GS-038: SHADOWGATE (P3) + CITY COUNCIL — ESC8 + Recon (HackSmarter) | 2026-09-03

The streamer completes the "Shadowgate" Hackmarter lab by exploiting an ESC8 Active Directory vulnerability to gain domain controller access, then begins a blind penetration test of the "City Council" machine, identifying initial reconnaissance findings before pausing to address tool compatibility issues.

Key Takeaways:
• The "Shadowgate" lab was completed by exploiting an ESC8 vulnerability in the Active Directory Certificate Services (ADCS), which allowed the interception of a certificate to authenticate as a machine account 15:40.
• Two methods were demonstrated for certificate relaying: using InveighRelayX and CertifyRelay, with the latter automatically detecting the template while the former required specific flags to handle ADCS correctly 29:10.
• After obtaining the certificate, the streamer used Rubeus to request a TGT and then SecretsDump to perform a DC Sync, successfully dumping the full Active Directory database and retrieving the KRBTGT hash to finish the lab 44:30.
• For the new "City Council" challenge, the streamer utilized Nmap with a comprehensive script to identify open ports and services, noting the presence of a website on the domain controller and a custom executable binary 38:00.
• The streamer highlighted the importance of having multiple tool options for redundancy, noting that if one tool fails due to dependency issues (like Python SSL conflicts), having an alternative like CertifyRelay ensures progress 31:25.
• The streamer announced a co-stream with Pentest TV (Tom Willm) for the upcoming Sunday, encouraging viewers to join the discussion and check out Leland’s free Junior Web Hacker academy 38:00.

The streamer emphasizes that understanding the underlying mechanics of attacks, such as AD CS vulnerabilities, is crucial for real-world penetration testing. He also stresses the value of writing detailed reports and writeups to solidify learning and professional practice.

Sources:

• 15:40 Discussion of the ESC8 vulnerability and initial setup for the Shadowgate lab.
• 29:10 Demonstration of using CertifyRelay as an alternative to InveighRelayX.
• 44:30 Execution of SecretsDump to retrieve the KRBTGT hash and complete the lab.
• 38:00 Initial Nmap scan of the City Council machine and identification of open services.
• 31:25 Commentary on the importance of having multiple tools and options for reliability.
• 38:00 Announcement of the upcoming Sunday stream with Pentest TV.