HackTheBox - Blazorized

Name: HackTheBox - Blazorized
Uploaded: 2024-11-09T15:05:50Z
Channel: IppSec
Description: 00:00 - Introduction 01:30 - Start of nmap 03:30 - Examining the website looking for interesting functionality 07:50 - The check updates page loads a un...

IppSec · Beginner ·🔐 Cybersecurity ·1y ago

00:00 - Introduction 01:30 - Start of nmap 03:30 - Examining the website looking for interesting functionality 07:50 - The check updates page loads a unique DLL and puts a JWT in the request 12:30 - Opening Blazorized.Helpers.Dll with ilSpy to discover a hardcoded JWT 15:27 - Using Burp to add the header to all of our requests and installing the Blazor Traffic Processor Plugin 19:00 - Examining the traffic, discovering the server instructs our client to get a JWT from localstorage 22:00 - Discovering MSSQL Injection in the Super Admin Panel, getting RCE 29:30 - Reverse shell returned 31:56 - R…

Watch on YouTube ↗ (saves to browser)

Chapters (16)

Introduction

1:30 Start of nmap

3:30 Examining the website looking for interesting functionality

7:50 The check updates page loads a unique DLL and puts a JWT in the request

12:30 Opening Blazorized.Helpers.Dll with ilSpy to discover a hardcoded JWT

15:27 Using Burp to add the header to all of our requests and installing the Blazor

19:00 Examining the traffic, discovering the server instructs our client to get a JW

22:00 Discovering MSSQL Injection in the Super Admin Panel, getting RCE

29:30 Reverse shell returned

31:56 Running SharpHound, then standing up a WebDAV server on nginx so we can use fi

39:00 Starting Bloodhound discovering we can SetSPN on another user

45:20 Setting the SPN on a user via Powerview, which lets us kerberoast to get a has

50:20 Using PowerView Find-InterestingDomainAcl to show unique things our user can d

58:50 Using AccessChk to find a writable directory in the SYSVOL Directory

1:03:50 Using Powerview to set the Login Script to our file and getting a shell

1:10:00 Using mimikatz to dcsync and get the administrator password

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →