Skip to content
HackIndex.io

DarkZeroReturns Writeup - HackTheBox

Hard Windows
Discuss on Discord

Created June 15, 2026 • Last updated July 30, 2026 • 6 min read

Khant-Nyar

Pentester, Learner, Builder

Would you like to solve this machine together? Join our discord and/or our open HTB team!

Domains: darkzeroreturns.htb darkzero.htb darkzero.ext dzcampaigns.htb

Join the HackIndex community

Share writeups, ask questions, and stay current with techniques. Over 500 members.

Join Discord (opens in new tab)

Hard-difficulty Windows box

Reconnaissance

Port scan

┌──(kali㉿kali)-[~]
└─$ ping -c2 "$TARGET_IP"
┌──(kali㉿kali)-[~]
└─$ nmap -sCV -oN scans/edge-sCV.nmap "$TARGET_IP" 
PING <edge IP> (<edge IP>) 56(84) bytes of data.
64 bytes from <edge IP>: icmp_seq=1 ttl=127 time=44.4 ms
64 bytes from <edge IP>: icmp_seq=2 ttl=127 time=45.6 ms

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.18
80/tcp open  http    nginx 1.24.0 (Ubuntu)
|_http-title: Did not follow redirect to http://dzcampaigns.htb/
Service Info: OS: Linux

Only SSH and HTTP. HTTP immediately redirected to the dzcampaigns.htb vhost, so the first move was adding the host entry and enumerating the web app.

┌──(kali㉿kali)-[~]
└─$ echo "$TARGET_IP dzcampaigns.htb" | sudo tee -a /etc/hosts
┌──(kali㉿kali)-[~]
└─$ ffuf -u "http://dzcampaigns.htb/FUZZ" \
-w /usr/share/wordlists/dirb/big.txt -t 80 -fc 404 
Login       [Status: 200, Size: 1509]
css         [Status: 301, Size: 153]
dashboard   [Status: 302, Size: 28]
dice        [Status: 200, Size: 2126]

Protected Writeup

This has not retired yet on HackTheBox. We only publish writeups for retired machines and challenges. Once it retires, this writeup will become publicly accessible.