Skip to main content
CPEBuddy
HackTheBox - DarkZero

HackTheBox - DarkZero

Source: YouTube · IppSec · published Apr 4, 2026 · 1:36:19

Penetration Testing
No ratings yet Log in to rate
Transcript Available
Description

This video covers the Hack The Box machine "Dark Zero," which the creator classifies as "easier than hard" due to several unintended privilege escalation vectors 0:07.

Key Takeaways:
• Initial access is achieved via credentials for Microsoft SQL Server, allowing pivoting to a linked server for code execution 0:09.
• The machine architecture involves a nested virtual machine, complicating the intended privilege escalation path 0:15.
• While the intended privesc is difficult, multiple unintended methods exist, including abusing a 2024 Windows CVE 0:20.
• An unintended vector involves abusing logon tokens, highlighting the inherent difficulty of securing Microsoft SQL 0:25.
• Another method involves coercing authentication to abuse NTLM relay, specifically the CVE Dakota found by the creator 0:33.

The machine serves as a case study for how complex security configurations often lead to multiple unintended attack paths.

Sources:

  • 0:07 Classification of the machine's difficulty.
  • 0:09 Initial access via Microsoft SQL.
  • 0:15 Nested VM architecture.
  • 0:20 Privesc via Windows CVE.
  • 0:25 Logon token abuse.
  • 0:33 NTLM relay abuse.

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 1.5 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

What's going on YouTube? This is IppSec. Today, we'll be doing Dark Zero from Hack The Box. And thanks to a couple of unintended methods, which are really cool, I think this machine's on the easier side of hard. We start off with creds to Microsoft SQL, and there's a linked server we can pivot to to get code execution. And this is just a nested VM. The intended way to privesc is somewhat difficult. However, there's a load of ways to privesc. I think most people abused a Windows CVE from 2024. There's also abusing the logon token, which was an unintended vector in this assigned machine because, well, securing Microsoft SQL is very hard. And then, I think there's one which is a CVE Dakota found where you can coerce an authentication and abuse NTLM relay. This is the partial mic remove method…