POSTS 2026-07-28

HTB: DarkZeroReturns

Heron is an advanced Active Directory scenario featuring complex multi-step exploitation chains including web entry points (like SSTI leading to RCE), cross-realm Kerberos trust abuses, CI/CD runner pivots, and forest trust navigation.

8664 words · 41 min

Hard Windows Season 11 Season of the Punk CVE-2026-33937 CVE-2026-22555 Cross-forest Golden ticket SeBackupPrivilege

Overview

Type Machines
Direct https://app.hackthebox.com/machines/DarkZeroReturns
OS Windows
Severity Hard
Creator 0xEr3bus & Pho3o
Release date 2026 Jul 26 (JST)

Enumeration

Nmap

$ nmap -sCV -Pn -p- --min-rate=1000 -T4 10.129.xx.xx
Starting Nmap 7.99 ( https://nmap.org ) at 2026-07-28 16:52 +0900
Nmap scan report for 10.129.xx.xx
Host is up (0.18s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.18 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 0c:4b:d2:76:ab:10:06:92:05:dc:f7:55:94:7f:18:df (ECDSA)
|_  256 2d:6d:4a:4c:ee:2e:11:b6:c8:90:e6:83:e9:df:38:b0 (ED25519)
80/tcp open  http    nginx 1.24.0 (Ubuntu)
|_http-server-header: nginx/1.24.0 (Ubuntu)
|_http-title: Did not follow redirect to http://dzcampaigns.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Add to /etc/hosts: echo ‘10.129.xx.xx dzcampaigns.htb’ | sudo tee -a /etc/hosts