HTB DarkZero Returns Complete Writeup: CVE-2026-33937 (Handlebars AST Injection), Gitea Actions Abuse and Cross Forest Trust Root Escalation
DarkZero Returns is a HackTheBox Season 11 Hard machine built around a two forest Active Directory environment fronted by a single Linux edge host. The chain starts with an unauthenticated Handlebars AST injection in the campaign_message field of a D&D style web app, granting a reverse shell on SRV01. From there, exposed SSH credentials for the domain user josh lead into a Gitea instance reachable through Kerberos SSPI, where a malicious Actions workflow injected via a fork and pull request executes as svc-runner and discloses user.txt. Reaching root.txt requires pivoting a SOCKS tunnel into the internal 172.16.20.0/24 network, then chaining a delegated Active Directory OU right into local root on SRV01, cracking a Domain Admin NTLM hash recovered from a database backup, and forging a golden ticket with a cross forest extra SID to abuse loose SID filtering and land Backup Operators rights on the second forest's Domain Controller.
Jul 28, 2026