> For the complete documentation index, see [llms.txt](https://0xb0b.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xb0b.gitbook.io/writeups/hack-smarter-labs/2026/darkhaven-technologies/dc-ext.md). # DC EXT {% embed url="" %} The following post by 0xb0b is licensed under [CC BY 4.0

](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1) *** ## Entry Point {% hint style="warning" %} Continue here if you were able to fully compromise CA.EXT.DARKHAVEN.LOCAL and gain access as ldap\_svc {% endhint %} Reference: {% embed url="" %} ## Recon We use `rustscan -b 500 -a dc.ext.darkhaven.local --top -- -sC -sV -Pn` to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts `-sC`, service and version detection `-sV`, and treats the host as online without ICMP echo `-Pn`. A batch size of `500` trades speed for stability, the default `1500` balances both, while much larger sizes increase throughput but risk missed responses and instability. {% code overflow="wrap" %} ``` rustscan -b 500 -a dc.ext.darkhaven.local --top -- -sC -sV -Pn ``` {% endcode %}

The target machine is the domain controller of the `ext.darkhaven.local` domain with exposed services including DNS `53`, Kerberos `88/464`, an `IIS /10.0` web server on port `80`, multiple MSRPC endpoints `135, 593, 49664+`, SMB `139/445`, LDAP and LDAPS `389/636/3268/3269` tied to Active Directory, RDP `3389`, WinRM on `5985`, and .NET Remoting `9389`.

{% code overflow="wrap" %} ``` 10.10.10.136 DC.ext.darkhaven.local ext.darkhaven.local DC ``` {% endcode %} ## Access as ldap\_svc From compromising the CA host we were able to retrieve the credentials of `ldap_svc`. But we were not able to successfully authenticate with that since the account is restricted using a password. {% code overflow="wrap" %} ``` nxc smb dc.ext.darkhaven.local -u 'ldap_svc' -p 'REDACTED' --smb-timeout 30 ``` {% endcode %}

To work around this, Kerberos authentication can be used instead. By requesting a Ticket Granting Ticket (TGT), we authenticate via Kerberos, which does not enforce the same logon restrictions. Request a Kerberos TGT for the `ldap_svc` account: {% code overflow="wrap" %} ``` getTGT.py 'ext.darkhaven.local/ldap_svc:6trfgvb**hs#@jskKFHJAh34' -dc-ip dc.ext.darkhaven.local ``` {% endcode %}

Set the Kerberos ticket cache environment variable {% code overflow="wrap" %} ``` export KRB5CCNAME=ldap_svc.ccache ``` {% endcode %}

Authenticate to SMB using Kerberos and we succesfully logged in. We see we are an administrator. {% code overflow="wrap" %} ``` nxc smb dc.ext.darkhaven.local -u ldap_svc -k --use-kcache ``` {% endcode %}

## Access as administrator Since we are an administrator we try to dump all secrets using secretsdump.py. {% code overflow="wrap" %} ``` secretsdump.py -k -no-pass dc.ext.darkhaven.local ``` {% endcode %}

We retrieve the local administrator hash and connect to the external DC via evil-winrm. We find the flag at `C:\Users\Administrator\Desktop\root.txt`.

## Post Compromise ### Access as ldap\_svc on DC02 Besides the flag we find binary on the Desktop of the administrator.

We download it to oour machine...

And inspect it via strings. {% code overflow="wrap" expandable="true" %} ``` strings ldap_sync.exe ``` {% endcode %}

Inside that binary we find hardcoded credentials of ldap\_svc. But the password is a different one. It seems to perform an ldap sync between the DCs by reading the comments.

We try to authenticate to the other DCs and are successful with `DC02.DARKHAVEN.TECH.` {% code overflow="wrap" expandable="true" %} ``` nxc smb dc02.darkhaven.tech -u 'ldap_svc' -p 'REDACTED' --smb-timeout 30 ``` {% endcode %}

{% hint style="warning" %} From here, we can move on to DC02 and DC01 of DARKHAVEN.TECH. {% endhint %} {% embed url="" %}