DC02 + DC01
DarkHaven Technologies - Range (Medium) - by Ryan Yager
The following post by 0xb0b is licensed under CC BY 4.0
Entry Point
Continue here if you were able to fully compromise DC.EXT.DARKHAVEN.LOCAL and gain access as ldap_svc on DC02.DARKHAVEN.TECH
Reference:
DC02
Recon
We use rustscan -b 500 -a dc02.darkhaven.tech --top -- -sC -sV -Pn to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts -sC, service and version detection -sV, and treats the host as online without ICMP echo -Pn.
A batch size of 500 trades speed for stability, the default 1500 balances both, while much larger sizes increase throughput but risk missed responses and instability.
The target machine is the domain controller of the darkhaven.tech domain with exposed services including DNS 53, Kerberos 88/464, an IIS /10.0 web server on port 80, multiple MSRPC endpoints 135, 593, 49664+, SMB 139/445, LDAP and LDAPS 389/636/3268/3269 tied to Active Directory, RDP 3389, WinRM on 5985, and .NET Remoting 9389.
Access as ldap_svc
Recalling the hardcoded credentials of ldap_svc found in the binary located at DC.EXT.DARKHAVEN.LOCAL. We try to connect to the other Domain Controllers using NetExec.
We successfully compromised DC02.DARKHAVEN.TECH, the user has administrative permissions. To ensure stability, we used the --smb-timeout 30 option, since NetExec may fail when SMB requests are sent too rapidly.
We connect to the Domain Controller using evil-winrm.
We find the flag at C:\Users\Administrator\Desktop\root.txt.
We enumerate the domain using SharpHound.
After ingesting the data we can see a bi-directional trust relationship between the child and parent domain controller.
In a bidirectional trust, both domains honor Kerberos tickets issued by each other’s KDC. By compromising the child domain, we can extract its krbtgt key and forge a Golden Ticket.
Since SID filtering is disabled, we can inject a privileged SID (e.g., Enterprise Admins from the parent domain) into the ticket’s SIDHistory. The parent domain will accept this SID, effectively granting us elevated privileges across the forest.
DC01
Recon
We use rustscan -b 500 -a dc01.darkhaven.tech --top -- -sC -sV -Pn to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts -sC, service and version detection -sV, and treats the host as online without ICMP echo -Pn.
A batch size of 500 trades speed for stability, the default 1500 balances both, while much larger sizes increase throughput but risk missed responses and instability.
The target machine is the domain controller of the darkhaven.tech domain with exposed services including DNS 53, Kerberos 88/464, an IIS /10.0 web server on port 80, multiple MSRPC endpoints 135, 593, 49664+, SMB 139/445, LDAP and LDAPS 389/636/3268/3269 tied to Active Directory, RDP 3389, WinRM on 5985, and .NET Remoting 9389.
Access as administrator
While attempting a Golden Ticket attack, the attempt initially failed because I had incorrectly identified the parent domain user I intended to impersonate.
So a fallback can be the Impackes raiseChild.py script. With raiseChild.py we perform a secretsdump and retreive the Administrators hash.
Impacket's raiseChild.py script can also be used to conduct the golden ticket technique automatically when SID filtering is disabled
We use the hash to connect to the final domain controller using the hash. We find the final flag at C:\Users\Administrator\Dekstop\root.txt.
Last updated