HackTheBox - Blackfield

Name: HackTheBox - Blackfield
Uploaded: 2020-10-03T14:57:59Z
Channel: IppSec
Description: 00:00 - Intro 01:00 - Start of nmap 03:00 - Enumerating fileshares with SMBClient and CrackMapExec, highlighting some picky syntax 06:15 - Mounting the ...

IppSec · Beginner ·🔐 Cybersecurity ·5y ago

00:00 - Intro 01:00 - Start of nmap 03:00 - Enumerating fileshares with SMBClient and CrackMapExec, highlighting some picky syntax 06:15 - Mounting the profiles$ directory so we can build a username list 09:00 - Using Kerbrute to enumerate valid usernames 13:40 - Running GetNPUsers to perform an ASREP Roast 17:50 - Checking what we can do with the Support User from the ASREP Roast 20:45 - Running the python Bloodhound ingestor from Linux 27:55 - Bloodhound ran, playing around with the data, eventually seeing support can reset audit2020's password 32:20 - Setting an Windows users (Audit2020) pa…

Watch on YouTube ↗ (saves to browser)

Chapters (21)

Intro

1:00 Start of nmap

3:00 Enumerating fileshares with SMBClient and CrackMapExec, highlighting some pick

6:15 Mounting the profiles$ directory so we can build a username list

9:00 Using Kerbrute to enumerate valid usernames

13:40 Running GetNPUsers to perform an ASREP Roast

17:50 Checking what we can do with the Support User from the ASREP Roast

20:45 Running the python Bloodhound ingestor from Linux

27:55 Bloodhound ran, playing around with the data, eventually seeing support can re

32:20 Setting an Windows users (Audit2020) password from linux using RPCClient

36:45 Audit2020 has access to the forensic share which has a memory dump of lsass, r

42:20 Using Evil-WinRM to access the box as SVC_Backup and discovering the backup pr

43:30 Failing to get WBADMIN to send a backup file to impacket

47:30 Creating a NTFS Block Device/Partition but does not fix our impacket issues

49:45 Editing samba to create a windows fileshare from linux. Purposefully don't po

54:54 Pointing samba to our NTFS Directory, to show it works much better

55:50 Running wbadmin to create a backup to our fileshare and include ntds.dit

57:00 Running wbadmin to restore a ntds.dit out of our backup and creating a backup

1:02:00 Using secretsdump to extract credentials out of the Active Directory database

1:04:20 Showing you can't grab the flag as SYSTEM user due to EFS (Encrypted File Syst

1:12:30 Using Mimikatz to restore the password of Audit2020, so it's like we were neve

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →