HackTheBox - Authority

Name: HackTheBox - Authority
Uploaded: 2023-12-09T15:04:48Z
Channel: IppSec
Description: 00:00 - Introduction 00:58 - Start of nmap 03:30 - Taking a look at the website 05:50 - Using NetExec to search for file shares and discovering the Deve...

IppSec · Beginner ·🔐 Cybersecurity ·2y ago

00:00 - Introduction 00:58 - Start of nmap 03:30 - Taking a look at the website 05:50 - Using NetExec to search for file shares and discovering the Development share is open. Using smbclient to download everything 08:00 - Exploring the Ansible Playbooks in the Development Share to discover encrypted passwords (ansible vault) 10:00 - Converting the Ansible Vault Hashes to John/Hashcat format so we can crack them 13:30 - Decrypting the values and getting some passwords, one of which lets us log into PWM (webapp) 19:50 - Adding a rogue ldap server into the PWM Config, then clicking test config wi…

Watch on YouTube ↗ (saves to browser)

Chapters (15)

Introduction

0:58 Start of nmap

3:30 Taking a look at the website

5:50 Using NetExec to search for file shares and discovering the Development share

8:00 Exploring the Ansible Playbooks in the Development Share to discover encrypted

10:00 Converting the Ansible Vault Hashes to John/Hashcat format so we can crack the

13:30 Decrypting the values and getting some passwords, one of which lets us log int

19:50 Adding a rogue ldap server into the PWM Config, then clicking test config will

27:00 Running Certipy to find the server is vulnerable to ESC1, we just need to enro

28:00 Using NetExec to show how the MachineAccoutnQuote, confirming we can enroll ma

29:00 Using Impacket to add a rogue computer

30:00 Using Certipy to perform the ESC1, it works but smart card login isn't enabled

33:30 Looking at the error message, finding we can PassTheCert to LDAP which then wi

37:15 Using PassTheCert to add ourselves to the Domain Administrator group

39:25 Showing PassTheSert to set_rbcd, which will enable our rogue computer the abil

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →