For the complete documentation index, see llms.txt. This page is also available as Markdown.

DC02 + DC01

DarkHaven Technologies - Range (Medium) - by Ryan Yager

The following post by 0xb0b is licensed under CC BY 4.0


Entry Point

Reference:

DC02

Recon

We use rustscan -b 500 -a dc02.darkhaven.tech --top -- -sC -sV -Pn to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts -sC, service and version detection -sV, and treats the host as online without ICMP echo -Pn.

A batch size of 500 trades speed for stability, the default 1500 balances both, while much larger sizes increase throughput but risk missed responses and instability.

The target machine is the domain controller of the darkhaven.tech domain with exposed services including DNS 53, Kerberos 88/464, an IIS /10.0 web server on port 80, multiple MSRPC endpoints 135, 593, 49664+, SMB 139/445, LDAP and LDAPS 389/636/3268/3269 tied to Active Directory, RDP 3389, WinRM on 5985, and .NET Remoting 9389.

Access as ldap_svc

Recalling the hardcoded credentials of ldap_svc found in the binary located at DC.EXT.DARKHAVEN.LOCAL. We try to connect to the other Domain Controllers using NetExec.

We successfully compromised DC02.DARKHAVEN.TECH, the user has administrative permissions. To ensure stability, we used the --smb-timeout 30 option, since NetExec may fail when SMB requests are sent too rapidly.

We connect to the Domain Controller using evil-winrm.

We find the flag at C:\Users\Administrator\Desktop\root.txt.

We enumerate the domain using SharpHound.

After ingesting the data we can see a bi-directional trust relationship between the child and parent domain controller.

In a bidirectional trust, both domains honor Kerberos tickets issued by each other’s KDC. By compromising the child domain, we can extract its krbtgt key and forge a Golden Ticket. Since SID filtering is disabled, we can inject a privileged SID (e.g., Enterprise Admins from the parent domain) into the ticket’s SIDHistory. The parent domain will accept this SID, effectively granting us elevated privileges across the forest.

DC01

Recon

We use rustscan -b 500 -a dc01.darkhaven.tech --top -- -sC -sV -Pn to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts -sC, service and version detection -sV, and treats the host as online without ICMP echo -Pn.

A batch size of 500 trades speed for stability, the default 1500 balances both, while much larger sizes increase throughput but risk missed responses and instability.

The target machine is the domain controller of the darkhaven.tech domain with exposed services including DNS 53, Kerberos 88/464, an IIS /10.0 web server on port 80, multiple MSRPC endpoints 135, 593, 49664+, SMB 139/445, LDAP and LDAPS 389/636/3268/3269 tied to Active Directory, RDP 3389, WinRM on 5985, and .NET Remoting 9389.

Access as administrator

While attempting a Golden Ticket attack, the attempt initially failed because I had incorrectly identified the parent domain user I intended to impersonate.

So a fallback can be the Impackes raiseChild.py script. With raiseChild.py we perform a secretsdump and retreive the Administrators hash.

Impacket's raiseChild.py script can also be used to conduct the golden ticket technique automatically when SID filtering is disabled

We use the hash to connect to the final domain controller using the hash. We find the final flag at C:\Users\Administrator\Dekstop\root.txt.

Last updated