> For the complete documentation index, see [llms.txt](https://0xb0b.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xb0b.gitbook.io/writeups/hack-smarter-labs/2026/darkhaven-technologies/dc02-+-dc01.md). # DC02 + DC01 {% embed url="" %} The following post by 0xb0b is licensed under [CC BY 4.0

](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1) *** ## Entry Point {% hint style="warning" %} Continue here if you were able to fully compromise DC.EXT.DARKHAVEN.LOCAL and gain access as ldap\_svc on DC02.DARKHAVEN.TECH {% endhint %} Reference: {% embed url="" %} ## DC02 ### Recon We use `rustscan -b 500 -a dc02.darkhaven.tech --top -- -sC -sV -Pn` to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts `-sC`, service and version detection `-sV`, and treats the host as online without ICMP echo `-Pn`. A batch size of `500` trades speed for stability, the default `1500` balances both, while much larger sizes increase throughput but risk missed responses and instability. {% code overflow="wrap" %} ``` rustscan -b 500 -a dc02.darkhaven.tech --top -- -sC -sV -Pn ``` {% endcode %}

The target machine is the domain controller of the `darkhaven.tech` domain with exposed services including DNS `53`, Kerberos `88/464`, an `IIS /10.0` web server on port `80`, multiple MSRPC endpoints `135, 593, 49664+`, SMB `139/445`, LDAP and LDAPS `389/636/3268/3269` tied to Active Directory, RDP `3389`, WinRM on `5985`, and .NET Remoting `9389`.

### Access as ldap\_svc Recalling the hardcoded credentials of `ldap_svc` found in the binary located at `DC.EXT.DARKHAVEN.LOCAL`. We try to connect to the other Domain Controllers using NetExec. {% code overflow="wrap" expandable="true" %} ``` strings ldap_sync.exe ``` {% endcode %}

We successfully compromised `DC02.DARKHAVEN.TECH`, the user has administrative permissions. To ensure stability, we used the `--smb-timeout 30` option, since NetExec may fail when SMB requests are sent too rapidly. {% code overflow="wrap" expandable="true" %} ``` nxc smb dc02.darkhaven.tech -u 'ldap_svc' -p 'REDACTED' --smb-timeout 30 ``` {% endcode %}

We connect to the Domain Controller using evil-winrm. {% code overflow="wrap" expandable="true" %} ``` evil-winrm -i dc02.darkhaven.tech -u 'ldap_svc' -p 'REDACTED' ``` {% endcode %}

We find the flag at `C:\Users\Administrator\Desktop\root.txt`.

We enumerate the domain using SharpHound. {% code overflow="wrap" %} ``` upload SharpHound.exe ``` {% endcode %} {% code overflow="wrap" %} ``` ./SharpHound.exe -c all ``` {% endcode %}

After ingesting the data we can see a bi-directional trust relationship between the child and parent domain controller. In a bidirectional trust, both domains honor Kerberos tickets issued by each other’s KDC. By compromising the child domain, we can extract its `krbtgt` key and forge a Golden Ticket.\ Since SID filtering is disabled, we can inject a privileged SID (e.g., Enterprise Admins from the parent domain) into the ticket’s `SIDHistory`. The parent domain will accept this SID, effectively granting us elevated privileges across the forest.

## DC01 ### Recon We use `rustscan -b 500 -a dc01.darkhaven.tech --top -- -sC -sV -Pn` to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts `-sC`, service and version detection `-sV`, and treats the host as online without ICMP echo `-Pn`. A batch size of `500` trades speed for stability, the default `1500` balances both, while much larger sizes increase throughput but risk missed responses and instability. {% code overflow="wrap" %} ``` rustscan -b 500 -a dc01.darkhaven.tech --top -- -sC -sV -Pn ``` {% endcode %}

### Access as administrator While attempting a Golden Ticket attack, the attempt initially failed because I had incorrectly identified the parent domain user I intended to impersonate. {% embed url="" %} So a fallback can be the Impackes raiseChild.py script. With raiseChild.py we perform a secretsdump and retreive the Administrators hash. > Impacket's [raiseChild.py](https://github.com/fortra/impacket/blob/master/examples/raiseChild.py) script can also be used to conduct the golden ticket technique automatically when SID filtering is disabled {% code overflow="wrap" expandable="true" %} ``` raiseChild.py 'corp.darkhaven.tech/ldap_svc:REDACTED' ``` {% endcode %}

We use the hash to connect to the final domain controller using the hash. We find the final flag at `C:\Users\Administrator\Dekstop\root.txt`. {% code overflow="wrap" expandable="true" %} ``` evil-winrm -i darkhaven.tech -u Administrator -H REDACTED ``` {% endcode %}