> For the complete documentation index, see [llms.txt](https://0xb0b.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xb0b.gitbook.io/writeups/hack-smarter-labs/2026/darkhaven-technologies/ca.md). # CA {% embed url="" %} The following post by 0xb0b is licensed under [CC BY 4.0

](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1) *** ## Entry Point {% hint style="warning" %} Continue here if you were able to fully compromise WEB.EXT.DARKHAVEN.LOCAL and gain access as kwarren {% endhint %} Reference: {% embed url="" %} ## Recon We use `rustscan -b 500 -a ca.ext.darkhaven.local --top -- -sC -sV -Pn` to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts `-sC`, service and version detection `-sV`, and treats the host as online without ICMP echo `-Pn`. A batch size of `500` trades speed for stability, the default `1500` balances both, while much larger sizes increase throughput but risk missed responses and instability. {% code overflow="wrap" %} ``` rustscan -b 500 -a ca.ext.darkhaven.local --top -- -sC -sV -Pn ``` {% endcode %}

Recalling the credentials found of `kwarren` on the WEB machine and confirming access as that user. We look into our BloodHound results.

{% code overflow="wrap" %} ``` nxc smb web.ext.darkhaven.local -u kwarren -p 'REDACTED' --shares ``` {% endcode %}

## BloodHound Enumeration Here we see that the `kwarren` user is member of the group `grp-gmsa-ca_svc_account_readers`.

## Access as administrator With that permission we can potentially read the group managed service accounts password of the account. {% embed url="" %} > This abuse stands out a bit from other abuse cases. It can be carried out when controlling an object that has enough permissions listed in the target gMSA account's `msDS-GroupMSAMembership` attribute's DACL. Usually, these objects are principals that were configured to be explictly allowed to use the gMSA account. > > The attacker can then read the gMSA (group managed service accounts) password of the account if those requirements are met. For this we are using NetExec and are able to retrieve the hash of `ca_svc_account$`. {% code overflow="wrap" %} ``` nxc ldap dc.ext.darkhaven.local -u kwarren -p 'REDACTED' --gmsa ``` {% endcode %}

We are now able to authenticate as `ca_svc_account$`. This user is local admin on the target machine CA. {% code overflow="wrap" %} ``` nxc smb ca.ext.darkhaven.local -u 'ca_svc_account$' -H 'REDACTED' --shares ``` {% endcode %}

Since we are local admin we try to dump the SAM secrets and retrieve the local admin hash. {% code overflow="wrap" %} ``` nxc smb ca.ext.darkhaven.local -u 'ca_svc_account$' -H 'REDACTED' --sam ``` {% endcode %}

With that we are able to get a evil-winrm session and find the `CA` flag at `C:\Users\Administrator\Desktop\root.txt.txt`. {% code overflow="wrap" %} ``` evil-winrm -i ca.ext.darkhaven.local -u 'Administrator' -H REDACTED ``` {% endcode %}

## Post Compromise ### Access as ldap\_svc On the machine we find a PowerShell commandline history. But due to encoding errors we cannot read the contents in our evil-winrm session.

For a workaround we will use Impackets smbclient. We'll connect as the local administrator, use the `C$` share and download the commandline history to our system. {% code overflow="wrap" %} ``` smbclient.py CA/Administrator@ca.ext.darkhaven.local -hashes :REDACTED ``` {% endcode %}

Inside that we identify several credentials for different users.

Among them for the `ldap_svc account`.

Unfortunately the account has the `STATUS_ACCOUNT_RESTRICTION` flag, we cannot authenticate yet. {% code overflow="wrap" %} ``` nxc smb dc.ext.darkhaven.local -u 'ldap_svc' -p 'REDACTED' --smb-timeout 30 ``` {% endcode %}

{% hint style="warning" %} From here, we can move on to DC.EXT.DARKHAVEN.LOCAL. {% endhint %} {% embed url="" %}