active directory · HTB · HackThe Box · hack-the-box

Hack The Box - HTB DarkZero Returns Writeup - Hard - Weekly - July 25th, 2026

July 25, 2026

Difficulty: Hard · OS: Windows two-forest Active Directory, reached through a Linux edge host Chain: Handlebars AST type-confusion RCE → credential reuse → Gitea CI pipeline poisoning → service-account takeover → ksu name-collision local root → DA via reused DB password → cross-forest golden ticket (SID-filter bypass) → SeBackupPrivilege → DCSync → root 1. Redaction key & script conventions All instance-specific secrets are stripped: IPs, flags, passwords, hashes, SIDs, tokens. Every script below reads these from environment v…