HackTheBox - DarkCorp

Name: HackTheBox - DarkCorp
Uploaded: 2025-10-18T15:02:49Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Start of nmap 02:45 - Discovering the Contact Us form lets us send emails anywhere, also leaks the bcase user to the recipi...

IppSec · Beginner ·🔐 Cybersecurity ·5mo ago

00:00 - Introduction 01:00 - Start of nmap 02:45 - Discovering the Contact Us form lets us send emails anywhere, also leaks the bcase user to the recipient 05:30 - Discovering RoundCube Version and finding it is vulnerable to XSS, testing it against ourself with the contact us form 11:45 - Building a XSS CSRF Payload that will exfil all emails in the inbox 18:50 - Creating the Python HTTP Server to display emails sent from the XSS Payload, use Beautiful Soup to parse the HTML to only show important pieces 31:40 - Sending the XSS to bcase, getting his emails. Discovering a new subdomain, using …

Watch on YouTube ↗ (saves to browser)

Chapters (18)

Introduction

1:00 Start of nmap

2:45 Discovering the Contact Us form lets us send emails anywhere, also leaks the b

5:30 Discovering RoundCube Version and finding it is vulnerable to XSS, testing it

11:45 Building a XSS CSRF Payload that will exfil all emails in the inbox

18:50 Creating the Python HTTP Server to display emails sent from the XSS Payload, u

31:40 Sending the XSS to bcase, getting his emails. Discovering a new subdomain, usi

35:20 Finding SQL Injection in PostGres, checking if we are super user, discovering

38:00 Doing some light evasion using an eval like feature of PostGres so we can enco

47:30 Discovering an encrypted file, using the db password within .env of the webapp

54:20 Getting our first Active Directory user, running RustHound but there aren't ma

59:40 Logging into another page with Victor's credentials, we have an SSRF here

1:04:18 Using socat to set up a tunnel so we can have the target listen on a port and

1:08:30 Responder grabs a NetNTLMv2 Hash from the SSRF, showing the latest version of

1:15:05 Showing LDAP Signing is not enabled, using NTLMRelayx to forward our request t

1:22:20 Getting KRBRelayX Up and running so we can auth with ADCS

1:26:20 Using the PrinterBug to force the machine to make a request to our KRBRelay Se

1:31:40 Got a NTLM Hash f

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →