HackTheBox - Certified

Name: HackTheBox - Certified
Uploaded: 2025-03-15T15:00:47Z
Channel: IppSec
Description: 00:00 - Introduction 01:08 - Start of nmap discovering only Active Directory (AD) Related ports 04:15 - Running Certipy both with and without the vulner...

IppSec · Beginner ·🔐 Cybersecurity ·1y ago

00:00 - Introduction 01:08 - Start of nmap discovering only Active Directory (AD) Related ports 04:15 - Running Certipy both with and without the vulnerable flag 07:00 - Outputting Certipy to JSON and then writing a JQ Query that will show us non-default users that can enroll certificates 09:00 - Explaining the JQ Query that will take the list, filter out specific words, then show us items that still have an item 13:30 - Running Bloodhound.py to get some bloodhound data 16:00 - Looking at what Judith can do in Bloodhound, showing discovering by clicking outbound permissions 17:30 - Certipty ga…

Watch on YouTube ↗ (saves to browser)

Chapters (18)

Introduction

1:08 Start of nmap discovering only Active Directory (AD) Related ports

4:15 Running Certipy both with and without the vulnerable flag

7:00 Outputting Certipy to JSON and then writing a JQ Query that will show us non-d

9:00 Explaining the JQ Query that will take the list, filter out specific words, th

13:30 Running Bloodhound.py to get some bloodhound data

16:00 Looking at what Judith can do in Bloodhound, showing discovering by clicking o

17:30 Certipty gave us a high value target, can also use bloodhound to show us a pat

19:00 Abusing WriteOwner with owneredit, allowing us to add members with dacledit, a

23:30 Using Certipy to abuse GenericAll/GenericWrite to create a shadow credential a

30:08 Going over ESC9

31:20 Using Certipy to exploit ESC9, updating UPN, requesting cert, updating UPN, an

34:25 Grabbing the NTLM Hash of administrator with certipy, then logging in with Win

35:45 Showing the certificate we generated

40:40 Running SharpHound with a low privilege user to show it grabs more than the Py

43:35 Building a Cypher Query to match all users that have CanPSRemote to computers

46:45 Building a Cypher Query to show the shortest path from owned to the certificat

51:00 Changing our Cypher Query to show a specific user to the template

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →