td><a href="/writeups/hack-smarter-labs/2026/darkhaven-technologies/share.md">SHARE</a></td></tr><tr><td>ca.ext.darkhaven.local</td><td><a href="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FE0bEcwDKdTgfXLK0FnJd%2FCA.png?alt=media&amp;token=09ce1755-6166-4d9c-8072-a2d0ca21811a">CA.png</a></td><td><a href="/writeups/hack-smarter-labs/2026/darkhaven-technologies/ca.md">CA</a></td></tr><tr><td>dc.ext.darkhaven.local</td><td><a href="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FgDdBFqSmU1E0MebNAcBc%2Fdc%2Bext.png?alt=media&amp;token=083aa1ed-f857-4807-b4c3-9d6af5fc2476">dc+ext.png</a></td><td><a href="/writeups/hack-smarter-labs/2026/darkhaven-technologies/dc-ext.md">DC EXT</a></td></tr><tr><td>corp.darkhaven.tech<br>darkhaven.tech</td><td><a href="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FQcNnXr8r8uHjOjUIhQT0%2Fdc02%2Bdc01.png?alt=media&amp;token=9f7f9122-7492-4b72-83b4-333c68092113">dc02+dc01.png</a></td><td><a href="/writeups/hack-smarter-labs/2026/darkhaven-technologies/dc02-+-dc01.md">DC02 + DC01</a></td></tr></tbody></table>

## Network Overview

### Subnet 1 10.10.10.0/25

<table><thead><tr><th width="122.9166259765625">IP Address</th><th width="82.5001220703125">Host</th><th width="334.5001220703125">Hostname</th><th>Purpose</th></tr></thead><tbody><tr><td>10.10.10.4</td><td>DC01</td><td>DC.DARKHAVEN.TECH</td><td>Domain Controller</td></tr><tr><td>10.10.10.5</td><td>DC02</td><td>DC02.CORP.DARKHAVEN.TECH</td><td>Child Domain Controller</td></tr></tbody></table>

### Subnet 2 10.10.10.128/25

<table><thead><tr><th width="122.75">IP Address</th><th width="83.4166259765625">Host</th><th width="335.083251953125">Hostname</th><th>Purpose</th></tr></thead><tbody><tr><td>10.10.10.132</td><td>WEB</td><td>WEB.EXT.DARKHAVEN.LOCAL</td><td>Web Server</td></tr><tr><td>10.10.10.133</td><td>SQL</td><td>SQL.EXT.DARKHAVEN.LOCAL</td><td>SQL Server</td></tr><tr><td>10.10.10.134</td><td>CA</td><td>CA.EXT.DARKHAVEN.LOCAL</td><td>Certificate Authority</td></tr><tr><td>10.10.10.135</td><td>SHARE</td><td>SHARE.EXT.DARKHAVEN.LOCAL</td><td>File Server</td></tr><tr><td>10.10.10.136</td><td>DC</td><td>WEB.EXT.DARKHAVEN.LOCAL</td><td>Domain Controller</td></tr></tbody></table>