Part 8: Hacking DarkHaven (Full Network) - Hack Smarter Labs

In this eighth installment of the Dark Haven range, we leverage Inveigh on the compromised Share machine to poison LLMNR requests, capturing the NTLMv2 hash for the SVC webpool account. By utilizing a specific IT security wordlist found in earlier enumeration rather than standard tools, we successfully crack the hash to reveal the password "Dark Haven 128," granting access to the Web server.

Key Takeaways:
• Inveigh serves as the Windows equivalent to Responder for SMB/LLMNR poisoning, requiring the latest compiled version to bypass Windows Defender 13:45
• Captured hashes must be cracked using environment-specific wordlists (e.g., IT security list) rather than generic dictionaries like rockyou.txt to succeed 21:30
• The cracked credentials for SVC webpool provide access to the web.external.darkhaven.local SMB share, marking progress toward the next objective 24:15

By paying attention to subtle enumeration details like historical password lists, you can bypass common cracking failures and advance through the range. Subscribe to stay updated on future live streams and join the community for hands-on practice.

Sources:

• 0:00 Introduction and series context
• 0:12 Advice for new viewers
• 0:18 Platform access instructions
• 13:45 Using Inveigh for LLMNR poisoning
• 21:30 Cracking the hash with specific wordlists
• 24:15 Validating SVC webpool credentials