Part 12: Hacking DarkHaven (Full Network) - Hack Smarter Labs

This episode details the compromise of the CA server in the Dark Haven range by leveraging the CA service account NTLM hash to gain admin access and establish a Sliver session 0:19-0:32. The creator demonstrates using NetExec for command execution to bypass Windows Defender, retrieve the flag, and identify post-exploitation paths toward the domain controller 0:42-1:10.

Key Takeaways:
• Ldeep was essential for retrieving the CA service account NTLM hash after NetExec and BloodyAD failed 0:19-0:29
• The CA server was compromised by passing the NTLM hash via NetExec, granting local admin access 0:32-0:42
• A Sliver session was established on the CA server using NetExec to execute PowerShell commands and download a payload 0:42-0:55
• Post-exploitation reveals the CA service machine account has outbound object control, enabling enrollment in the Dark Haven CA 0:58-1:03
• Viewers are advised to avoid ADCS rabbit holes and focus on credential history to progress to the domain controller 1:03-1:10

The creator challenges viewers to perform independent post-exploitation to find credentials and advance toward the domain controller before the next installment.

Sources:

• 0:19 Recap of using Ldeep to retrieve CA service account NTLM hash
• 0:22 Explanation that NetExec and BloodyAD failed
• 0:32 Compromising the CA server via pass-the-hash
• 0:42 Establishing Sliver session using NetExec command exec